Gridinsoft Logo
File Icon

BioShock 2 Remastered v1.0-Update 2 Plus 15 Trainer.exe Trojan Agent Analysis

Updated 1 year ago
Checked by Malware Check
BioShock 2 Remastered v1.0-Update 2 Plus 15 Trainer.exe

Technical Analysis

File Name BioShock 2 Remastered v1.0-Update 2 Plus 15 Trainer.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.178.174
Database Version 2024-06-01 22:00:29 UTC
⚠

Trojan.Win32.Agent.cld

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
1,095,680
File Size (bytes)
2024-06-01
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
95d43210016dbbdcc9dbf58b9ca20c93
SHA1
28a94a0d8e1a2e208c392fc8ca59e400679e94c8
SHA256
313ce3e30029bc88a27113ed2224ab8f66a8d62c82670c3508bd60af07157401
SHA512
364b0fc5be1fe27e2aa629776ee98e6c8d0c878ed119ae2dae1709d56e9d5f3baed10abc5be753bb74a02fc6c0796b59ee28a3a77159a470290d913fba272b03
ImpHash
859fc9ab19ec6730aced9b67a695cdc4

PE Analysis

Basic Information

▼
Icon
Hash: 0ba2d793e22fa06db80e1e35d71acfad
Fuzzy: c006c3aa0e4b6640c9b325e553adba39
dHash: 70f8fcfafeaeaaf0
Image Base 0x00400000
Entry Point 0x0042ea34
Compilation Time 2016-12-21 11:12:50
Checksum 0x00000000 (Actual: 0x0010d532)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 11 libraries
Exports 0 functions
Resources 40 Resources
Sections 5 Sections

Version Information

▼
CompanyName 3DMGAME
FileDescription FLiNG@3DMGAME Presents - BioShock 2 Remastered v1.0-Update 2 Plus 15 Trainer
FileVersion 1.0.0.1
InternalName BioShock 2 Remastered v1.0-Update 2 Plus 15 Trainer
LegalCopyright 风灵月影 (FLiNG@3DMGAME) Copyright (C) 2016
OriginalFilename BioShock 2 Remastered v1.0-Update 2 Plus 15 Trainer.exe
ProductName BioShock 2 Remastered v1.0-Update 2 Plus 15 Trainer
ProductVersion 1.0.435.1
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 293,376 bytes 293,376 bytes 6.63 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ F6C6864E2015518127EE95FC728284FB
.rdata 0x00049000 69,058 bytes 69,120 bytes 4.90 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6682DED34A03532B31C2EF796D9C6294
.data 0x0005a000 28,680 bytes 10,240 bytes 4.33 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A160F59BA38FB26D9F61BFA34641D500
.rsrc 0x00062000 706,544 bytes 706,560 bytes 7.58 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 8BB8A4CF7445A8CD57BDF5489DA1025C
.reloc 0x0010f000 15,200 bytes 15,360 bytes 6.59 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ E23A2E1CBD0E57D48CA4A50EECF8081A
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 40 (704,247 bytes)
Resource Type Count Total Size Percentage
MID 1 32,445 bytes
4.6%
PNG 21 309,395 bytes
43.9%
REMOTE 2 225,796 bytes
32.1%
WAVE 2 22,222 bytes
3.2%
RT_ICON 9 112,476 bytes
16%
RT_ACCELERATOR 1 16 bytes
0%
RT_GROUP_ICON 2 138 bytes
0%
RT_VERSION 1 1,108 bytes
0.2%
RT_MANIFEST 1 651 bytes
0.1%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Agent.cld Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Agent.cld without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware