The Shape of Dreams RUS ENG 11 1.0.7 Portable.exe File Analysis

Updated 3 months ago

Checked by Malware Check

Shape of Dreams RUS ENG 11 1.0.7 Portable.exe

Technical Analysis

File Name	Shape of Dreams RUS ENG 11 1.0.7 Portable.exe
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	3072:E6GEtNEXN4wCq5/v46QC2mCm/lY9Kkj3c6QQaWAk0Ag5qAWKGETBKnF58it3kzMx:hGYk4wCq5x+9T3bQQaNlTwNt3kz
Scanner Version	1.0.226.174
Database Version	2025-10-05 15:00:30 UTC

⚠

Suspicious File Detected

Detected by 26 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

36%

Detection Rate

231,072

File Size (bytes)

26/72

Engines Detected

2025-10-05

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	13500464210fe3a0e3903b6d1e2368d7
SHA1	98ed96f9b587182f7f3f9c3ef947119c58d4b675
SHA256	6605e0e1bb8725bad89d6742ced6460d9fa9c5589a72eba6de9cb35314d024d4
SHA512	9d64c48e9d3cd1cfbe6503bcf4fe7560abcd1d207ebc5a34ec4b950e5e17020d154c4b3c2bddd7afe134dc32560972f5ebdedfb1f815a6c0e7c30956a8731c30
ImpHash	9d4745b4b8ed18dda7e4fbf0015900e0

Security Engines with Detections (26 of 72)

Bkav

W32.AIDetectMalware Malicious

Lionic

Trojan.Win32.Yandex.4!c Malicious

Elastic

malicious (moderate confidence) Malicious

CTX

exe.trojan.yandex Malicious

CAT-QuickHeal

Trojan.Ghanarava.17471396572368d7 Malicious

Cylance

Unsafe Malicious

Sangfor

Riskware.Win32.Yandex.Vmse Malicious

CrowdStrike

win/grayware_confidence_100% (W) Malicious

ESET-NOD32

a variant of Win32/Yandex.K potentially unwanted Malicious

Paloalto

generic.ml Malicious

SUPERAntiSpyware

PUP.Bundler/Variant Malicious

Tencent

Pua:Riskware.Win32.Yandex.16001805 Malicious

McAfeeD

ti!6605E0E1BB87 Malicious

Ikarus

PUA.Yandex Malicious

GData

Win32.Application.Agent.Q1RLTL Malicious

Jiangmin

Grayware.Yandex.a Malicious

Webroot

W32.Adware.Gen Malicious

Google

Detected Malicious

Varist

W32/Yandex.H.gen!Eldorado Malicious

Antiy-AVL

GrayWare/Win32.Yandex Malicious

Gridinsoft

PUP.Win32.Downloader.oa!s1 Malicious

VBA32

Riskware.PackagingUntrustworthyYandex Malicious

Malwarebytes

PUP.Optional.Downloader Malicious

MaxSecure

Trojan.Malware.328123987.susgen Malicious

Fortinet

Riskware/PackagingUntrustworthyYandex Malicious

alibabacloud

Trojan:Win/Yandex.K Malicious

46 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: 392ef86c821c190403abcba071d4d503 Fuzzy: 7084d568ef659e35f736e2ccc91a8711 dHash: 4d6d6545e1e14565
Image Base	`0x00400000`
Entry Point	`0x004074a6`
Compilation Time	2023-05-19 13:34:48
Checksum	0x000454d1 (Actual: 0x00044bee)
OS Version	5.1
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`C:\BuildAgent\work\4a73c29f3c4e6ac\downloader\Release\downloader.pdb`
Digital Signature	OK
Imports	12 libraries
Exports	0 functions
Resources	8 Resources
Sections	6 Sections

Version Information

▼

FileDescription	Setup Downloader
FileVersion	0.1.0.33
InternalName	download
LegalCopyright	Copyright (C) 2015 Yandex LLC
OriginalFilename	downloader.exe
ProductName	Setup Downloader
ProductVersion	0.1.0.33
Translation	0x0419 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	143,196 bytes	143,360 bytes	6.64 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`B2F302DCDD2E298382279E8BA4E379A1`
`.rdata`	`0x00024000`	37,256 bytes	37,376 bytes	4.98 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`037CDCA27407B5EDD2DA31AA892A6521`
`.data`	`0x0002e000`	13,820 bytes	3,072 bytes	2.61 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B72A9D7AD331416726B4EB8310C842B5`
`.gfids`	`0x00032000`	308 bytes	512 bytes	2.40 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C9416F2EC5469E88CA913957752DB93C`
`.rsrc`	`0x00033000`	26,592 bytes	26,624 bytes	4.16 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`73E6F8B38237E248E97BA69E7DC19FBB`
`.reloc`	`0x0003a000`	6,232 bytes	6,656 bytes	6.42 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`DC6A543A9687C2F2D25595A1F85F0CA0`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 8 (26,082 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	5	24,082 bytes	92.3%
RT_GROUP_ICON	1	76 bytes	0.3%
RT_VERSION	1	692 bytes	2.7%
RT_MANIFEST	1	1,232 bytes	4.7%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

26 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1