The Setup Full exe (iTop Screen Recorder Magnifier) iTop Inc File Malware Analysis

The Setup-Full.exe (iTop Screen Recorder Magnifier) File Analysis

Updated 3 days ago

Checked by Malaware Check

Setup-Full.exe

Hash Type	Value	Action
MD5	f876e62ab6f2e10bfbbb11773f844fa8
SHA1	4a39494a508c5808e674159723d309bb881e7c7d
SHA256	5b2db3dd337e30581c5833c7f5ef6d06b8e3242969fb259f88fafbd343e78c3f
SHA512	e2823c5af826edf7fd026d33b2b83f33c60dfc75d14bd3d291bfa0bd1e5545ab4022556399b290b0b164de528f12cb6497062ab6b5bf19f7cbfd4f445d5e4c81
ImpHash	340f1e29a8d076b4de2d37adce161684

Hash Type

Value

Action

MD5

f876e62ab6f2e10bfbbb11773f844fa8

SHA1

4a39494a508c5808e674159723d309bb881e7c7d

SHA256

5b2db3dd337e30581c5833c7f5ef6d06b8e3242969fb259f88fafbd343e78c3f

SHA512

e2823c5af826edf7fd026d33b2b83f33c60dfc75d14bd3d291bfa0bd1e5545ab4022556399b290b0b164de528f12cb6497062ab6b5bf19f7cbfd4f445d5e4c81

ImpHash

340f1e29a8d076b4de2d37adce161684

PE Analysis

Basic Information

▼

Icon	Hash: 3d5dc4e5a911bee7292a914140092c8c Fuzzy: a788a1c8239f81d6e401dd187d68f45e dHash: b2b2e3e3e3a3a200
Image Base	`0x00400000`
Entry Point	`0x006d8468`
Compilation Time	2024-06-14 01:33:46
Checksum	0x003ad424 (Actual: 0x003ad424)
OS Version	5.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	15 libraries
Exports	1 functions
Resources	91 Resources
Sections	11 Sections

Version Information

▼

CompanyName	iTop Inc.
FileDescription	iTop Screen Recorder Magnifier
FileVersion	5.0.0.5
InternalName	iScrMagnifierFull.exe
LegalCopyright	© iTop Inc. All rights reserved.
LegalTrademarks	iTop Inc.
OriginalFilename	iScrMagnifierFull.exe
ProductName	iTop Screen Recorder
ProductVersion	5.0
Translation	0x0409 0x04e4

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	2,967,832 bytes	2,968,064 bytes	6.50 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`1B10D4135297518952E1DA12F0E86577`
`.itext`	`0x002d6000`	9,880 bytes	10,240 bytes	6.19 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`1D87851889EE8A0521E032177173D2D7`
`.data`	`0x002d9000`	58,424 bytes	58,880 bytes	6.20 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B8EBAE3E62F9D9BC60DE13AC9011F532`
`.bss`	`0x002e8000`	289,684 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0032f000`	17,970 bytes	18,432 bytes	5.22 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`AAAA4BA5D6442CB5A94220115EF6F314`
`.didata`	`0x00334000`	2,372 bytes	2,560 bytes	4.03 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`109A12EF70B2341164A2DBD64CD0E372`
`.edata`	`0x00335000`	88 bytes	512 bytes	1.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`792B75DD079DFAE1798901971F16C480`
`.tls`	`0x00336000`	1,620 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00337000`	24 bytes	512 bytes	0.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`80A461BA023F1B2EFAC730E1C97F9211`
`.reloc`	`0x00338000`	234,312 bytes	234,496 bytes	6.74 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`84269B654334BA8575CF587327BF92C4`
`.rsrc`	`0x00372000`	543,232 bytes	543,232 bytes	7.60 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`113A2DDEB8EF521E41A6102CAA8A29B4`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 91 (272,530 bytes)

Resource Type	Count	Total Size	Percentage
MAD	2	158,496 bytes	58.2%
RT_CURSOR	7	2,156 bytes	0.8%
RT_BITMAP	21	25,580 bytes	9.4%
RT_ICON	13	48,184 bytes	17.7%
RT_STRING	30	25,864 bytes	9.5%
RT_RCDATA	8	9,882 bytes	3.6%
RT_GROUP_CURSOR	7	140 bytes	0.1%
RT_GROUP_ICON	1	188 bytes	0.1%
RT_VERSION	1	868 bytes	0.3%
RT_MANIFEST	1	1,172 bytes	0.4%

Certificate Chain Analysis

▼

Certificate Information

Product	iTop Screen Recorder
Description	iTop Screen Recorder Magnifier
File Version	5.0.0.5
Original Name	iScrMagnifierFull.exe
Internal Name	iScrMagnifierFull.exe
Copyright	© iTop Inc. All rights reserved.

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	Setup-Full.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.217.174
Database Version	2025-06-01 22:00:17 UTC

The Setup-Full.exe (iTop Screen Recorder Magnifier) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification