Gridinsoft Logo
File Icon

The processhacker-2.39-setup.exe (Process Hacker Setup) File Analysis

Updated 7 months ago
Checked by Malware Check
processhacker-2.39-setup.exe

Technical Analysis

File Name processhacker-2.39-setup.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows
SSDEEP Hash
49152:l9hfV/U5NkLXXzGZjt6kFTCVP6hWE0wvmk/eE+FrAl+NGsOSE6IX8pq:Dh9/ULkjKxtTGP6VZd2rAcvOSE6Nq
Scanner Version 1.0.194.174
Database Version 2024-10-28 16:00:29 UTC
⚠

Suspicious File Detected

Detected by 32 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
45%
Detection Rate
2,267,848
File Size (bytes)
32/71
Engines Detected
2024-10-28
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
54daad58cce5003bee58b28a4f465f49
SHA1
162b08b0b11827cc024e6b2eed5887ec86339baa
SHA256
28042dd4a92a0033b8f1d419b9e989c5b8e32d1d2d881f5c8251d58ce35b9063
SHA512
8330de722c8800ff64c6b9ea16a4ff7416915cd883e128650c47e5cb446dd3aaa2a9ba5c4ecda781d243be7fb437b054bbcf942ea714479e6cc3cef932390829
ImpHash
884310b1928934402ea6fec1dbd3cf5e

Security Engines with Detections (32 of 71)

Bkav
W32.Common.8261D340 Malicious
Lionic
Riskware.Win32.ProcHack.1!c Malicious
CAT-QuickHeal
HackTool.ProcHacker.P5 Malicious
VIPRE
Application.ProcessHacker.1 Malicious
K7AntiVirus
Unwanted-Program ( 005447311 ) Malicious
K7GW
Unwanted-Program ( 005447311 ) Malicious
Cyren
W32/ProcessHacker.C.gen!Eldorado Malicious
Symantec
Hacktool.ProcHack Malicious
Kaspersky
not-a-virus:HEUR:RiskTool.Win32.ProcHack.gen Malicious
BitDefender
Application.ProcessHacker.1 Malicious
Emsisoft
Application.ProcessHacker.1 (B) Malicious
DrWeb
Tool.ProcessHacker.3 Malicious
TrendMicro
PUA.Win32.ProcHack.A Malicious
FireEye
Application.ProcessHacker.1 Malicious
Sophos
Process Hacker (PUA) Malicious
Jiangmin
RiskTool.ProcHack.hi Malicious
Webroot
W32.Riskware.Processhacker Malicious
Antiy-AVL
Trojan/Win32.SGeneric Malicious
Xcitium
ApplicUnwnt@#134ggy9regjgg Malicious
Arcabit
Application.ProcessHacker.1 Malicious
ZoneAlarm
not-a-virus:HEUR:RiskTool.Win32.ProcHack.gen Malicious
GData
Application.ProcessHacker.1 Malicious
Google
Detected Malicious
ALYac
Misc.Riskware.ProcHack Malicious
Cylance
unsafe Malicious
Panda
HackingTool/ProcHack Malicious
TrendMicro-HouseCall
PUA.Win32.ProcHack.A Malicious
Yandex
Riskware.ProcessHacker!Z+ABec4nlz0 Malicious
MaxSecure
Trojan.Malware.10181834.susgen Malicious
Fortinet
Riskware/ProcHack Malicious
DeepInstinct
MALICIOUS Malicious
CrowdStrike
win/grayware_confidence_100% (W) Malicious
39 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 269727acacba789cd7a93601617416ed
Fuzzy: c2b74ba8bb134400487ce1be7b5c9c96
dHash: f8a48686aeb6f3e0
Image Base 0x00400000
Entry Point 0x0040a5f8
Compilation Time 1992-06-19 22:22:17
Checksum 0x0022e77b (Actual: 0x0022e77b)
OS Version 1.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature OK
Imports 5 libraries
kernel32, user32, oleaut32, advapi32, comctl32
Exports 0 functions
Resources 23 Resources
Sections 8 Sections

Version Information

▼
Comments This installation was built with Inno Setup.
CompanyName wj32
FileDescription Process Hacker Setup
FileVersion 2.39 (r124)
LegalCopyright Copyright © 2010-2016, Process Hacker Team. Licensed under the GNU GPL, v3.
ProductName Process Hacker
ProductVersion 2.39 (r124)
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
CODE 0x00001000 40,240 bytes 40,448 bytes 6.63 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 611A4D7A24DD9B18A256468A5D7453F5
DATA 0x0000b000 592 bytes 1,024 bytes 2.75 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2F7F9F859C8B4B133ABF78CEBD99CC90
BSS 0x0000c000 3,728 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.idata 0x0000d000 2,384 bytes 2,560 bytes 4.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BB5485BF968B970E5EA81292AF2ACDBA
.tls 0x0000e000 8 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x0000f000 24 bytes 512 bytes 0.20 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 9BA824905BF9C7922B6FC87A38B74366
.reloc 0x00010000 2,244 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.rsrc 0x00011000 104,316 bytes 104,448 bytes 7.30 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 98F54B0DE9ADC0A4FF04354819FCF891
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 23 (103,025 bytes)
Resource Type Count Total Size Percentage
RT_ICON 13 97,235 bytes
94.4%
RT_STRING 6 2,710 bytes
2.6%
RT_RCDATA 1 44 bytes
0%
RT_GROUP_ICON 1 188 bytes
0.2%
RT_VERSION 1 1,268 bytes
1.2%
RT_MANIFEST 1 1,580 bytes
1.5%

Certificate Chain Analysis

▼
Certificate Information
Product Process Hacker
Description Process Hacker Setup
File Version 2.39 (r124)
Signing Date 01:35 AM 03/29/2016 (3365 days ago)
Verification Status Signed
Signers Wen Jia Liu; DigiCert High Assurance Code Signing CA-1; DigiCert
Counter Signers DigiCert Timestamp Responder; DigiCert Assured ID CA-1; DigiCert
Copyright Copyright © 2010-2016, Process Hacker Team. Licensed under the GNU GPL, v3.
Certificate Chain Summary
Wen Jia Liu #1 Primary
Validity Period: 2013-10-30 00:00:00 → 2017-01-04 12:00:00
Signature Algorithm: sha1RSA
Serial Number: 0F F1 EF 66 BD 62 1C 65 B7 4B 4D E4 14 25 71 7F
DigiCert Timestamp Responder #2 Chain
Validity Period: 2014-10-22 00:00:00 → 2024-10-22 00:00:00
Signature Algorithm: sha1RSA
Serial Number: 03 01 9A 02 3A FF 58 B1 6B D6 D5 EA E6 17 F0 66
DigiCert High Assurance Code Signing CA-1 #3 Chain
Validity Period: 2011-02-11 12:00:00 → 2026-02-10 12:00:00
Signature Algorithm: sha1RSA
Serial Number: 02 C4 D1 E5 8A 4A 68 0C 56 8D A3 04 7E 7E 4D 5F
DigiCert Assured ID CA-1 #4 Chain
Validity Period: 2006-11-10 00:00:00 → 2021-11-10 00:00:00
Signature Algorithm: sha1RSA
Serial Number: 06 FD F9 03 96 03 AD EA 00 0A EB 3F 27 BB BA 1B
Wen Jia Liu #5 Chain
Validity Period: 2013-10-30 00:00:00 → 2017-01-04 12:00:00
Signature Algorithm: sha256RSA
Serial Number: 04 0C B4 1E 4F B3 70 C4 5C 43 44 76 51 62 58 2F
DigiCert SHA2 High Assurance Code Signing CA #6 Chain
Validity Period: 2013-10-22 12:00:00 → 2028-10-22 12:00:00
Signature Algorithm: sha256RSA
Serial Number: 0B 7E 10 90 3C 38 49 0F FA 2F 67 9A 87 A1 A7 B9
DigiCert SHA2 Timestamp Responder #7 Chain
Validity Period: 2015-12-24 00:00:00 → 2025-01-07 00:00:00
Signature Algorithm: sha256RSA
Serial Number: 02 CE 42 94 59 02 A4 F3 C0 40 B0 FF 77 93 D1 4F
DigiCert SHA2 Assured ID Timestamping CA #8 Chain
Validity Period: 2016-01-07 12:00:00 → 2031-01-07 12:00:00
Signature Algorithm: sha256RSA
Serial Number: 0A A1 25 D6 D6 32 1B 7E 41 E4 05 DA 36 97 C2 15

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
32 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware