Gridinsoft Logo
File Icon

JM Soloutions Loader.exe Trojan Downloader Analysis

Updated 11 months ago
Checked by Malware Check
JM Soloutions Loader.exe

Technical Analysis

File Name JM Soloutions Loader.exe
File Type
PE32+ executable (console) x86-64, for MS Windows
Scanner Version 1.0.184.174
Database Version 2024-08-10 03:00:29 UTC
⚠

Trojan.Win64.Downloader.sa

Malware family: Downloader

Downloader Trojans specialize in retrieving and installing additional malware payloads. Unlike comprehensive malware, they focus specifically on payload delivery rather than direct system damage.
N/A
Detection Rate
1,514,496
File Size (bytes)
2024-08-10
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
bc64ab9131d64c3e7deb91d87bcf9561
SHA1
2d57be0114d349601b673c9f37b505823b7840d3
SHA256
6a98e734207cf716866d627d159cf5f63c501ebf932147d68ce34d1657951fba
SHA512
af6abc718156f3a6d0b5913921801bbd5a602279027e04cabc070cd1a55b091ecb603e02c14260d08bf6e61f572209690d3295047fb2b7f0d0f304326f2fb088
ImpHash
d8aeaa3b897b31df1e135500a9ea67b1

PE Analysis

Basic Information

▼
Icon
Hash: f7fb6eb16704ea8e8465e4438e08c99c
Fuzzy: 9afdb3d2f97afcc1b2b091e3f470c4f5
dHash: d8e8e8f8d05444f0
Image Base 0x140000000
Entry Point 0x14005b1c4
Compilation Time 2024-08-07 22:31:09
Checksum 0x00000000 (Actual: 0x0017c125)
OS Version 6.0
PEiD Signatures PE32+ executable (console) x86-64, for MS Windows
PDB Path C:\Users\Joel Matic\Desktop\loader\loader-main\x64\Release\Loader.pdb
Digital Signature The PE file does not contain a certificate table.
Imports 20 libraries
Exports 0 functions
Resources 3 Resources
Sections 6 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 375,959 bytes 376,320 bytes 6.51 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 025591DF86CAD5071C51722258F931E6
.rdata 0x0005d000 1,013,004 bytes 1,013,248 bytes 6.75 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 131649C1ADE1874EC9593B6673DEACBB
.data 0x00155000 104,008 bytes 101,888 bytes 6.09 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 3CBD5E2B08AD9E390E8F7A7E8FBDFB12
.pdata 0x0016f000 16,284 bytes 16,384 bytes 5.80 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 4040EFA318BC515B78741E20FFF57A88
.rsrc 0x00173000 4,920 bytes 5,120 bytes 5.84 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6A0199A061DA538FF352DF0AB971AFF0
.reloc 0x00175000 400 bytes 512 bytes 4.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 7BC8A4042B3A26D155EFD3B53AD47EA0
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 3 (4,676 bytes)
Resource Type Count Total Size Percentage
RT_ICON 1 4,264 bytes
91.2%
RT_GROUP_ICON 1 20 bytes
0.4%
RT_MANIFEST 1 392 bytes
8.4%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Downloader.sa Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Downloader.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware