The ExLoader Installer exe File Malware Analysis

Technical Analysis

File Name	ExLoader_Installer.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.229.174
Database Version	2025-11-26 13:00:26 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	a8c0f0b0ea26dc9673b2597268f6a372
SHA1	703b61482fe9ce008ed2abde6ab247114c0cae05
SHA256	1f114d5fd6f25da761d3314b008bce3e76bfc6e9f1cfc782c41873c46407d84b
SHA512	f57161dae3865cda6b43526557b309319cf26953d6eaeecd0e5df96d99223da9259aa6af8bb0c48f15c7ee917ba41fbea05e721811b8702e94d708add4a1e0f0
ImpHash	5f5c4d3663cd5c9660ea403fe416cb2f

PE Analysis

Basic Information

▼

Icon	Hash: 54cdabf0f7ab56c546ddf3e68caca124 Fuzzy: 1d0d9a9a22ae650979020cb167748e27 dHash: cc8e616565618ecc
Image Base	`0x140000000`
Entry Point	`0x14000a9ec`
Compilation Time	2009-08-16 11:05:47
Checksum	0x00000000 (Actual: 0x016b6a38)
OS Version	5.2
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB Path	`d:\Projects\WinRAR\SFX\build\sfxzip64\Release\sfxzip.pdb`
Digital Signature	No valid SignedData structure was found.
Imports	8 libraries COMCTL32, KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, ole32, OLEAUT32
Exports	0 functions
Resources	27 Resources
Sections	6 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	59,600 bytes	59,904 bytes	6.33 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`A9AAF0ED852ECA686692376386A46424`
`.rdata`	`0x00010000`	9,411 bytes	9,728 bytes	4.96 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9156DFB36689B5B1CA7A2133B8B2C6FA`
`.data`	`0x00013000`	107,072 bytes	512 bytes	1.57 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E02B9BFA924D4A1C8C6EC20B0F2CB82D`
`.pdata`	`0x0002e000`	3,000 bytes	3,072 bytes	4.77 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`764374D0A948AEDFF2D427F53047267A`
`.CRT`	`0x0002f000`	32 bytes	512 bytes	0.28 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1D54CD6223B3E31E46DE866C00B33853`
`.rsrc`	`0x00030000`	113,204 bytes	113,664 bytes	7.10 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5F8DE02527350C7AE7568CDB8AFC2C7F`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 27 (111,590 bytes)

Resource Type	Count	Total Size	Percentage
RT_BITMAP	1	2,998 bytes	2.7%
RT_ICON	13	101,350 bytes	90.8%
RT_DIALOG	6	2,844 bytes	2.5%
RT_STRING	5	2,746 bytes	2.5%
RT_GROUP_ICON	1	188 bytes	0.2%
RT_MANIFEST	1	1,464 bytes	1.3%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The ExLoader_Installer.exe File Analysis