Gridinsoft Logo
File Icon

Setup.exe Adware Agent Analysis

Updated 2 months ago
Checked by Malaware Check
Setup.exe

Technical Analysis

File Name Setup.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Scanner Version 1.0.211.174
Database Version 2025-03-25 04:01:16 UTC
⚠

Adware.Win32.Agent.cl

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
998,212
File Size (bytes)
2025-03-25
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
2f1595ed55449ecc6e835252f9488039
SHA1
954b080d30a58fe7c9065dc708b10a79a3334098
SHA256
4470ee3eb5fc226466f15dda9e95c36e07dc593ba49f4c4c1a131d5d5ede82b5
SHA512
cd4eeb3c6ac2da0afa905db9220d55301130e3b17442431364e1757842eb027843c90820d029130d630cf9c308cdd3889802a268fd59ece114670a2d82322ad3
ImpHash
fc0b07cab61404bf1b27f84e23fa42a1

PE Analysis

Basic Information

▼
Icon
Hash: b6508b592695a184f71826fed718fef9
Fuzzy: 60fd3092d1c44756b607907abbbf3564
dHash: 00200668aab6e970
Image Base 0x00400000
Entry Point 0x005d2180
Compilation Time 1992-06-19 22:22:17
Checksum 0x00000000 (Actual: 0x000f8e97)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Digital Signature No valid SignedData structure was found.
Imports 10 libraries
advapi32, comctl32, gdi32, KERNEL32, ole32, oleaut32, shell32, user32, version, winmm
Exports 0 functions
Resources 97 Resources
Sections 3 Sections

Version Information

▼
CompanyName Razor 1911
FileDescription Razor 1911 Installer 2024
FileVersion 1.0.0.0
InternalName Razor 1911 Installer
LegalCopyright bp^Razor 1911
LegalTrademarks Razor 1911
OriginalFilename Setup.exe
ProductName
ProductVersion 1.0.0.0
Translation 0x0809 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
UPX0 0x00001000 983,040 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
UPX1 0x000f1000 925,696 bytes 922,624 bytes 7.90 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 889528BA052EE4C61413C88DCF7882D2
.rsrc 0x001d3000 12,288 bytes 10,240 bytes 4.13 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE ACF04BBE9682C11E2CD0DAC4A843A7B9
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 97 (664,711 bytes)
Resource Type Count Total Size Percentage
RT_CURSOR 20 10,560 bytes
1.6%
RT_BITMAP 25 46,762 bytes
7%
RT_ICON 1 2,216 bytes
0.3%
RT_DIALOG 1 82 bytes
0%
RT_STRING 19 16,232 bytes
2.4%
RT_RCDATA 8 587,075 bytes
88.3%
RT_GROUP_CURSOR 20 400 bytes
0.1%
RT_GROUP_ICON 1 20 bytes
0%
RT_VERSION 1 768 bytes
0.1%
RT_MANIFEST 1 596 bytes
0.1%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Adware.Win32.Agent.cl Removal

Gridinsoft has the capability to identify and eliminate Adware.Win32.Agent.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware