Gridinsoft Logo
File Icon

Генератор IMEI Lumia.exe Trojan Agent Analysis

Updated 1 year ago
Checked by Malware Check
Генератор IMEI Lumia.exe

Technical Analysis

File Name Генератор IMEI Lumia.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.179.174
Database Version 2024-06-12 00:00:13 UTC
⚠

Trojan.Win32.Agent.cl

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
1,010,176
File Size (bytes)
2024-06-12
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
b0952b785c11066e52615ccdcfc85af5
SHA1
55101681b0364203d18a6e79ebf05ffb27550d4b
SHA256
6d9b375a7d48d23a2c70888dc82073b32ca9f82022789a160c3e55dece57399e
SHA512
292966b02d497318a89d3a219e5560f2df688e899646ea644174c171c60f484dc62aefbc9436f4432d1d4190b0b844ff5817b3f5603c13f2b5ddc466f43fe25c
ImpHash
8176fae8fcc4ea15fb284cb2001b2cf6

PE Analysis

Basic Information

▼
Icon
Hash: 2a3cceb5d038831767c9dcdc2fe64944
Fuzzy: adec011acfe6122bbc06de54f5e3584d
dHash: 0361a9a3b3ad331e
Image Base 0x00400000
Entry Point 0x004b3c50
Compilation Time 2017-01-05 04:51:38
Checksum 0x00000000 (Actual: 0x00105c16)
OS Version 5.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 10 libraries
oleaut32, advapi32, user32, kernel32, msimg32, gdi32, version, ole32, comctl32, winspool
Exports 0 functions
Resources 43 Resources
Sections 10 Sections

Version Information

▼
CompanyName
FileDescription IMEI Generator
FileVersion 1.1.0.0
InternalName IMEIGen
LegalCopyright CrazyBullet
LegalTrademarks
OriginalFilename IMEIGen
ProductName IMEI Generator
ProductVersion 1.0.0.0
Comments
Translation 0x0419 0x04e3

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 725,352 bytes 725,504 bytes 6.45 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ A7553BBC4CCB986586939BFCA7D86742
.itext 0x000b3000 3,296 bytes 3,584 bytes 5.82 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 14C2D3219C397F0CF54E288A095DCF08
.data 0x000b4000 9,180 bytes 9,216 bytes 4.07 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 1053ED9F78B73A66518842A51E78DBDC
.bss 0x000b7000 21,172 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.idata 0x000bd000 12,178 bytes 12,288 bytes 5.23 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2F7216BACA6C2ED13C02206C705232B8
.didata 0x000c0000 670 bytes 1,024 bytes 2.85 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 93781B796EF35F1CD9F169498AFA3FD4
.tls 0x000c1000 60 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x000c2000 24 bytes 512 bytes 0.21 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 25BECCA0403AD91CD989C19B27B5A919
.reloc 0x000c3000 65,468 bytes 65,536 bytes 6.69 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ CE3F89EB27A81DC58FAC93FF5F5A8253
.rsrc 0x000d3000 191,488 bytes 191,488 bytes 7.20 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 36346ADD7EC04CDCF0A811F94CFDD82E
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 43 (188,972 bytes)
Resource Type Count Total Size Percentage
RT_CURSOR 7 2,156 bytes
1.1%
RT_ICON 7 138,855 bytes
73.5%
RT_STRING 15 10,504 bytes
5.6%
RT_RCDATA 4 35,635 bytes
18.9%
RT_GROUP_CURSOR 7 140 bytes
0.1%
RT_GROUP_ICON 1 104 bytes
0.1%
RT_VERSION 1 728 bytes
0.4%
RT_MANIFEST 1 850 bytes
0.4%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Agent.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Agent.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware