Gridinsoft Logo
File Icon

The formatfactory-4-6-1-0.exe (Format Factory Video/Audio/Picture Converter) File Analysis

Updated 1 year ago
Checked by Malware Check
formatfactory-4-6-1-0.exe

Technical Analysis

File Name formatfactory-4-6-1-0.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
SSDEEP Hash
1572864:9Fa/EwoM+GaUS0jO8vqmPhCOF6Nfqw53AP/b1dDgufw:9Fap+GHqmP/F6N2vDO
Scanner Version 1.0.181.174
Database Version 2024-07-02 21:00:19 UTC
⚠

Suspicious File Detected

Detected by 26 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
38%
Detection Rate
71,385,664
File Size (bytes)
26/68
Engines Detected
2024-07-02
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
6af91b235681396ac6f4aec860f74465
SHA1
66874294436c1558bf4745faf3d8e31dc47864c6
SHA256
2bda7312cc2376f702b824a443673407ddb8886d56eaa4b2c9492bb6c1e0b2b1
SHA512
85952ec7b9cfb9c42f7678c3bc51a907ff9cdb80245750723227a1671d98da1976afb6f10ea46ba2018cd7fff10ebd9f0c188b30bc1c1814c871c5f170bdd706
ImpHash
4ea4df5d94204fc550be1874e1b77ea7

Security Engines with Detections (26 of 68)

Bkav
W32.AIDetectMalware Malicious
FireEye
Generic.mg.6af91b235681396a Malicious
Skyhigh
FusionCore Malicious
ALYac
Gen:Variant.Application.Bundler.FusionCore.2 Malicious
Sangfor
PUP.Win32.Fusioncore.Vdln Malicious
Cybereason
malicious.356813 Malicious
Symantec
PUA.InstallCore!g15 Malicious
ESET-NOD32
a variant of Win32/FusionCore.AQ potentially unwanted Malicious
BitDefender
Gen:Variant.Application.Bundler.FusionCore.2 Malicious
NANO-Antivirus
Trojan.Win32.InstallCore.grrqln Malicious
Emsisoft
Gen:Variant.Application.Bundler.FusionCore.2 (B) Malicious
DrWeb
Trojan.InstallCore.3772 Malicious
VIPRE
Gen:Variant.Application.Bundler.FusionCore.2 Malicious
Webroot
W32.Adware.Gen Malicious
Antiy-AVL
GrayWare[Modifier]/Win32.Prifou Malicious
Microsoft
PUABundler:Win32/FormfacBundle Malicious
Xcitium
ApplicUnwnt@#3kwb4lufn44q3 Malicious
Arcabit
Trojan.Application.Bundler.FusionCore.2 Malicious
GData
Gen:Variant.Application.Bundler.FusionCore.2 Malicious
Varist
W32/ABApplication.UOZI-4395 Malicious
McAfee
FusionCore Malicious
MAX
malware (ai score=94) Malicious
DeepInstinct
MALICIOUS Malicious
VBA32
Trojan.InstallCore Malicious
Yandex
Riskware.Agent!4kowbRAsswM Malicious
MaxSecure
Adware.not-a-virus.WIN32.AdWare.DealPly.gen_186542 Malicious
42 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 71ec5075b65b7cca7a1ee61965c53ddf
Fuzzy: ec3f9df6c2d52e75485397bf843c2c91
dHash: 2369271b1565271d
Image Base 0x00400000
Entry Point 0x004033b6
Compilation Time 2016-07-25 00:55:51
Checksum 0x04414435 (Actual: 0x04414435)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Digital Signature Chain verification from CN=暇光软件科技（上海）有限公司, OU=研发部, O=暇光软件科技（上海）有限公司, L=上海, C=CN (serial:19851180954834495458172774191676532436, sha1:db862da99fcf4acaf362e9e3ea21d5ab388f5136) failed: The path could not be validated because the end-entity certificate expired 2022-04-04 12:00:00Z
Imports 7 libraries
KERNEL32, USER32, GDI32, SHELL32, ADVAPI32, COMCTL32, ole32
Exports 0 functions
Resources 36 Resources
Sections 5 Sections

Version Information

▼
Comments Format Factory Media Tools
CompanyName Free Time Co., Ltd
FileDescription Format Factory Video/Audio/Picture Converter
FileVersion 4.6.1.0
LegalCopyright Free Time Co., Ltd
LegalTrademarks Format Factory Application is a trademark of FreeTime
ProductName Format Factory
ProductVersion 4.6.1.0
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 24,925 bytes 25,088 bytes 6.45 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 0B0812166EBBD0109E7F5E007B182949
.rdata 0x00008000 5,028 bytes 5,120 bytes 5.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4AC891D4DDF58633F14436F9F80AC6B6
.data 0x0000a000 131,896 bytes 1,536 bytes 3.98 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 66B45FCEBA0F24D768FB09E0AFE23C99
.ndata 0x0002b000 176,128 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rsrc 0x00056000 112,296 bytes 112,640 bytes 5.67 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E7C046CA8504115BCBDE900D5B45B707

Resource Analysis

▼
Total Resources: 36 (110,375 bytes)
Resource Type Count Total Size Percentage
RT_ICON 5 99,592 bytes
90.2%
RT_DIALOG 28 8,746 bytes
7.9%
RT_GROUP_ICON 1 76 bytes
0.1%
RT_VERSION 1 892 bytes
0.8%
RT_MANIFEST 1 1,069 bytes
1%

Certificate Chain Analysis

▼
Certificate Information
Product Format Factory
Description Format Factory Video/Audio/Picture Converter
File Version 4.6.1.0
Verification Status A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Signers 暇光软件科技（上海）有限公司; DigiCert SHA2 Assured ID Code Signing CA; DigiCert
Copyright Free Time Co., Ltd
Certificate Chain Summary
DigiCert SHA2 Assured ID Code Signing CA #1 Primary
Validity Period: 2013-10-22 12:00:00 → 2028-10-22 12:00:00
Signature Algorithm: sha256RSA
Serial Number: 04 09 18 1B 5F D5 BB 66 75 53 43 B5 6F 95 50 08
暇光软件科技（上海）有限公司 #2 Chain
Validity Period: 2019-04-01 00:00:00 → 2022-04-04 12:00:00
Signature Algorithm: sha256RSA
Serial Number: 0E EF 32 C9 3E 68 FE A8 81 AE EA 7B 43 84 26 D4

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

Chain verification from CN=暇光软件科技（上海）有限公司, OU=研发部, O=暇光软件科技（上海）有限公司, L=上海, C=CN (serial:19851180954834495458172774191676532436, sha1:db862da99fcf4acaf362e9e3ea21d5ab388f5136) failed: The path could not be validated because the end-entity certificate expired 2022-04-04 12:00:00Z

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
26 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware