Gridinsoft Logo

The msedge_elf.dll File Analysis

Updated 3 months ago
Checked by Malware Check
msedge_elf.dll

Technical Analysis

File Name msedge_elf.dll
File Type
Win32 DLL
Magic Bytes PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
SSDEEP Hash
24576:r9P9Cb9B2+0DgeAQ+yywzsCq/pTBTl2B3BSCaoo3PgAf/DeleNKj4H+fMXK:r9FCb2+6gFQ9zsCqHl29aLQUel
Scanner Version 1.0.226.174
Database Version 2025-09-29 00:00:26 UTC
⚠

Suspicious File Detected

Detected by 9 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
13%
Detection Rate
2,070,592
File Size (bytes)
9/72
Engines Detected
2025-09-29
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
2eb2a260113c54886eb6ca6dedd356df
SHA1
f122603ed8add38cab3fab58d95e4e69cd3e0cbf
SHA256
6828ba554d51627f57f16c2c9dffde5ad440ec3c658228c4c90add301ab4ff49
SHA512
af0171896c00b34b8e3192fa8b8b633b11804e851cfd4ff1f8a5b2dab8ab24c4a90c0e0dbc84b9d2aa4d590fd349feab8e815be6b571fa68ccaf525c2deec6a2
ImpHash
91478e17c100ccb7f5a8e81dc4828348

Security Engines with Detections (9 of 72)

Bkav
W64.AIDetectMalware Malicious
Elastic
malicious (moderate confidence) Malicious
Cynet
Malicious (score: 100) Malicious
Kaspersky
VHO:Trojan.Win32.Gatak.gen Malicious
Rising
Downloader.FakeDll!8.1BD60 (TFE:6:LGJyTQmSqOK) Malicious
Ikarus
Trojan.WinGo.Crypt Malicious
Microsoft
Program:Win32/Wacapew.C!ml Malicious
Google
Detected Malicious
DeepInstinct
MALICIOUS Malicious
63 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Image Base 0x248000000
Entry Point 0x2480011f0
Compilation Time 1970-01-01 00:00:00
Checksum 0x0020006b (Actual: 0x001fe256)
OS Version 6.1
PEiD Signatures PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 2 libraries
KERNEL32, msvcrt
Exports 6 functions
Resources 0 Resources
Sections 10 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 579,424 bytes 579,584 bytes 6.29 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 94346326591842E6413AD2AF8B624034
.data 0x0008f000 26,512 bytes 26,624 bytes 2.18 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 76644E9D858254FFA7149D961A8224AC
.rdata 0x00096000 1,419,312 bytes 1,419,776 bytes 7.16 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 8E80CC45CF41C21BA99F5717E9D43BC1
.pdata 0x001f1000 16,692 bytes 16,896 bytes 5.23 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4ABADA73F50A082451DBE83D6F87503C
.xdata 0x001f6000 1,180 bytes 1,536 bytes 3.57 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 863884042C0E732B1079025C4BFB36A4
.bss 0x001f7000 302,144 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.edata 0x00241000 249 bytes 512 bytes 2.94 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E45B561F65224EA327DF5E10DBF9298C
.idata 0x00242000 3,116 bytes 3,584 bytes 4.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E49E125032486B557F541F85BC729DF0
.tls 0x00243000 16 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BF619EAC0CDF3F68D496EA9344137E8B
.reloc 0x00244000 10,152 bytes 10,240 bytes 5.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ F4F37D0FFAF80C1F68CC31C00ACC9B93
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Certificate Chain Analysis

▼
Certificate Information
Signing Date 07:01 AM 07/31/2025 (163 days ago)
Verification Status The digital signature of the object did not verify.
Signers Microsoft Corporation; Microsoft Code Signing PCA 2011; Microsoft Root Certificate Authority 2011
Counter Signers Microsoft Time-Stamp Service; Microsoft Time-Stamp PCA 2010; Microsoft Root Certificate Authority 2010
Certificate Chain Summary
Microsoft Corporation #1 Primary
Validity Period: 2025-05-15 18:49:10 → 2026-05-15 18:49:10
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 04 7F 2F 42 2A 73 53 08 DE EA 00 00 00 00 04 7F
Microsoft Code Signing PCA 2011 #2 Chain
Validity Period: 2011-07-08 20:59:09 → 2026-07-08 21:09:09
Signature Algorithm: sha256RSA
Serial Number: 61 0E 90 D2 00 00 00 00 00 03
Microsoft Time-Stamp Service #3 Chain
Validity Period: 2024-07-25 18:31:19 → 2025-10-22 18:31:19
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 01 FF 12 38 7C F7 C1 65 D6 A1 00 01 00 00 01 FF
Microsoft Time-Stamp PCA 2010 #4 Chain
Validity Period: 2021-09-30 18:22:25 → 2030-09-30 18:32:25
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
9 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware