Gridinsoft Logo

The PotatoGraphics.exe (PotatoGraphics) File Analysis

Updated 2 months ago
Checked by Malaware Check
PotatoGraphics.exe

Technical Analysis

File Name PotatoGraphics.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows
SSDEEP Hash
1572864:8Wl164XEQCrwvXoTXkcpDNNEfxPJc9XIr1lAZ1POJC6X/1B+i3j:8y640cAQ656xPJc9k1lfhWiT
Scanner Version 1.0.210.174
Database Version 2025-03-14 13:00:54 UTC
⚠

Suspicious File Detected

Detected by 5 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
7%
Detection Rate
67,247,829
File Size (bytes)
5/71
Engines Detected
2025-03-14
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
f73b7791baeb98ce6c6f6b7f82e1792d
SHA1
3b1620b7a105b3ffa6c248f020cbee1119211952
SHA256
7533c3d88c4ff72273d982f53faf9cfa04a7ca51dae4c481512663514872d21d
SHA512
dc4cdca7ece2beb159bb1ed316e61b4334931307351ca3799593c47dc706164454e874aa23ffcbd2c8787ab7d2456068c3bc054800d6d727bec8ad700a4d321c
ImpHash
df453def9d4f8f1453a5fa51c6608cfc

Security Engines with Detections (5 of 71)

Zillya
Trojan.RozenaAGen.Win32.591 Malicious
VirIT
Trojan.Win32.Genus.WMJ Malicious
Antiy-AVL
Trojan/Win32.Agent Malicious
Microsoft
Trojan:Win32/Pomal!rfn Malicious
VBA32
TrojanSpy.Stealer Malicious
66 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x008fa050
Compilation Time 2023-10-31 14:59:22
Checksum 0x00000000 (Actual: 0x04026c3a)
OS Version 6.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
PDB Path D:\a\_work\1\s\artifacts\obj\coreclr\windows.x86.Release\Corehost.Static\singlefilehost.pdb
Digital Signature No valid SignedData structure was found.
Imports 17 libraries
Exports 5 functions
Resources 5 Resources
Sections 8 Sections

Version Information

▼
Translation 0x0000 0x04b0
CompanyName PotatoGraphics
FileDescription PotatoGraphics
FileVersion 1.0.0.0
InternalName PotatoGraphics.dll
LegalCopyright
OriginalFilename PotatoGraphics.dll
ProductName PotatoGraphics
ProductVersion 1.0.0
Assembly Version 1.0.0.0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 5,572,874 bytes 5,573,120 bytes 6.56 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7AD59DCF80AFCBA46BB6779381710378
.CLR_UEF 0x00552000 68 bytes 512 bytes 0.96 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 57BC74EDCAE15B11802D7FF93D25B76A
.rdata 0x00553000 1,307,630 bytes 1,307,648 bytes 5.13 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ A81CB89E48FC1A139C5BD873361779E1
.data 0x00693000 81,084 bytes 29,184 bytes 3.87 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 9EBA1EFE4F91CDE198B04E2A6523BD9D
.didat 0x006a7000 28 bytes 512 bytes 0.25 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F0474F498313864F0BEDB9BB443E88CF
_RDATA 0x006a8000 69,392 bytes 69,632 bytes 5.36 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 211089D7D672E1712B48C26D0BDC0A1B
.rsrc 0x006b9000 1,268,452 bytes 1,268,736 bytes 6.40 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6A924232B319F0A79417DB80C6464134
.reloc 0x007ef000 268,556 bytes 268,800 bytes 6.67 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 0BDA70936AE3F88B8B17230BF231D2D3
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 5 (1,267,976 bytes)
Resource Type Count Total Size Percentage
RT_RCDATA 3 1,266,776 bytes
99.9%
RT_VERSION 1 764 bytes
0.1%
RT_MANIFEST 1 436 bytes
0%

Certificate Chain Analysis

▼
Certificate Information
Product PotatoGraphics
Description PotatoGraphics
File Version 1.0.0.0
Original Name PotatoGraphics.dll
Internal Name PotatoGraphics.dll
Certificate Chain Summary
.NET DAC #1 Primary
Validity Period: 2023-04-06 18:27:54 → 2024-04-03 18:27:54
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 05 15 B0 EF 41 0F A4 18 8F B1 00 00 00 00 05 15
Microsoft Code Signing PCA 2010 #2 Chain
Validity Period: 2010-07-06 20:40:17 → 2025-07-06 20:50:17
Signature Algorithm: sha256RSA
Serial Number: 61 0C 52 4C 00 00 00 00 00 03
Microsoft Time-Stamp Service #3 Chain
Validity Period: 2023-05-25 19:12:18 → 2024-02-01 19:12:18
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 01 D1 B2 5B 40 28 6C 2E D2 45 00 01 00 00 01 D1
Microsoft Time-Stamp PCA 2010 #4 Chain
Validity Period: 2021-09-30 18:22:25 → 2030-09-30 18:32:25
Signature Algorithm: sha256RSA
Serial Number: 33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
5 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware