Gridinsoft Logo
File Icon

Game.exe Trojan Packed Analysis

Updated 1 month ago
Checked by Malware Check
Game.exe

Technical Analysis

File Name Game.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.230.174
Database Version 2025-12-08 04:00:17 UTC
⚠

Trojan.Win64.Packed.cl

Malware family: Packed

Packed malware uses compression, encryption, or obfuscation techniques to alter code appearance and evade security detection. These methods modify the original malware structure to bypass signature-based detection systems and complicate analysis efforts.
N/A
Detection Rate
4,909,056
File Size (bytes)
2025-12-08
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
39784f1908d48eaeb74e8a0847f41f3d
SHA1
133c7fb104fcaf217ac68ffbd7ad1dfa3f1c6082
SHA256
4d8393103f98d4818ac6a41ebbcf6d09b85104bb148eaacde51ec855a0976701
SHA512
73cca3e94132dc26ed56d3f40ca1671b588fe24fabc28eb26c7d4eecf133cf50147deda0f95b82e4565ca17703aec2023e7ae2b4a405d29116b74e8dbc118806
ImpHash
3fc76ed3ffc571d0bc701aa0795ce244

PE Analysis

Basic Information

▼
Icon
Hash: c78ea2e284ddc9feb131b0bb9b0335f2
Fuzzy: 359bb7409f6d66c2043431322b378e73
dHash: 70f0b23319aecc70
Image Base 0x140000000
Entry Point 0x14128bae8
Compilation Time 2018-09-02 05:00:00
Checksum 0x004bb2de (Actual: 0x004be748)
OS Version 5.2
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 10 libraries
kernel32, user32, advapi32, oleaut32, gdi32, shell32, version, ole32, nw_elf, YKN
Exports 2 functions
Resources 18 Resources
Sections 13 Sections

Version Information

▼
CompanyName The NW.js Community
FileDescription nwjs
FileVersion 0.48.4
InternalName nw_exe
LegalCopyright Copyright 2020, The NW.js community and The Chromium Authors. All rights reserved.
OriginalFilename nw.exe
ProductName nwjs
ProductVersion 0.48.4
CompanyShortName nwjs.io
ProductShortName nwjs
LastChange ac9418ba9c3bd7f6baaffa0b055dfe147e0f8364-refs/branch-heads/3538@{#468}
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 1,433,600 bytes 613,376 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D28CECBA415159FC95CDBB2A35AC764E
0x0015f000 307,200 bytes 90,624 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2799372C0AAE797C83B18B28BC9DEB19
0x001aa000 40,960 bytes 2,560 bytes 7.46 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 58DAF05C0BB66917F3BF05D74CD3DAAC
0x001b4000 57,344 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x001c2000 4,096 bytes 512 bytes 0.37 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 605BE524D178121AEEA66D369C79FC1D
0x001c3000 4,096 bytes 512 bytes 0.37 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B82FD6C9C071D6ED7FF80F6DED9A5F02
0x001c4000 4,096 bytes 512 bytes 0.22 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A7F230DC642B8AC4AEAB7994CB9B6AC4
0x001c5000 4,096 bytes 512 bytes 0.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 0B01C1AEBABA585BB8F45E69D1AF6085
0x001c6000 323,584 bytes 512 bytes 0.58 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2B6A13E04420CFA9CFE7C1CCA478825F
0x00215000 12,288 bytes 3,584 bytes 7.50 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 8A0E8F882F8359BE58490F8133534D94
.rsrc 0x00218000 323,584 bytes 321,536 bytes 5.18 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ BC7F4909607C0A7EF94F8B2A2FC6D1BF
0x00267000 13,619,200 bytes 539,136 bytes 7.95 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 353CAF781B1C11CA24C9D74A6267F92D
0x00f64000 3,334,394 bytes 3,334,656 bytes 7.95 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE DFCBCDB4C153F279AE51DEC297D32873
Entropy Analysis Alert

5 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 18 (319,900 bytes)
Resource Type Count Total Size Percentage
GOOGLEUPDATEAPPLICATIONCOMMANDS 1 4 bytes
0%
RT_ICON 12 316,655 bytes
99%
RT_GROUP_ICON 3 186 bytes
0.1%
RT_VERSION 1 1,076 bytes
0.3%
RT_MANIFEST 1 1,979 bytes
0.6%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Packed.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Packed.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware