Gridinsoft Logo

The executable.1156.exe (Spooler SubSystem App) File Analysis

Updated 1 year ago
Checked by Malaware Check
executable.1156.exe

Technical Analysis

File Name executable.1156.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.144.174
Database Version 2023-11-01 00:03:12 UTC
✓

Clean File

No threats detected by our scanner

0%
Detection Rate
559,104
File Size (bytes)
2023-11-01
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
277517f667e47c66aa5c1005cf1c108d
SHA1
7046d5f43ea035a6f9fb7a8ad7f3f94d6329d28d
SHA256
76926016c6251dc314887470c7796e8370aef830e5673729b37963e3b7de209e
SHA512
bf6398d33c2331f75ae40d2f5b583d8ab82099c884c0a20042774737a9adb069941211fe2e747e8e81267741dddc66a93e545287126f864af30dd257d6c7fe2c
ImpHash
631fdb37f5587bb06fab5c930edc4a1f

PE Analysis

Basic Information

▼
Image Base 0xffc60000
Entry Point 0xffc6f1e0
Compilation Time 2010-11-20 11:45:43
Checksum 0x0008e6ab (Actual: 0x0008dc7e)
OS Version 6.1
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 9 libraries
msvcrt, ntdll, API-MS-Win-Core-LocalRegistry-L1-1-0, API-MS-WIN-Service-Core-L1-1-0, RPCRT4, KERNEL32, USER32, POWRPROF, DNSAPI
Exports 220 functions
Resources 3 Resources
Sections 6 Sections

Version Information

▼
CompanyName Microsoft Corporation
FileDescription Spooler SubSystem App
FileVersion 6.1.7601.17514 (win7sp1_rtm.101119-1850)
InternalName spoolsv.exe
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename spoolsv.exe
ProductName Microsoft® Windows® Operating System
ProductVersion 6.1.7601.17514
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 307,888 bytes 308,224 bytes 2.63 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 88140FC73E5F72F0882BF348DB628215
.rdata 0x0004d000 204,800 bytes 204,800 bytes 1.92 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 42BBF4684A798EE97C4AE1D6FFB81063
.data 0x0007f000 8,320 bytes 7,680 bytes 2.69 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 565C711F6C0509C46CD71BDBABFEF7EE
.pdata 0x00082000 22,644 bytes 23,040 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ BC2432B0C085142AD707ED2EF20D3D0F
.rsrc 0x00088000 2,064 bytes 2,560 bytes 3.80 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CFC8B0B0EAA3AA3887EFDF6461DFD834
.reloc 0x00089000 11,348 bytes 11,776 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 09619CAD959A5C220C87F12082613988

Resource Analysis

▼
Total Resources: 3 (1,818 bytes)
Resource Type Count Total Size Percentage
MUI 1 200 bytes
11%
RT_VERSION 1 920 bytes
50.6%
RT_MANIFEST 1 698 bytes
38.4%

Certificate Chain Analysis

▼
Certificate Information
Product Microsoft® Windows® Operating System
Description Spooler SubSystem App
File Version 6.1.7601.17514 (win7sp1_rtm.101119-1850)
Original Name spoolsv.exe
Internal Name spoolsv.exe
Copyright © Microsoft Corporation. All rights reserved.

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
This file passed all security checks, but stay vigilant. New malware variants appear daily that can evade detection. Always verify files come from official sources and check digital signatures when available.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware