The 5xUi3RGk exe File Malware Analysis

Technical Analysis

File Name	5xUi3RGk.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.229.174
Database Version	2025-11-27 11:00:25 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	08eabe323db0e42dd7c2108d00248a7b
SHA1	9fcb01904f42cc51979d13d8639c8f86a08a5ee4
SHA256	2d8f9e8814e40c817ac9125cf8a7ef419147b95155f345a6227a08e785805442
SHA512	8f20d72ff827d03e283d6bd26ee1803b1cc839e1714ba5982e57560524601a8d0ec081955d40f82a118ebafb8b07455aa63507ad2b506bbd35dd737e695eb1f9
ImpHash	7e8160b357c3a20bccaa536600122887

PE Analysis

Basic Information

▼

Image Base	`0x00400000`
Entry Point	`0x00403764`
Compilation Time	2017-01-09 12:23:16
Checksum	0x00014378 (Actual: 0x00014378)
OS Version	6.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`C:\Projects\Version 18\Binary\ReleaseWin32\ScanPlugins.pdb`
Digital Signature	OK
Imports	4 libraries Zxl, KERNEL32, MSVCP110, MSVCR110
Exports	0 functions
Resources	1 Resources
Sections	5 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	12,117 bytes	12,288 bytes	6.14 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`E14BF4D0F7FEDE16CAE70A5BB6ACAA0F`
`.rdata`	`0x00004000`	5,188 bytes	5,632 bytes	4.70 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`49FF056E4FA2E224D8D51EE7774185EC`
`.data`	`0x00006000`	1,340 bytes	512 bytes	4.30 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`07B66F0AAB3501984DC08918AD7795D1`
`.rsrc`	`0x00007000`	1,144 bytes	1,536 bytes	4.62 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4E7452A66CD7F43198C8ADDEC9292AD1`
`.reloc`	`0x00008000`	5,798 bytes	6,144 bytes	1.78 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`7C7F47BD8FC7624F686CF184F6B7A0F7`

Resource Analysis

▼

Total Resources: 1 (1,046 bytes)

Resource Type	Count	Total Size	Percentage
RT_MANIFEST	1	1,046 bytes	100%

Certificate Chain Analysis

▼

Certificate Information

Signing Date	05:44 PM 01/09/2017 (3285 days ago)
Verification Status	Signed
Signers	ZONER software, a.s.; Symantec Class 3 Extended Validation Code Signing CA - G2; VeriSign
Counter Signers	Symantec Time Stamping Services Signer - G4; Symantec Time Stamping Services CA - G2; Thawte Timestamping CA

Certificate Chain Summary

Symantec Time Stamping Services CA - G2 #1 Primary

Validity Period: 2012-12-21 00:00:00 → 2020-12-30 23:59:59

Signature Algorithm: sha1RSA

Serial Number: 7E 93 EB FB 7C C6 4E 59 EA 4B 9A 77 D4 06 FC 3B

Symantec Time Stamping Services Signer - G4 #2 Chain

Validity Period: 2012-10-18 00:00:00 → 2020-12-29 23:59:59

Signature Algorithm: sha1RSA

Serial Number: 0E CF F4 38 C8 FE BF 35 6E 04 D8 6A 98 1B 1A 50

Symantec Class 3 Extended Validation Code Signing CA - G2 #3 Chain

Validity Period: 2014-03-04 00:00:00 → 2024-03-03 23:59:59

Signature Algorithm: sha256RSA

Serial Number: 19 1A 32 CB 75 9C 97 B8 CF AC 11 8D D5 12 7F 49

ZONER software, a.s. #4 Chain

Validity Period: 2016-07-22 00:00:00 → 2018-07-22 23:59:59

Signature Algorithm: sha256RSA

Serial Number: 2C 60 8D 47 B9 7D B2 02 88 9A 38 E2 D4 C2 FB D9

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

OK

The 5xUi3RGk.exe File Analysis