Gridinsoft Logo

Bootx64.efi Trojan Heuristic Analysis

Updated 2 days ago
Checked by Malware Check
bootx64.efi

Technical Analysis

File Name bootx64.efi
File Type
PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows
Scanner Version 1.0.221.174
Database Version 2025-07-21 05:00:28 UTC
⚠

Trojan.Heur!.0001A1AF

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
965,672
File Size (bytes)
2025-07-21
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
c661c777be57e43cc5f5ab426e3623d1
SHA1
e4943f42d947235a4a93b7a7c22fc830f6268c73
SHA256
4f5c118a947b3af976ff6b5df05a46c7c2d1d77c0c8199e8ff81397566452e5b
SHA512
117ee80d4f9d7d0945efaf84bff333a698799d4c3b147c2bf03d24fb10af9dbc5c4388edac3d0450e01284f9fe4b1f664d11f2d70cd9fa8f4e60077d548ea482

PE Analysis

Basic Information

▼
Image Base 0x00000000
Entry Point 0x00023000
Compilation Time 1970-01-01 00:00:00
Checksum 0x000e5cd1 (Actual: 0x000f156e)
OS Version 0.0
PEiD Signatures PE32+ executable (EFI application) x86-64 (stripped to external PDB), for MS Windows
Digital Signature Chain verification from [email protected], OU=Build Team, O=SUSE Linux Products GmbH, L=Nuremberg, C=DE, CN=SUSE Linux Enterprise Secure Boot Signkey (serial:14626765626405128578, sha1:76b6a6a0b22bccb13f465f7c489e7939fde09e83) failed: Unable to build a validation path for the certificate "Email Address: [email protected], Organizational Unit: Build Team, Organization: SUSE Linux Products GmbH, Locality: Nuremberg, Country: DE, Common Name: SUSE Linux Enterprise Secure Boot Signkey" - no issuer matching "Email Address: [email protected], Organizational Unit: Build Team, Organization: SUSE Linux Products GmbH, Locality: Nuremberg, Country: DE, Common Name: SUSE Linux Enterprise Secure Boot CA" was found
Imports 0
Exports 0 functions
Resources 0 Resources
Sections 10 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
/4 0x00005000 121,564 bytes 121,856 bytes 5.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ A026FA65067B52535AF22024C92498A7
.text 0x00023000 394,081 bytes 394,240 bytes 6.37 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ AA4225F42EEAEA28A7D39DE88651C2D5
.reloc 0x00084000 10 bytes 512 bytes 0.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0C45F6D812D079821C1D54C09AB89E1D
/14 0x00085000 107 bytes 512 bytes 1.79 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2BCDC2ED3C80C91E1B51AE5626936A0A
/26 0x00086000 106 bytes 512 bytes 1.48 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 8CAC229FB51C28086FA5221ECF848C12
.data 0x00087000 187,160 bytes 187,392 bytes 4.38 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 14412CC5659439CAE5BA341778A08A65
/37 0x000b5000 7,618 bytes 7,680 bytes 7.37 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C040A53DBB363B76BEA4E28F5286573E
.dynamic 0x000b7000 256 bytes 512 bytes 0.48 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BDF77E6B18EEC54C2A97C9C4645DB38D
.rela 0x000b8000 111,672 bytes 112,128 bytes 2.60 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 14C267D20193D5C44967DDA1399D86F9
.sbat 0x000d4000 196 bytes 512 bytes 2.79 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ BDB18CB7433EB152AB60E36EC35CC310
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

Chain verification from [email protected], OU=Build Team, O=SUSE Linux Products GmbH, L=Nuremberg, C=DE, CN=SUSE Linux Enterprise Secure Boot Signkey (serial:14626765626405128578, sha1:76b6a6a0b22bccb13f465f7c489e7939fde09e83) failed: Unable to build a validation path for the certificate "Email Address: [email protected], Organizational Unit: Build Team, Organization: SUSE Linux Products GmbH, Locality: Nuremberg, Country: DE, Common Name: SUSE Linux Enterprise Secure Boot Signkey" - no issuer matching "Email Address: [email protected], Organizational Unit: Build Team, Organization: SUSE Linux Products GmbH, Locality: Nuremberg, Country: DE, Common Name: SUSE Linux Enterprise Secure Boot CA" was found

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.0001A1AF Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.0001A1AF without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware