Gridinsoft Logo
File Icon

Global_mapper.exe Trojan Packed Analysis

Updated 1 month ago
Checked by Malaware Check
global_mapper.exe

Technical Analysis

File Name global_mapper.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.214.174
Database Version 2025-04-22 21:00:30 UTC
⚠

Trojan.Win64.Packed.cld

Malware family: Packed

Packed malware uses compression, encryption, or obfuscation techniques to alter code appearance and evade security detection. These methods modify the original malware structure to bypass signature-based detection systems and complicate analysis efforts.
N/A
Detection Rate
42,993,792
File Size (bytes)
2025-04-22
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
2a4a59feb99b1eaa3f16c17d93123c9c
SHA1
ee813c2efb6982e388396e3c879ed102e263ee9d
SHA256
7b12fe2dc94e7749388581fe9480e74c447b73e64dbe24ee7cdbb2f5b3d1b277
SHA512
75d4f1f8affc671cc479bbe8ddac82aca7ebeedfd22e06cac9d2783c172ad38a1eabab2511ea3819e832e59758036ec73b5134544d7c675e90f54778ba91b53b
ImpHash
f1329bb49707b255568d57f98888c87c

PE Analysis

Basic Information

▼
Icon
Hash: 357c7d1c976253d2b766bc8514c29edf
Fuzzy: b05ef06b143c89dfd0ddb3311b1ca29c
dHash: 23913961630d330f
Image Base 0x140000000
Entry Point 0x1467cb0fc
Compilation Time 2022-09-20 14:31:06
Checksum 0x0502f62d (Actual: 0x02906c91)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 93 libraries
Exports 3546 functions
Resources 1908 Resources
Sections 10 Sections

Version Information

▼
CompanyName Blue Marble Geographics
FileDescription Global Mapper 24.0
FileVersion 24.0
InternalName Global Mapper
LegalCopyright Copyright © 2002-2022
OriginalFilename global_mapper.exe
ProductName Global Mapper 24.0
ProductVersion 24.0
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 52,301,824 bytes 21,010,432 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5F73D39D78816729EB6D09EB0082A29A
0x031e2000 1,200,128 bytes 329,728 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 54F43A7131E9A68666D4BCBAF6B473F3
0x03307000 19,087,360 bytes 6,959,104 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C0AD7133FC2392EF903FD016C314E261
0x0453b000 8,896,512 bytes 346,624 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE EF95B47C6973E89486918D785454AAD4
0x04db7000 1,601,536 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x04f3e000 53,248 bytes 32,256 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 19E4B028A4207793DEE81720CC22E8A4
0x04f4b000 8,101,888 bytes 3,195,392 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E7C33C12043E1F1547D636DCDFF1546D
.rsrc 0x05705000 581,632 bytes 578,048 bytes 3.61 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2089FC3413E8D3BB4CF16DBA7B267A78
0x05793000 12,091,392 bytes 5,603,328 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 58ADE0F4679D5CB9CECFD525F335345E
0x0631b000 4,931,584 bytes 4,928,000 bytes 7.80 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D08385356736D831364BF47F73E08C86
Entropy Analysis Alert

8 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 1908 (7,999,764 bytes)
Resource Type Count Total Size Percentage
AFX_DIALOG_LAYOUT 276 1,264 bytes
0%
PNG 410 2,551,083 bytes
31.9%
RT_CURSOR 47 184,172 bytes
2.3%
RT_BITMAP 71 3,507,400 bytes
43.8%
RT_ICON 22 483,500 bytes
6%
RT_MENU 10 44,594 bytes
0.6%
RT_DIALOG 512 683,212 bytes
8.5%
RT_STRING 370 526,892 bytes
6.6%
RT_ACCELERATOR 1 464 bytes
0%
RT_GROUP_CURSOR 47 940 bytes
0%
RT_GROUP_ICON 10 368 bytes
0%
RT_VERSION 1 764 bytes
0%
RT_MANIFEST 1 642 bytes
0%
None 130 14,469 bytes
0.2%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Packed.cld Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Packed.cld without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware