StataMP 64 exe Trojan Heuristic File Malware Analysis: 5a8a170a641626ee1181aeebecacd7ec
Gridinsoft Logo
File Icon

StataMP-64.exe Trojan Heuristic Analysis

Updated 1 year ago
Checked by Malware Check
StataMP-64.exe

Technical Analysis

File Name StataMP-64.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.170.174
Database Version 2024-04-01 14:00:31 UTC
⚠

Trojan.Heur!.03210023

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
90,251,848
File Size (bytes)
2024-04-01
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
5a8a170a641626ee1181aeebecacd7ec
SHA1
4f131d2af2b681ba5e28f220629d5b8184009261
SHA256
4b88173493e1f20ca5713057f428292e3fa0c3aa7c8f789fdc2aee6890676938
SHA512
6a602d8063211b415dc1e09d2c1a3c5a273afddf765caf31330aa7031c5b2c37d52b4f81ebfafecc8afc58301b90ca1603de07800ade8f027d72022d9c304b6d
ImpHash
e10a977d126718d1e0fc9d8f19a678b9

PE Analysis

Basic Information

▼
Icon
Hash: d3d53dd6bde54d338927541a2a2108d6
Fuzzy: c8bba836f435a4f5ddd6ee9daa18b1ad
dHash: d2d2d3d4d4b4b494
Image Base 0x140000000
Entry Point 0x1472c1058
Compilation Time 2023-06-02 14:11:23
Checksum 0x05613b38 (Actual: 0x05613b38)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 24 libraries
Exports 0 functions
Resources 2061 Resources
Sections 13 Sections

Version Information

▼
CompanyName StataCorp LLC
FileDescription Stata
FileVersion 521,18,0,120
InternalName StataMP-64
LegalCopyright Copyright (C) 2023 StataCorp LLC. All rights reserved.
OriginalFilename StataMP-64
PrivateBuild 120
ProductName Stata
ProductVersion 521.18.0.120
Translation 0x0409 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 57,703,432 bytes 57,703,936 bytes 6.69 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 921ECFCF4EDBF4205A4F30EC9CB60F0E
.rdata 0x03709000 7,817,666 bytes 7,817,728 bytes 5.66 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 965B71ADE022E833296303001B318303
.data 0x03e7e000 26,599,168 bytes 1,074,688 bytes 3.72 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D3A4A14BC288BACD48791B166E478887
.pdata 0x057dc000 1,618,692 bytes 1,618,944 bytes 7.06 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9939CDFE52765CAF9CF52786FAE9700B
.itt_not 0x05968000 42,571 bytes 43,008 bytes 3.92 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 49D7BE8D0B0CF4B9DA198FA750B1140A
_RDATA 0x05973000 560 bytes 1,024 bytes 2.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 7B0D1655BB58BD1D6DB9DB9E82BBCC2C
.rsrc 0x05974000 14,871,152 bytes 14,871,552 bytes 3.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 959064A5E9BA96F51B96D254363D1654
.reloc 0x067a3000 379,692 bytes 379,904 bytes 5.49 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ F008CCDBE066C5AD840413501BEF9BCE
.idata 0x06800000 4,096 bytes 2,048 bytes 3.24 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE DE2B8C9C0A78E3A166A5B1179587E9E3
.tls 0x06801000 8,192 bytes 5,632 bytes 0.04 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 72C0ECEC424C307B2690371E90405642
.winlice 0x06803000 11,264,000 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.boot 0x072c1000 6,722,560 bytes 6,722,560 bytes 7.89 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 845E17A008B87B183D49A24665FC4DF5
.reloc 0x0792b000 4,096 bytes 16 bytes 2.73 (Normal) IMAGE_SCN_MEM_READ 681D816BB920CFB644EDD414E3A73C4D
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 2061 (14,765,827 bytes)
Resource Type Count Total Size Percentage
AFX_DIALOG_LAYOUT 13 26 bytes
0%
AVI 1 5,632 bytes
0%
PNG 38 123,553 bytes
0.8%
REGISTRY 2 735 bytes
0%
RT_XAML 71 46,125 bytes
0.3%
STYLE 1 41,377 bytes
0.3%
TYPELIB 1 12,404 bytes
0.1%
RT_CURSOR 48 18,088 bytes
0.1%
RT_BITMAP 154 4,951,348 bytes
33.5%
RT_ICON 1176 9,385,442 bytes
63.6%
RT_MENU 19 4,198 bytes
0%
RT_DIALOG 99 72,908 bytes
0.5%
RT_STRING 96 35,896 bytes
0.2%
RT_FONTDIR 1 154 bytes
0%
RT_FONT 1 4,424 bytes
0%
RT_ACCELERATOR 8 1,608 bytes
0%
RT_GROUP_CURSOR 44 936 bytes
0%
RT_GROUP_ICON 163 17,442 bytes
0.1%
RT_VERSION 1 808 bytes
0%
RT_HTML 70 40,025 bytes
0.3%
RT_MANIFEST 1 1,672 bytes
0%
None 53 1,026 bytes
0%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.03210023 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.03210023 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware