File Name | RuntimeBroker.exe |
File Type |
PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
|
Scanner Version | 1.0.216.174 |
Database Version | 2025-05-10 02:00:17 UTC |
Malware family: CoinMiner
Hash Type | Value | Action |
---|---|---|
MD5 |
4c61df8c33061b3b8d398c84f544ddaa
|
|
SHA1 |
0cd42419ffeef90825055c38c3ef1690d701adf7
|
|
SHA256 |
2b0146bc831b7c54b5527ea8c26a9153f410ec5efce19bb97499ffc9fd29d4b3
|
|
SHA512 |
59c6e4485ec506f7df9c527d534c49d6c46e1cce624db4c9f52a27cd4655a1a52e2eb3653cd2b09bdc7f1f58efd5e1da3a3f299dba1ce10620471ccd1cbbbdbe
|
|
ImpHash |
aca9431aa96d3f2a923773f5c3fa0d02
|
Icon |
Hash: e35ef5b40987be4a81b37bdb1b3a8730
Fuzzy: 67b5702929aead99d08ec74265d272c5 dHash: e8f4b4d959d6a6f8 |
Image Base | 0x00400000 |
Entry Point | 0x004014a0 |
Compilation Time | 2019-09-28 16:12:57 |
Checksum | 0x002dc146 (Actual: 0x002dc146) |
OS Version | 4.0 |
PEiD Signatures |
PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
|
Digital Signature | No valid SignedData structure was found. |
Imports |
8 libraries
ADVAPI32, IPHLPAPI, KERNEL32, msvcrt, PSAPI, USER32, USERENV, WS2_32 |
Exports | 0 functions |
Resources | 7 Resources |
Sections | 10 Sections |
CompanyName | www.xmrig.com |
FileDescription | XMRig CPU miner |
FileVersion | 3.2.0 |
LegalCopyright | Copyright (C) 2016-2019 xmrig.com |
OriginalFilename | xmrig.exe |
ProductName | XMRig |
ProductVersion | 3.2.0 |
Translation | 0x0000 0x04b0 |
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
2,520,568 bytes | 2,520,576 bytes | 6.33 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_64BYTES
|
BF914D3672ED5605CB3FE765439226CF |
.data |
0x00269000 |
13,792 bytes | 13,824 bytes | 0.45 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES
|
85712F7E848A160A720DB624FBDA334D |
.rdata |
0x0026d000 |
195,072 bytes | 195,072 bytes | 5.66 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_64BYTES
|
345B673E10E89FBD16530F2074B625DD |
.pdata |
0x0029d000 |
79,008 bytes | 79,360 bytes | 6.16 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
B8F484E4CC47C68FAD44F779E9323793 |
.xdata |
0x002b1000 |
115,028 bytes | 115,200 bytes | 5.22 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
7EA489245F5BBCED7577E0988FED1214 |
.bss |
0x002ce000 |
3,218,848 bytes | 0 bytes | 0.00 (Normal) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_64BYTES
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x005e0000 |
14,748 bytes | 14,848 bytes | 4.62 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
AEBDF29C717AAADBFEA82DD9D9DE250D |
.CRT |
0x005e4000 |
112 bytes | 512 bytes | 0.33 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES
|
DAF8376ED9E417167601C08E8FEBD388 |
.tls |
0x005e5000 |
16 bytes | 512 bytes | 0.00 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x005e6000 |
23,784 bytes | 23,784 bytes | 5.54 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
776820D480E6AFD2925F34C1D61D6EF1 |
Resource Type | Count | Total Size | Percentage |
---|---|---|---|
RT_ICON | 4 | 21,427 bytes | |
RT_GROUP_ICON | 1 | 62 bytes | |
RT_VERSION | 1 | 652 bytes | |
RT_MANIFEST | 1 | 1,167 bytes |
This file is not digitally signed.
⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources
No valid SignedData structure was found.
Recommendation: Verify the file source and ensure it comes from a trusted publisher.
Gridinsoft has the capability to identify and eliminate Trojan.Win64.CoinMiner.ca without requiring further user intervention.
Download Anti-MalwareFollow these steps to completely remove the threat from your system