MapleStory.exe Trojan Heuristic Analysis

Trojan Heuristic

Updated on 2024-07-06 (3 months ago)

Online Virus Checker	v.1.0.181.174
DB Version:	2024-07-06 15:00:21

Trojan.Heur!.03A50421

The "Heur" stands for "heuristic," which means we use a set of rules, algorithms, or behavioral analysis to detect potential threats that may not have a specific, known signature. It's a proactive approach to identifying suspicious behavior or code patterns that could indicate the presence of a Trojan or other malware. The file's behavior or characteristics triggered the heuristic analysis as potentially malicious. However, it doesn't necessarily confirm that the file is indeed a Trojan. It could be a false positive, where a legitimate program exhibits behavior that resembles malicious activity.

File	MapleStory.exe
Checked	2024-07-06 12:18:53
MD5	2777e16b8a92acc3e3593001d0d6803a
SHA1	b6582396de9718be0e9445308894f67f01e2e73e
SHA256	22b009cd79c3425986393d0823ec1b2f2a79dd5017319312522e48e88b2da2c4
SHA512	4eab0b1163a6f7d4f4e96262ec615e79a1d5c3f3d04c52d3254b4c69b77cdefcfb70220abb8821f142356f210f748367d6cbc4f77fe87f9d3308134224e564e0
Imphash	c57c26799122050c71e3fe2c4d464c40
File Size	11401763 bytes

Trojan.Heur!.03A50421 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.03A50421 without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

CompanyName	Wizet
FileDescription	MapleStory
FileVersion	1, 0, 0, 1
InternalName	MapleStory
LegalCopyright	Copyright ⓒ 2003
OriginalFilename	MapleStory.exe
ProductName	Wizet MapleStory
ProductVersion	1, 0, 0, 1
Translation	0x0412 0x04b0

Portable Executable Info

	00bd778b5a457c394f982ab2a68874b4 8c9a73ee1b3cbf27885ec5df62539a91 b970e0f2fcdaf2f0
Image Base:	0x00400000
Entry Point:	0x01475058
Compilation:	2010-08-17 23:46:29
Checksum:	0x00adfb64 (Actual: 0x00adfb64)
OS Version:	4.0
PEiD:	PE32 executable (GUI) Intel 80386, for MS Windows
Sign:	The PE file does not contain a certificate table.
Sections:	18
Imports:	kernel32, advapi32, dinput8, gdi32, oleaut32, shell32, user32, version, wininet, winmm, ws2_32, wzmss, aossdk, ijl15, iphlpapi, mss32, ole32, 109DLL_protected,
Exports:	3
Resources:	5

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
	0x00001000	0x0070f000	0x0070f000	24e253ac741c8d51cfe6f06886d5f987	6.57
	0x00710000	0x0009f000	0x0009f000	6101093404eeb0fae9af3e3ea1b2b6c1	4.48
	0x007af000	0x00059000	0x00059000	54dde0091deb44bc8daca66a30c942f4	6.07
	0x00808000	0x00032000	0x0002fa6d	f203e569b62bcaadec8f23b21a6e9d4d	7.97
	0x0083a000	0x00001000	0x00000063	48d57a63d01a2932d8b2a39c4c17ef91	6.15
	0x0083b000	0x0003f000	0x0003f000	cf59e30576a19027bb0177f567b9b9d5	7.96
	0x0087a000	0x00001000	0x00000007	0e4cec6133a3af9038d68f9341733ff5	2.81
	0x0087b000	0x00005000	0x0000047a	7346343ba4801da8d923a4232b51b8ba	7.85
	0x00880000	0x00002000	0x00000062	505fa61a0301a5a6969e0774771d0d03	6.15
	0x00882000	0x00401000	0x00000a1b	0d65e9ef85f8a161546eb5bbd95e8a87	7.83
	0x00c83000	0x000011a1	0x00000011	6889418ccc6256280ec5e010f7197c6c	3.85
	0x00c85000	0x00001000	0x00000007	c6aeacf777e3b251ab3dfe5d8729e6ff	2.81
	0x00c86000	0x00003000	0x00000457	b01a376f3fbeb0335e403d79bb24fc98	7.73
.exports	0x00c89000	0x00001000	0x00001000	7e54a9f70ef495285298eac23adcb0e2	0.30
.imports	0x00c8a000	0x00001000	0x00001000	d174c02600085c22d759adf51c397232	1.51
.rsrc	0x00c8b000	0x00002000	0x00002000	f415992bdfe3c41e309e030a0f01eb7c	2.36
.themida	0x00c8d000	0x003e8000	0x00000000	d41d8cd98f00b204e9800998ecf8427e	0.00
.boot	0x01075000	0x0025d000	0x0025ca23	5ff104a06883edcf99879e6dbbea2048	7.96