Gridinsoft Logo
File Icon

Tibia.exe Trojan Downloader Analysis

Updated 1 year ago
Checked by Malware Check
Tibia.exe

Technical Analysis

File Name Tibia.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.168.174
Database Version 2024-03-09 05:00:32 UTC
⚠

Trojan.Win32.Downloader.sa

Malware family: Downloader

Downloader Trojans specialize in retrieving and installing additional malware payloads. Unlike comprehensive malware, they focus specifically on payload delivery rather than direct system damage.
N/A
Detection Rate
2,433,024
File Size (bytes)
2024-03-09
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
b56b4916accaaecf87a0eb5fea9a5b30
SHA1
12578d8f094f149cbae7d0c1d22200e81167c335
SHA256
52107dcd1fe24c75ecd987d01f3f1157556eb01cc4c74b99037eb9749e247c13
SHA512
44c8d8b7ac00c2e786c67a86fc1fd32a8a91acf8d3cea1220abccf4dbd44ab311fea6b526f9c529a909b3df63aa71078fbad9abe972db799fee3e1d4e891dd80
ImpHash
0f3a6fc847e94ff8dc4fa05ad68da0ea

PE Analysis

Basic Information

▼
Icon
Hash: f2fcbc697e0c2bc5bc8fb8dffbfcec81
Fuzzy: 1ee179f3803535889559fd353e85095c
dHash: 18dcca38b0f1a420
Image Base 0x00400000
Entry Point 0x005625eb
Compilation Time 2010-06-29 09:08:59
Checksum 0x002522ba (Actual: 0x0025ce31)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 13 libraries
Exports 0 functions
Resources 63 Resources
Sections 4 Sections

Version Information

▼
Comments Tibia is a massively multiplayer online roleplaying game. Enter a medieval fantasy scenery, meet players from all over the world and have adventures together with them.
CompanyName CipSoft GmbH
FileDescription Tibia Player
FileVersion 8.60
InternalName Player
LegalCopyright Copyright (C) CipSoft GmbH 2002-2010
LegalTrademarks Tibia is a registered Trademark of CipSoft GmbH.
OriginalFilename Tibia.exe
ProductName Tibia Player
ProductVersion 8.60
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 1,796,700 bytes 1,798,144 bytes 6.33 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 2C6C3DCC682D57C3AB62FD2D721EA66A
.rdata 0x001b8000 524,762 bytes 528,384 bytes 5.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 7B6F2115B4399FD6C45DBACC692898FD
.data 0x00239000 1,754,580 bytes 20,480 bytes 4.69 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D2DC793B6683D8A5934342C364953929
.rsrc 0x003e6000 77,984 bytes 81,920 bytes 6.48 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F969B6F3C884C8DF0156E11FB8850051

Resource Analysis

▼
Total Resources: 63 (74,707 bytes)
Resource Type Count Total Size Percentage
RT_CURSOR 18 5,416 bytes
7.2%
RT_BITMAP 2 508 bytes
0.7%
RT_ICON 9 60,651 bytes
81.2%
RT_DIALOG 1 232 bytes
0.3%
RT_STRING 13 5,824 bytes
7.8%
RT_GROUP_CURSOR 17 354 bytes
0.5%
RT_GROUP_ICON 1 132 bytes
0.2%
RT_VERSION 1 1,224 bytes
1.6%
RT_MANIFEST 1 366 bytes
0.5%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Downloader.sa Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Downloader.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware