Gridinsoft Logo

3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9.docx Trojan Gen Analysis

Updated 1 year ago
Checked by Malware Check
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9.docx

Technical Analysis

File Name 3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9.docx
File Type
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Scanner Version 1.0.140.174
Database Version 2023-09-30 12:04:05 UTC
⚠

Trojan.Win64.Gen.bot

Malware family: Gen

This is a generic detection identifier for files exhibiting Trojan horse characteristics. It indicates malware that disguises itself as legitimate software while containing malicious code designed to compromise system security or steal information.
N/A
Detection Rate
5,404,672
File Size (bytes)
2023-09-30
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
d381d9db9cbd1b60afdfb4f05e52a775
SHA1
d59c52583ca791e07f3e6aec2ee2590ab9bfd67e
SHA256
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9
SHA512
cebe8732fbcdc7d5672667d94473245377780e7cce940f5162789fcb6684c49b3c9c9cef6d7aff3cb005d614e32c228fe958011ee27d5063ca488b28b594d861
ImpHash
0fdd3d21d2193b717f076a70dfaa659c

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x1400012fd
Compilation Time 1970-01-01 00:00:00
Checksum 0x0053250f (Actual: 0x0053250f)
OS Version 4.0
PEiD Signatures PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 2 libraries
KERNEL32, msvcrt
Exports 0 functions
Resources 1 Resources
Sections 11 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 25,080 bytes 25,088 bytes 6.18 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ ADC85401F0123178B62A5E973D789C96
.data 0x00008000 5,365,536 bytes 5,365,760 bytes 7.71 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E1220A460667AB4286E674F4813BCF43
.rdata 0x00526000 5,600 bytes 5,632 bytes 5.05 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 5F8A683B3F54EB60D2A5A39A85D5417B
.pdata 0x00528000 1,392 bytes 1,536 bytes 4.15 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0FA38A850E5E56ACFDD7CCD2218E1E83
.xdata 0x00529000 1,096 bytes 1,536 bytes 3.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 80234C2E908F06DC83F3A590A0F2C17D
.bss 0x0052a000 4,000 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.idata 0x0052b000 1,508 bytes 1,536 bytes 4.09 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 80E6587222095B16EBF3B665F77CBC86
.CRT 0x0052c000 96 bytes 512 bytes 0.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2340B1934E77B2B021FC8AE041287F9C
.tls 0x0052d000 16 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BF619EAC0CDF3F68D496EA9344137E8B
.rsrc 0x0052e000 896 bytes 1,024 bytes 5.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D27B8F157A6CF33F427B8D124B71C53E
.reloc 0x0052f000 132 bytes 512 bytes 1.50 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ D88761CDCD981531CA230B046AA66B2F
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 1 (805 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 805 bytes
100%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Gen.bot Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Gen.bot without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware