Gridinsoft Logo

EMP.dll Trojan Heuristic Analysis

Updated 1 month ago
Checked by Malware Check
EMP.dll

Technical Analysis

File Name EMP.dll
File Type
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Scanner Version 1.0.229.174
Database Version 2025-11-19 13:00:20 UTC
⚠

Trojan.Heur!.010120B2

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
1,715,512
File Size (bytes)
2025-11-19
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
c12c69ce065a3dcd195dcde9f59ba45f
SHA1
f411c6e22e05fcadb7056d9295ea2d0bf8a1b38c
SHA256
65fff97e2e3659965338390b797dc6408f53804abda2e83770827cd5efdb542e
SHA512
0ad89b50aea983e58ed5db78119532472022a84ed6eb1c3b2083c81fe3142c3338c2dc335736e62245ba74a0cf859d76594d5117d96f10295ab9ac57b44d5edd
ImpHash
fc7124d57387852c0a6a634e9130bf57

PE Analysis

Basic Information

▼
Image Base 0x13000000
Entry Point 0x13001334
Compilation Time 2020-07-18 13:47:30
Checksum 0x00000000 (Actual: 0x001af368)
OS Version 6.0
PEiD Signatures PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 1 libraries
KERNEL32
Exports 1 functions
Resources 1 Resources
Sections 11 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 3,128 bytes 3,584 bytes 5.35 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7C26CE9FD4BC6BB68C99B44834B6546C
.rdata 0x00002000 2,644 bytes 3,072 bytes 4.56 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3698923B0227C7B2077F825225F6D13E
.data 0x00003000 208 bytes 512 bytes 0.45 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 3E54B380C18E9FB1C3756C3724029E08
.pdata 0x00004000 372 bytes 512 bytes 6.13 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F22D88DB8FB638E24557410F15434FF5
.emp0 0x00005000 248 bytes 512 bytes 4.30 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6060AA49D3C752D8CF1A2BDEF2FE6869
.data2 0x00006000 94,208 bytes 94,208 bytes 2.68 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 3ADC75192A28B9E6FA71C0A314944FCC
.EMP 0x0001d000 208,896 bytes 208,896 bytes 1.31 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 562924CC994A6A8250EE6075A845E8EA
.data3 0x00050000 36,864 bytes 36,864 bytes 1.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE AD2F9ED014F9397B359A88172E91BC56
.emp1 0x00059000 1,338,772 bytes 1,338,880 bytes 7.21 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 102D48F03C4D6C36587D165E1455B359
.reloc 0x001a0000 192 bytes 512 bytes 1.64 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 24A819125FE0D8B30B31BBBC1FC1161B
.rsrc 0x001a1000 233 bytes 512 bytes 2.53 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C57D5F6830519FDFB7C7D6DBCBECB182
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 1 (145 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 145 bytes
100%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.010120B2 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.010120B2 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware