Gridinsoft Logo
File Icon

RustClient.exe Trojan Heuristic Analysis

Updated 1 year ago
Checked by Malware Check
RustClient.exe

Technical Analysis

File Name RustClient.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.168.174
Database Version 2024-03-02 21:00:14 UTC
⚠

Trojan.Heur!.03052023

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
24,992,616
File Size (bytes)
2024-03-02
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
87bbcee1fa1ae537c3ec5f963973e6a9
SHA1
ca505722517ae8e5c64d47c4233695fa30152326
SHA256
2ddba742e4161065178471f2d7b30d280183320a2b76b195b74198cde8acf57c
SHA512
5df32fb23ba1d55c37f3d96126e11a19e7dd683c53e165d80dcf0585e6148b849ea88243fa05b76d277256cd4e98695babd95eee1a7cdc5ce34cb557f87dbfe8
ImpHash
bf56211dba7941289c7b75f93dac6d1a

PE Analysis

Basic Information

▼
Icon
Hash: 879e2123b8b542962572155c0a7a5bfd
Fuzzy: 0cbb07a74f126f49f5b5e5e38c172091
dHash: 5d5d92d4f4c48349
Image Base 0x140000000
Entry Point 0x1410adc18
Compilation Time 2017-10-03 11:15:23
Checksum 0x0160c4ab (Actual: 0x017d5be5)
OS Version 5.2
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path C:\buildslave\unity\build\artifacts\win64_release_StandalonePlayer_mono_0\player_win_x64.pdb
Digital Signature The PE file does not contain a certificate table.
Imports 7 libraries
kernel32, ntdll, oleaut32, user32, advapi32, ole32, shlwapi
Exports 2 functions
Resources 14 Resources
Sections 12 Sections

Version Information

▼
FileVersion 2017.1.2.13403583
ProductVersion 2017.1.2.13403583
Unity Version 2017.1.2f1_cc85bf6a8a04
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 17,859,270 bytes 17,859,584 bytes 6.51 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 281F5D994138A88ACD95D83C6AFA6826
.rdata 0x0110a000 3,165,924 bytes 3,166,208 bytes 6.27 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ AB50AEFEB504BBB4A286DB54F4DB0B78
.data 0x0140f000 1,420,068 bytes 717,312 bytes 5.29 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C4FCEC9EE3C28E0EE71743033852643E
.pdata 0x0156a000 914,928 bytes 914,944 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 411E21A6839FFD3109C1758F87F9F8A3
.rodata 0x0164a000 2,896 bytes 3,072 bytes 4.12 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 1548249B6287B5B6505E73F641D969EA
.trace 0x0164b000 39,024 bytes 39,424 bytes 3.50 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 82201E20666B6A37F5D0B1AB25A273BD
.data1 0x01655000 64 bytes 512 bytes 0.44 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F5688ADFEAF35CD6BE99948B3E39F323
_RDATA 0x01656000 4,608 bytes 4,608 bytes 3.81 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ FDD767A294508784D8F6B7A35088857B
.rsrc 0x01658000 189,701 bytes 189,952 bytes 7.01 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ B8518D41AA2E82B6FEEC9DAA31175560
.reloc 0x01687000 178,562 bytes 178,688 bytes 4.31 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ D7B701699EA6612F796ECFB00DAB5876
.enigma1 0x016b3000 4,096 bytes 315,392 bytes 7.90 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE EDC274B4F95A557460E573EC9425AB0C
.enigma2 0x016b4000 1,597,440 bytes 1,597,440 bytes 6.45 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B2F39845C133DAB36CDF0590F2E5635E
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 14 (188,885 bytes)
Resource Type Count Total Size Percentage
RT_ICON 6 185,358 bytes
98.1%
RT_DIALOG 5 1,372 bytes
0.7%
RT_GROUP_ICON 1 90 bytes
0%
RT_VERSION 1 444 bytes
0.2%
RT_MANIFEST 1 1,621 bytes
0.9%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.03052023 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.03052023 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware