Gridinsoft Logo

T10_zl_fs_5e7f5e149e.exe Trojan Heuristic Analysis

Updated 12 days ago
Checked by Malaware Check
t10_zl_fs_5e7f5e149e.exe

Technical Analysis

File Name t10_zl_fs_5e7f5e149e.exe
File Type
PE32+ executable (console) x86-64, for MS Windows
Scanner Version 1.0.217.174
Database Version 2025-05-26 08:00:16 UTC
⚠

Trojan.Heur!.03210023

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
23,311,888
File Size (bytes)
2025-05-26
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
b5024c3f06e5ca1bf5cbf15987165e45
SHA1
a0d38319c9e43a8e44adc1780b5c4ed77755491e
SHA256
5750723b0a7799f9432b5c8b98a9049e10141a6e4494dd843f60a00faa67fbf3
SHA512
af1195eb13b8b72c5a71f53a85b24c7800d27aecbfd47c79738b484de410fac1da686844ee9ee7194db50991ba055195daaac2a1d2eb0c08cb683d68339d8bab
ImpHash
209c109870f6c9147dc079f25641d7e4

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x141e9b058
Compilation Time 2025-05-21 03:43:52
Checksum 0x01644e9b (Actual: 0x01644e9b)
OS Version 6.0
PEiD Signatures PE32+ executable (console) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 22 libraries
Exports 0 functions
Resources 1 Resources
Sections 12 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 893,488 bytes 518,144 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 68F0018B93BD73AE317F077BE866A4C8
0x000dc000 200,406 bytes 109,056 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 57170C365BBE8204A3DF7D071C25210A
0x0010d000 9,536 bytes 2,560 bytes 7.23 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 6D0A2B4E8DE2052FFE4AD07CFAF29027
0x00110000 30,312 bytes 17,920 bytes 7.63 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 697E116AEAAEAC105D06778DB0D43DCC
0x00118000 488 bytes 512 bytes 4.78 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CA1CCC8E8806E03DD1CC273942B526BD
0x00119000 2,624 bytes 1,536 bytes 7.72 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 985EEC8408EA11286781859F33A773C8
.idata 0x0011a000 4,096 bytes 2,048 bytes 3.53 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D7A394AB72E42726386C5B0990E17A2B
.tls 0x0011b000 4,096 bytes 512 bytes 0.28 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F29BBEB2F9A17741389521DDA9740413
.rsrc 0x0011c000 4,096 bytes 512 bytes 4.77 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 22B6BF42D58471F5950B0E95180C1895
??????? 0x0011d000 30,924,800 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.boot 0x01e9b000 22,657,536 bytes 22,657,536 bytes 7.94 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ C5FBCE9084F8B62EF0881BCDDD5AF678
.reloc 0x03437000 4,096 bytes 16 bytes 2.47 (Normal) IMAGE_SCN_MEM_READ 68C6FEA1FD06614B79AACAFF8D90558C
Entropy Analysis Alert

5 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 1 (392 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 392 bytes
100%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.03210023 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.03210023 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware