Gridinsoft Logo

Swift.exe Trojan Wacatac Analysis

Updated 1 month ago
Checked by Malaware Check
Swift.exe

Technical Analysis

File Name Swift.exe
File Type
MS-DOS executable PE32+ executable (GUI) x86-64, for MS Windows, MZ for MS-DOS
Scanner Version 1.0.214.174
Database Version 2025-04-16 16:00:17 UTC
⚠

Trojan.Win64.Wacatac.cl

Malware family: Wacatac

Wacatac malware demonstrates multiple malicious capabilities including data theft, system compromise, and secondary payload deployment. It can download additional malware components including ransomware to extend attack impact.
N/A
Detection Rate
21,045,776
File Size (bytes)
2025-04-16
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
532e28bfd55208ef66d609a48a65cf91
SHA1
5da3a7f1a437cae4109b4c052b7de697bc58a674
SHA256
3b19486b4e14b206ec8ab2602ec6a430f9fce7ef40247b1e1f4c6f004ee468b4
SHA512
10c57c4bd1c18242405bb7ac89361121b6169f3444122dbef246e4605b0f793f205a9fb36f5a8d820e9c8617bddb9df65b9590acbaada19a89ac7a064a23a0f1
ImpHash
8116db8b6421aa4889d6bf077799812c

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x142b08058
Compilation Time 2025-03-28 16:40:11
Checksum 0x01421752 (Actual: 0x01421752)
OS Version 6.0
PEiD Signatures MS-DOS executable PE32+ executable (GUI) x86-64, for MS Windows, MZ for MS-DOS
Digital Signature No valid SignedData structure was found.
Imports 35 libraries
Exports 0 functions
Resources 506 Resources
Sections 12 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 14,640,127 bytes 3,443,712 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 80179D5404BDEA837B2E98B7199C9A8D
0x00df8000 6,496,850 bytes 2,708,992 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 92C7EE78D3ECA6D2EDD3B11C0E4293F3
0x0142b000 104,536 bytes 5,120 bytes 7.88 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F77596896792DF12A173473AB0494C02
0x01445000 683,820 bytes 228,864 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 62D879E575344D689D398690869734B0
0x014ec000 11,216 bytes 9,216 bytes 7.86 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 01D2650527193DCA0823639D13E5A711
0x014ef000 76,600 bytes 15,360 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E84DEC56C78D6514716AD9E6287362AF
.idata 0x01502000 4,096 bytes 2,560 bytes 4.27 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A9146E5912A73F24033F9E8376D2C5A0
.tls 0x01503000 4,096 bytes 1,024 bytes 0.26 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 84F9890C094459707E48C0000CAAC049
.rsrc 0x01504000 1,375,744 bytes 1,375,744 bytes 5.06 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 963275479E75A69280653A78E0341498
.themida 0x01654000 21,708,800 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.boot 0x02b08000 13,254,144 bytes 13,254,144 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 52A7AAA848A85D01DFB64040C0304849
.reloc 0x037ac000 4,096 bytes 16 bytes 2.65 (Normal) IMAGE_SCN_MEM_READ 084AA0B28C191E805DCE414E870DF162
Entropy Analysis Alert

7 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 506 (141,742 bytes)
Resource Type Count Total Size Percentage
RT_ICON 6 9,574 bytes
6.8%
RT_DIALOG 500 132,168 bytes
93.2%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Wacatac.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Wacatac.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware