Gridinsoft Logo
File Icon

ESRS.exe Trojan Heuristic Analysis

Updated 2 months ago
Checked by Malaware Check
ESRS.exe

Technical Analysis

File Name ESRS.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.211.174
Database Version 2025-03-20 10:00:39 UTC
⚠

Trojan.Heur!.02212021

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
2,353,152
File Size (bytes)
2025-03-20
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
0202855d1f0a206deba4c2609ce89f84
SHA1
801b83f89f43bb1d3ce9f2dd15035b28f1545b4d
SHA256
50bfea6c398d32aa37f7a211f9c55257f99fe9cccc9f64dc58c8f203a9f77422
SHA512
5ae82ed9f8128cbf17a19fe9188054172e17575b4bc54aa116e93d080ca2f88aa3175d140454dbace753a6d91025230fdb2ff02c7f854e499c716453be27fc73
ImpHash
c57932fca7fce06c6e8a3a2664a177cb

PE Analysis

Basic Information

▼
Icon
Hash: c42d9f1a38a2f8ac88c215d9b7801e99
Fuzzy: 79983bf248603b7ecee4b2f9f52ea996
dHash: fefee6d6948e7a9e
Image Base 0x00400000
Entry Point 0x00428433
Compilation Time 2023-05-12 10:32:03
Checksum 0x00000000 (Actual: 0x002452fd)
OS Version 1.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 6 libraries
cvirte, ADVAPI32, GDI32, KERNEL32, msi, USER32
Exports 0 functions
Resources 8 Resources
Sections 16 Sections

Version Information

▼
CompanyName 青岛仪迪电子公司
FileDescription ESRS (Release x86)
FileVersion 1.0
InternalName ESRS
LegalCopyright Copyright IDI Instrument Co.Ltd. 2023
OriginalFilename ESRS.exe
ProductName 双通道安全性能综合测试系统
ProductVersion 1.0
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 233,746 bytes 233,984 bytes 6.34 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 9EF869F77E23858A97799C1C970123EE
.data 0x0003b000 239,193 bytes 239,616 bytes 5.53 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 93E749E78E2B3EA2780675D23FB8D121
.bss 0x00076000 6,600 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x00078000 5,120 bytes 5,120 bytes 5.85 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D2D64C2D9C58FECB3DC4A3EC71676524
.db_info 0x0007a000 4,007 bytes 4,096 bytes 5.07 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 958F9DE4F7660421F7ED86233C0DCB00
.db_abbv 0x0007b000 1,040 bytes 1,536 bytes 3.54 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0E7CBE57E596148277EAE7E0175BF809
.db_line 0x0007c000 1,606 bytes 2,048 bytes 5.00 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ D6F1DB37447517FDE6499064DE8D1AB0
.db_pnam 0x0007d000 1,397 bytes 1,536 bytes 4.42 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 42640BF3150AD3E49B58D63E5F775A59
.db_str 0x0007e000 2,565 bytes 3,072 bytes 4.53 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ E8CA142D3C794A8915A16D0FD9902BF2
.db_ref 0x0007f000 1,050 bytes 1,536 bytes 4.12 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ C492F4493CAC7B128DEC7598B75FFBB9
.db_fram 0x00080000 800 bytes 1,024 bytes 3.19 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 74642F790AE717CDD5514C04C50E2316
_data 0x00081000 10 bytes 512 bytes 0.04 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4C5B8AF90312D48F50B09A05AE1B16A3
_text 0x00082000 444 bytes 512 bytes 5.58 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7B965209BA92BBFC2E17B84352D59171
.idata 0x00083000 56,694 bytes 56,832 bytes 5.91 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE FEAE19FDF6341A1FFC056328B894055F
.edata 0x00091000 49 bytes 512 bytes 0.37 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F2F1FA5CC9B0735A60CB5F636E9B416C
.rsrc 0x00092000 1,798,920 bytes 1,799,168 bytes 7.46 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C3E17948514026BF27CF34769F181D51
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 8 (1,798,292 bytes)
Resource Type Count Total Size Percentage
UIRFILETYPE 3 1,784,748 bytes
99.2%
RT_ICON 1 12,432 bytes
0.7%
RT_STRING 1 40 bytes
0%
RT_GROUP_ICON 1 20 bytes
0%
RT_VERSION 1 712 bytes
0%
RT_MANIFEST 1 340 bytes
0%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.02212021 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.02212021 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware