Gridinsoft Logo
File Icon

717c20f1e4f5925c103b80832f80ab2079ca22d09df089dbf9d835ac0a1a63e9 Ransomware STOP/Djvu Analysis

Updated 1 year ago
Checked by Malaware Check
717c20f1e4f5925c103b80832f80ab2079ca22d09df089dbf9d835ac0a1a63e9

Technical Analysis

File Name 717c20f1e4f5925c103b80832f80ab2079ca22d09df089dbf9d835ac0a1a63e9
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.176.174
Database Version 2024-05-17 11:00:18 UTC
⚠

Ransom.Win32.STOP.tr

Malware family: STOP/Djvu

STOP/Djvu ransomware encrypts files on victim systems and demands ransom payments for decryption keys. This ransomware family has maintained consistent activity over several years, affecting both individual users and organizational networks through various distribution methods.
N/A
Detection Rate
741,376
File Size (bytes)
2024-05-17
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
f53c71e50af396778d6d94b7067b9613
SHA1
0f66ef86e34795b66c3620e81cfe64e4d3ab47b4
SHA256
717c20f1e4f5925c103b80832f80ab2079ca22d09df089dbf9d835ac0a1a63e9
SHA512
87ebefdfcee5e27a106a7fa9a4627fef2b36bc345d16ede48c2115cbc51a494a8825e5a6e073f4687777524f7c71e72ae6c95d54e5663ac1adfe5bf9e1623f71
ImpHash
8b14535b7546f94f1ac354dac2df7e48

PE Analysis

Basic Information

▼
Icon
Hash: 6d7c5a93bf831c241b0941dc53f8e085
Fuzzy: f32a923f45a1742bd3257f9787651b6f
dHash: 40dadac2a2928aa4
Image Base 0x00400000
Entry Point 0x00403f3c
Compilation Time 2023-02-19 16:26:29
Checksum 0x000c32a8 (Actual: 0x000c32a8)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 5 libraries
KERNEL32, USER32, GDI32, ole32, MSIMG32
Exports 0 functions
Resources 20 Resources
Sections 4 Sections

Version Information

▼
FileVersions 70.75.12.64
InternalName Moon
FileDescription Verens
LegalCopyright Copyrights (C) 2023, fulletien
OriginalFilenames Filezer
ProductVersions 82.1.74.60
Translation 0x16fe 0x06d8

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 69,523 bytes 69,632 bytes 6.71 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 50C3E9908B61C20BAF11E0BB68117D81
.rdata 0x00012000 28,198 bytes 28,672 bytes 4.70 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E021289596833055EB00DB85310A2431
.data 0x00019000 4,096,584 bytes 604,160 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BD21EDE275E476FED6949ABCF9252A61
.rsrc 0x00402000 37,840 bytes 37,888 bytes 4.73 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 038CEDD2B93B2D0B1871FC4174E371E3
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 20 (36,636 bytes)
Resource Type Count Total Size Percentage
AFX_DIALOG_LAYOUT 1 2 bytes
0%
RT_CURSOR 5 7,832 bytes
21.4%
RT_ICON 7 24,120 bytes
65.8%
RT_STRING 3 3,896 bytes
10.6%
RT_GROUP_CURSOR 2 82 bytes
0.2%
RT_GROUP_ICON 1 104 bytes
0.3%
RT_VERSION 1 600 bytes
1.6%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Ransom.Win32.STOP.tr Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win32.STOP.tr without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware