Gridinsoft Logo
File Icon

Prismlauncher.exe Trojan Heuristic Analysis

Updated 1 month ago
Checked by Malaware Check
prismlauncher.exe

Technical Analysis

File Name prismlauncher.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.212.174
Database Version 2025-04-09 21:01:06 UTC
⚠

Trojan.Heur!.0201202F

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
16,395,776
File Size (bytes)
2025-04-09
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
e6dc643d57ee0916d3ff8a818ee470d0
SHA1
9f590997c9c12db83c898fd809ecc9c1d376f684
SHA256
728e8b1a5b95bf7ab6e9230a0edd4027f2ef387fed2123818c03448d5b1e6d07
SHA512
0aae4312e3f3713104c44d1d51f5650c23f5d30cbfbb9bc13ec7f869a3fe54eecea20b7f35544c06287bfe65a669e66a9c268c3765fd03f427be3d319c87d50c
ImpHash
dd9649e8582f9b81fb10be51bac4ad7a

PE Analysis

Basic Information

▼
Icon
Hash: 35d2c1a80133032cd42cce963b0770c8
Fuzzy: b40dc48b4f5fb6bc5a605f1d4061fb99
dHash: 30f8b0b0e0b2e030
Image Base 0x140000000
Entry Point 0x140001160
Compilation Time 2025-04-07 16:32:04
Checksum 0x00000000 (Actual: 0x00fb0c4e)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 25 libraries
Exports 0 functions
Resources 10 Resources
Sections 15 Sections

Version Information

▼
CompanyName MultiMC & Prism Launcher Contributors
FileDescription Prism Launcher
FileVersion 9.4.0.0
ProductName Prism Launcher
ProductVersion 9.4.0.0
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 7,239,702 bytes 7,240,192 bytes 5.94 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 4670FA8872A932B82D1B615360EDAC65
.rdata 0x006e9000 5,901,756 bytes 5,901,824 bytes 7.37 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ BB9CB816DC29A05E7C8358B895FE78C5
.buildid 0x00c8a000 53 bytes 512 bytes 0.65 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CDF0E021A0B96D44CF3D89DB902E266F
.data 0x00c8b000 52,576 bytes 45,056 bytes 1.90 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 56832B3A1FBEDE077DF304867D9ED6A3
.pdata 0x00c98000 101,628 bytes 101,888 bytes 6.47 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D7D19108206D7FECFB3D12F95623AFD9
.qtversi 0x00cb1000 16 bytes 512 bytes 0.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3782136C6CEB28ED388AA470D00FF7EF
.tls 0x00cb2000 16 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BF619EAC0CDF3F68D496EA9344137E8B
.rsrc 0x00cb3000 375,072 bytes 375,296 bytes 3.63 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 5CB02B9883FEAC4C0C7D27FF73F4CEC0
.reloc 0x00d0f000 54,316 bytes 54,784 bytes 5.47 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ AFCC0738B33428A5AAF9DC7926586404
/4 0x00d1d000 8,383 bytes 8,704 bytes 4.59 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 95B7D0D267A6B7B001DC622BA4027CC7
/18 0x00d20000 132,998 bytes 133,120 bytes 5.07 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0F79BE88AD006CDD194B558BF32BCA8A
/30 0x00d41000 11,025 bytes 11,264 bytes 5.61 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 9BAF487DB6FC4A8360384CC8437CC239
/42 0x00d44000 9,683 bytes 9,728 bytes 1.96 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ A9C03E055BC377F35D4A2309DAAA971B
/53 0x00d47000 544 bytes 1,024 bytes 0.79 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ C11F48C38219FB75BF3740F236D4CA82
/67 0x00d48000 144,352 bytes 144,384 bytes 5.24 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 36198BA3D7AA1964106D36FE9CF80C36
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 10 (374,442 bytes)
Resource Type Count Total Size Percentage
RT_ICON 7 372,408 bytes
99.5%
RT_GROUP_ICON 1 104 bytes
0%
RT_VERSION 1 564 bytes
0.2%
RT_MANIFEST 1 1,366 bytes
0.4%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.0201202F Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.0201202F without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware