Gridinsoft Logo
File Icon

Patch.exe Trojan Wacatac Analysis

Updated 13 days ago
Checked by Malaware Check
Patch.exe

Technical Analysis

File Name Patch.exe
File Type
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Scanner Version 1.0.217.174
Database Version 2025-05-23 02:00:12 UTC
⚠

Trojan.Win32.Wacatac.cl

Malware family: Wacatac

Wacatac malware demonstrates multiple malicious capabilities including data theft, system compromise, and secondary payload deployment. It can download additional malware components including ransomware to extend attack impact.
N/A
Detection Rate
2,334,720
File Size (bytes)
2025-05-23
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
2e97802dd27ecaedfd7b576afe9267cf
SHA1
1d4ddc971dc5ba6201b414d86e37b99523b0d85c
SHA256
220c8084bbed37f54fbba4c5d50d8ceeb3099bac0ef4041f56ab725678213abc
SHA512
0573bc870bdc7624ad76ad290988c82f511e6bfdf7e3805758b83c89b30da784bc83e224ca54210f21722d029d283d09fb918a387b92f6b0b45bb1c24e81f869
ImpHash
27217db43315c86e6bc0c26023e9cfe0

PE Analysis

Basic Information

▼
Icon
Hash: d142e9cafb9de40d8f480cc4c1126452
Fuzzy: 331e5aadfe7e102734662ad03844dd6b
dHash: e88e272f16178ee8
Image Base 0x00400000
Entry Point 0x0086250e
Compilation Time 2023-06-18 14:49:18
Checksum 0x00000000 (Actual: 0x002425ee)
OS Version 6.0
PEiD Signatures PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 11 libraries
Exports 9 functions
Resources 54 Resources
Sections 11 Sections

Version Information

▼
CompanyName H Hayat
FileDescription SketchUp Pro v23.x [Patch v1.3.1]
FileVersion 1.3.1.0
InternalName Patch.exe
LegalCopyright Copyright (C) 2023 H Hayat
OriginalFilename Patch.exe
ProductName SketchUp Pro v23.x [Patch v1.3.1]
ProductVersion 1.3.1.0
Translation 0x0409 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 3,194,880 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.data 0x0030d000 225,280 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.tls 0x00344000 4,096 bytes 1,024 bytes 0.03 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 91CCB28EB66F40FB9808FD088DA27BA6
.rdata 0x00345000 4,096 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.idata 0x00346000 16,384 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.didata 0x0034a000 4,096 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.edata 0x0034b000 4,096 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.UPX0 0x0034c000 631,148 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.UPX1 0x003e7000 2,055,104 bytes 2,055,168 bytes 7.94 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ A257F3B322E5EBF20091B47EB243A1BA
.reloc 0x005dd000 288 bytes 512 bytes 2.79 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 2895EF239D2F4AA432E2ECF26EFA3498
.rsrc 0x005de000 442,160 bytes 276,480 bytes 2.82 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 2E8C3D53BCBDBE978AEA711D506CB02C
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 54 (439,109 bytes)
Resource Type Count Total Size Percentage
VCLSTYLE 1 124,332 bytes
28.3%
RT_CURSOR 8 2,464 bytes
0.6%
RT_ICON 1 270,376 bytes
61.6%
RT_STRING 27 24,356 bytes
5.5%
RT_RCDATA 6 14,807 bytes
3.4%
RT_GROUP_CURSOR 8 160 bytes
0%
RT_GROUP_ICON 1 20 bytes
0%
RT_VERSION 1 780 bytes
0.2%
RT_MANIFEST 1 1,814 bytes
0.4%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Wacatac.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Wacatac.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware