Gridinsoft Logo

The FantoPiX Limbo.exe File Analysis

Updated 1 year ago
Checked by Malware Check
FantoPiX Limbo.exe

Technical Analysis

File Name FantoPiX Limbo.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
SSDEEP Hash
384:36286WIiejtCVLO309Qmykrt4QdqMjf+vWEWxrAF+rMRTyN/0L+EcoinblneHQMH:3mHdGdkrOGb+eE2rM+rMRa8NuRzWt
Scanner Version 1.0.177.174
Database Version 2024-05-26 17:00:29 UTC
⚠

Suspicious File Detected

Detected by 62 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
85%
Detection Rate
37,888
File Size (bytes)
62/73
Engines Detected
2024-05-26
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
142c2d3ede31c953b92f58455ab30014
SHA1
e4e9e413d34ed9c56e5266f00e4993d9c0deb151
SHA256
7c44951f7f89f124957782ec6c62baf3336567ed92c13df07029303ba1e0bcd6
SHA512
5905bb46b8fefc2bd7c72f8ffe1b2aaebd602c9904993af42a2bdfe413c391f1bfb9d80fbf9181ec4394b27d73b55b03cfdcf3bc25c31f00d8add2e289d4a002
ImpHash
f34d5f2d4577ed6d9ceec516c1f5a744

Security Engines with Detections (62 of 73)

Bkav
W32.AIDetectMalware.CS Malicious
Lionic
Virus.Generic.AI.1!c Malicious
Elastic
Windows.Trojan.Njrat Malicious
CAT-QuickHeal
Backdoor.Bladabindi.B3 Malicious
Skyhigh
BehavesLike.Win32.BackdoorNJRat.nm Malicious
Cylance
unsafe Malicious
Zillya
Trojan.Bladabindi.Win32.72266 Malicious
Sangfor
Suspicious.Win32.Save.a Malicious
K7AntiVirus
Trojan ( 700000121 ) Malicious
K7GW
Trojan ( 700000121 ) Malicious
Cybereason
malicious.ede31c Malicious
Arcabit
Trojan.MSIL.Krypt.44 Malicious
Baidu
MSIL.Backdoor.Bladabindi.a Malicious
VirIT
Trojan.Win32.DownLoader21.BPQW Malicious
Symantec
Backdoor.Ratenjay!gen3 Malicious
ESET-NOD32
a variant of MSIL/Bladabindi.AR Malicious
APEX
Malicious Malicious
ClamAV
Win.Packed.Bladabindi-7994427-0 Malicious
Kaspersky
HEUR:Trojan.Win32.Generic Malicious
BitDefender
Gen:Heur.MSIL.Krypt.44 Malicious
NANO-Antivirus
Trojan.Win32.Autoruner2.ebrjyu Malicious
ViRobot
Backdoor.Win32.Agent.37888.AL Malicious
MicroWorld-eScan
Gen:Heur.MSIL.Krypt.44 Malicious
Avast
MSIL:Bladabindi-JK [Trj] Malicious
Tencent
Trojan.Msil.Bladabindi.fa Malicious
TACHYON
Backdoor/W32.DN-NjRat.37888.AA Malicious
Emsisoft
Worm.Bladabindi (A) Malicious
F-Secure
Trojan.TR/ATRAPS.Gen Malicious
DrWeb
Trojan.MulDrop6.43244 Malicious
VIPRE
Gen:Heur.MSIL.Krypt.44 Malicious
TrendMicro
BKDR_BLADABI.SMC Malicious
McAfeeD
Real Protect-LS!142C2D3EDE31 Malicious
Trapmine
malicious.moderate.ml.score Malicious
FireEye
Generic.mg.142c2d3ede31c953 Malicious
Sophos
Troj/Bbindi-W Malicious
SentinelOne
Static AI - Malicious PE Malicious
Jiangmin
TrojanDropper.Autoit.dce Malicious
Webroot
W32.Malware.Gen Malicious
Avira
TR/ATRAPS.Gen Malicious
Antiy-AVL
Trojan[Backdoor]/MSIL.Bladabindi.as Malicious
Xcitium
TrojWare.MSIL.Spy.Agent.CP@4pqytu Malicious
Microsoft
Trojan:MSIL/njRAT.RDSA!MTB Malicious
ZoneAlarm
HEUR:Trojan.Win32.Generic Malicious
GData
MSIL.Trojan-Spy.Bladabindi.BQ Malicious
Varist
W32/MSIL_Troj.AP.gen!Eldorado Malicious
AhnLab-V3
Trojan/Win32.Korat.R207428 Malicious
McAfee
Trojan-FIGN Malicious
MAX
malware (ai score=88) Malicious
VBA32
Trojan.MSIL.Bladabindi.Heur Malicious
Malwarebytes
Generic.Malware.AI.DDS Malicious
Panda
Trj/GdSda.A Malicious
Zoner
Trojan.Win32.84773 Malicious
Rising
Backdoor.njRAT!1.9E49 (CLASSIC) Malicious
Yandex
Trojan.Agent!gyT5um5AOYY Malicious
Ikarus
Trojan.Inject Malicious
MaxSecure
Trojan.Malware.300983.susgen Malicious
Fortinet
MSIL/Bladabindi.AS!tr Malicious
BitDefenderTheta
Gen:NN.ZemsilF.36804.cmW@aSOS4wh Malicious
AVG
MSIL:Bladabindi-JK [Trj] Malicious
DeepInstinct
MALICIOUS Malicious
CrowdStrike
win/malicious_confidence_100% (D) Malicious
alibabacloud
Backdoor:Win/Bladabindi.BCE(dyn) Malicious
11 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x0040abbe
Compilation Time 2024-05-26 13:23:53
Checksum 0x00000000 (Actual: 0x00009d99)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 1 libraries
mscoree
Exports 0 functions
Resources 1 Resources
Sections 3 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00002000 35,780 bytes 35,840 bytes 5.60 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 0CF081572F5B0CEB3B3DB14C1AF7A0FC
.rsrc 0x0000c000 576 bytes 1,024 bytes 4.97 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F7CE2F7B506CE16C06C85A549EF2CD98
.reloc 0x0000e000 12 bytes 512 bytes 0.08 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 163D66697186C0743C0DA6F82247A39A

Resource Analysis

▼
Total Resources: 1 (487 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 487 bytes
100%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
62 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware