Gridinsoft Logo
File Icon

The powershell.exe (Windows PowerShell) File Analysis

Updated 1 year ago
Checked by Malware Check
powershell.exe

Technical Analysis

File Name powershell.exe
File Type
PE32 executable (console) Intel 80386, for MS Windows
Scanner Version 1.0.146.174
Database Version 2023-11-06 21:01:12 UTC
✓

Clean File

No threats detected by our scanner

0%
Detection Rate
433,152
File Size (bytes)
2023-11-06
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
c32ca4acfcc635ec1ea6ed8a34df5fac
SHA1
f5ee89bb1e4a0b1c3c7f1e8d05d0677f2b2b5919
SHA256
73a3c4aef5de385875339fc2eb7e58a9e8a47b6161bdc6436bf78a763537be70
SHA512
6e43dca1b92faace0c910cbf9308cf082a38dd39da32375fad72d6517dea93e944b5e5464cf3c69a61eabf47b2a3e5aa014d6f24efa1a379d4c81c32fa39ddbc
ImpHash
194427a488ed1dd0a91731658b071667

PE Analysis

Basic Information

▼
Icon
Hash: 211310fa36c43b67f4b9dd836a6d1e84
Fuzzy: 3ef19c85b9689424e7450af5fb583bf6
dHash: 10acd8b2b2ece609
Image Base 0x00400000
Entry Point 0x0040afc0
Compilation Time 1996-01-08 14:51:31
Checksum 0x0006a9f2 (Actual: 0x0006a9f2)
OS Version 10.0
PEiD Signatures PE32 executable (console) Intel 80386, for MS Windows
PDB Path powershell.pdb
Digital Signature The PE file does not contain a certificate table.
Imports 8 libraries
msvcrt, ATL, KERNEL32, OLEAUT32, ADVAPI32, OLE32, USER32, mscoree
Exports 0 functions
Resources 26 Resources
Sections 5 Sections

Version Information

▼
CompanyName Microsoft Corporation
FileDescription Windows PowerShell
FileVersion 10.0.19041.546 (WinBuild.160101.0800)
InternalName POWERSHELL
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename PowerShell.EXE
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.19041.546
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 62,300 bytes 62,464 bytes 5.68 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ C74F3599A1CF2A40ACA5C9A0CB5BC93F
.data 0x00011000 2,360 bytes 1,024 bytes 4.39 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 239079A196D3B40A5EE3F527569F4ADB
.idata 0x00012000 3,288 bytes 3,584 bytes 5.29 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C07646BD5525F67A7D420A3B9CA7B73E
.rsrc 0x00013000 359,816 bytes 359,936 bytes 5.31 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9093B45A71887240DBEECE9BD155D708
.reloc 0x0006b000 4,732 bytes 5,120 bytes 6.26 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0525440EF900B706A881AA97C3CA7EC0

Resource Analysis

▼
Total Resources: 26 (358,359 bytes)
Resource Type Count Total Size Percentage
MUI 1 216 bytes
0.1%
RT_ICON 21 355,214 bytes
99.1%
RT_GROUP_ICON 2 306 bytes
0.1%
RT_VERSION 1 924 bytes
0.3%
RT_MANIFEST 1 1,699 bytes
0.5%

Certificate Chain Analysis

▼
Certificate Information
Product Microsoft® Windows® Operating System
Description Windows PowerShell
File Version 10.0.19041.546 (WinBuild.160101.0800)
Original Name PowerShell.EXE
Internal Name POWERSHELL
Copyright © Microsoft Corporation. All rights reserved.

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
This file passed all security checks, but stay vigilant. New malware variants appear daily that can evade detection. Always verify files come from official sources and check digital signatures when available.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware