Gridinsoft Logo
File Icon

Napse.exe Trojan Heuristic Analysis

Updated 10 months ago
Checked by Malware Check
Napse.exe

Technical Analysis

File Name Napse.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.187.174
Database Version 2024-09-14 01:00:42 UTC
⚠

Trojan.Heur!.032104A3

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
35,815,936
File Size (bytes)
2024-09-14
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
7ad0021de614c3e3df27a2392a6d054b
SHA1
3b76fedf36f4e68de5ea83e80fd238eff5ca05f9
SHA256
3d087a3de163452fd496e170fc55a38318996ffb8222dbde3c53e2ab46dc3eb8
SHA512
75d3c2b59d5bc1474a7e101dd75bd4e720900dca26b192d37222e1e5a040dea48552bca42a962072736af1ac411bfd9ca9fde265d625a3c5106feca7bba54ea5
ImpHash
fe4d7c5fb64d3cfcb8ec1d361ca91940

PE Analysis

Basic Information

▼
Icon
Hash: 597494d1c5a55e954a35a2ed4100ff0c
Fuzzy: 19cf91157fea7759a4255cb8bb1ffec1
dHash: 3ab17a7f2d058910
Image Base 0x140000000
Entry Point 0x1425cf058
Compilation Time 2024-08-30 06:01:13
Checksum 0x0222aec0 (Actual: 0x0222aec0)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 2 libraries
kernel32, SHELL32
Exports 0 functions
Resources 4 Resources
Sections 11 Sections

Version Information

▼
CompanyName Napse
ProductName Napse
FileDescription Napse
LegalCopyright Napse
ProductVersion 8.3.0.1
FileVersion 8.3.0.1
OriginalFilename Napse.exe
InternalName Napse
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 130,896 bytes 78,336 bytes 7.97 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7BED2D27A6CAD07AD215EA58E77F51D9
0x00021000 52,190 bytes 24,576 bytes 7.93 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ EF2D1F3289B2D3A3ED825B82E92C4F2D
0x0002e000 150,960 bytes 512 bytes 6.58 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 01BF44F99845702F04FAFBCB3C7A11B6
0x00053000 6,060 bytes 3,584 bytes 7.57 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3DD4C088A00BED4D165AE0581A7CA5C4
0x00055000 256 bytes 512 bytes 0.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE CC6440A5874FCBBA3FF6812EB15802E6
0x00056000 30,847,944 bytes 30,848,000 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ B82E5F8152B66920D1C4436AD8380E52
0x01dc2000 1,680 bytes 1,536 bytes 6.93 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6CEE795F505F02E2B556A72D1FF5477B
.idata 0x01dc3000 4,096 bytes 512 bytes 1.32 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE AD61D276C4D1F3B53E35F5E81163B87D
.rsrc 0x01dc4000 36,864 bytes 36,864 bytes 3.53 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3C05F2D46B8E0F862A52FD7F33623CA4
Napse 0x01dcd000 8,396,800 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.boot 0x025cf000 4,820,480 bytes 4,820,480 bytes 7.97 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ C1C18F39C7454B0EF85E72FB4A5C0806
Entropy Analysis Alert

5 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 4 (36,503 bytes)
Resource Type Count Total Size Percentage
RT_ICON 1 34,844 bytes
95.5%
RT_GROUP_ICON 1 20 bytes
0.1%
RT_VERSION 1 612 bytes
1.7%
RT_MANIFEST 1 1,027 bytes
2.8%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.032104A3 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.032104A3 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware