File Name | game.exe |
File Type |
PE32 executable (GUI) Intel 80386, for MS Windows
|
Scanner Version | 1.0.179.174 |
Database Version | 2024-06-21 07:00:38 UTC |
Malware family: STOP/Djvu
Hash Type | Value | Action |
---|---|---|
MD5 |
9b3e38e023020228484dcc008d6f6e52
|
|
SHA1 |
16a218483c71a8edeb7c43a9ff3696e53c586ef2
|
|
SHA256 |
567ed29376b1cdfc820544d6d8e38d58187476a0b911226d5cb8e95f69dcba6f
|
|
SHA512 |
0f46c3509890560a4c753efb5d6b940b545a2619b277c536fae8cb2dab280def9afd61b7d7d7e0ab08a879dcf2288705e92a3066b37da1a1c2b0e0ca64e98399
|
|
ImpHash |
1c3aebb846cbbabbc7cfe5a60c0dd715
|
Icon |
Hash: 30e901e854a17b2ec09b301007fad46a
Fuzzy: 1f417353671ead591aa2e83badcb3843 dHash: 92a2c8d2a482d468 |
Image Base | 0x00400000 |
Entry Point | 0x0040308b |
Compilation Time | 2023-03-23 07:42:51 |
Checksum | 0x000d71b0 (Actual: 0x000d71b0) |
OS Version | 5.1 |
PEiD Signatures |
PE32 executable (GUI) Intel 80386, for MS Windows
|
Digital Signature | The PE file does not contain a certificate table. |
Imports |
1 libraries
KERNEL32 |
Exports | 0 functions |
Resources | 72 Resources |
Sections | 4 Sections |
FileVersions | 76.51.27.10 |
InternalName | sadf |
FileDescription | sadf |
LegalCopyright | Copyrights (C) 2023, sadf |
OriginalFilenames | asdf |
ProductName | asdf |
ProductVersions | 8.22.79 |
Translation | 0x16fe 0x06da |
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
41,968 bytes | 41,984 bytes | 6.82 (Compressed) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
509E878B9B106BE477F3B73E4B4EB732 |
.rdata |
0x0000c000 |
11,848 bytes | 12,288 bytes | 4.84 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
593D913DD9A0B3054B5B79B9080C62E0 |
.data |
0x0000f000 |
660,160 bytes | 606,208 bytes | 7.97 (Packed/Encrypted) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
9E6E4BFD39BD963C33395B2A906218B3 |
.rsrc |
0x000b1000 |
182,512 bytes | 182,784 bytes | 4.84 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
7E268806F15CB169F467B5AC34EC2B4F |
1 section(s) with high entropy (≥7.5) detected - possible packing/encryption
1 section(s) with elevated entropy (≥6.5) - possible compression
Resource Type | Count | Total Size | Percentage |
---|---|---|---|
KUSUFOFIHOVAME | 1 | 2,535 bytes | |
RT_CURSOR | 14 | 29,888 bytes | |
RT_ICON | 40 | 139,392 bytes | |
RT_STRING | 5 | 5,550 bytes | |
RT_GROUP_CURSOR | 5 | 226 bytes | |
RT_GROUP_ICON | 6 | 596 bytes | |
RT_VERSION | 1 | 616 bytes |
This file is not digitally signed.
⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources
The PE file does not contain a certificate table.
Recommendation: Verify the file source and ensure it comes from a trusted publisher.
Gridinsoft has the capability to identify and eliminate Ransom.Win32.STOP.tr without requiring further user intervention.
Download Anti-MalwareFollow these steps to completely remove the threat from your system