Gridinsoft Logo
File Icon

The ReShade_Setup_6.1.1.exe (ReShade Setup) File Analysis

Updated 1 year ago
Checked by Malware Check
ReShade_Setup_6.1.1.exe

Technical Analysis

File Name ReShade_Setup_6.1.1.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
SSDEEP Hash
49152:GJ3bUDVjzGEOWTLBM6mYI5pOo11cz8Y+z1LJwzkXcO78v26twH8Fr8etqNqD4Sq:GiBjqiLBt7apOapYee26td8ea8q
Scanner Version 1.0.172.174
Database Version 2024-04-22 20:00:35 UTC
⚠

Suspicious File Detected

Detected by 7 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
10%
Detection Rate
3,654,272
File Size (bytes)
7/70
Engines Detected
2024-04-22
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
66be9e4eed5cb2d1c66de1f4264ba23e
SHA1
db25de0f1ecfbd201768de67a63b61d4bb67a952
SHA256
7dfef150d8377d59bb9fbf511b2769e4ed496f9bdafedd9b5eb15caaa2288413
SHA512
d89aaf0291dac524ef3b7b23a1f7dd0606be719cd417f430ae0699315355ff71ee2ca09978ffc96a1417679242546a0dbf7f517b0ec56ef6634db29340103ab4
ImpHash
f34d5f2d4577ed6d9ceec516c1f5a744

Security Engines with Detections (7 of 70)

Bkav
W32.AIDetectMalware.CS Malicious
Sophos
Generic Reputation PUA (PUA) Malicious
Varist
W32/ABApplication.FZYD-6525 Malicious
MaxSecure
Trojan.Malware.241375262.susgen Malicious
Fortinet
Riskware/Application Malicious
DeepInstinct
MALICIOUS Malicious
alibabacloud
Trojan:Win/Malgent.Gen Malicious
63 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 633cc43e495bf2220851e73eb7a75187
Fuzzy: cac8cb1dae2a3f516c31c2f2d10ebaa4
dHash: 00b2e2e2c2e2b200
Image Base 0x00400000
Entry Point 0x0041f1f2
Compilation Time 2024-04-14 13:05:43
Checksum 0x0037d16f (Actual: 0x0037d16f)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Digital Signature Chain verification from CN=ReShade, [email protected] (serial:158857473820933528650258895346321435594, sha1:589690208a5e52fb96980c4a6698f50acd47c49f) failed: The X.509 certificate provided is self-signed - "Common Name: ReShade, Email Address: [email protected]"
Imports 1 libraries
mscoree
Exports 0 functions
Resources 8 Resources
Sections 3 Sections

Version Information

▼
Translation 0x0000 0x04b0
Comments
CompanyName crosire
FileDescription ReShade Setup
FileVersion 6.1.1.0
InternalName ReShade Setup.exe
LegalCopyright Copyright © 2014. All rights reserved.
OriginalFilename ReShade Setup.exe
ProductName ReShade
ProductVersion 6.1.1
Assembly Version 6.1.1.0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00002000 119,296 bytes 119,296 bytes 6.35 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ BC04586A9BEB0EDB8AFCE28BC456C728
.rsrc 0x00020000 103,160 bytes 103,424 bytes 4.57 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ B8A5DCF73447516A65FF79F7B788A6F0
.reloc 0x0003a000 12 bytes 512 bytes 0.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 13D6A6A0AFD5A2E75306668F6CDAE632

Resource Analysis

▼
Total Resources: 8 (102,658 bytes)
Resource Type Count Total Size Percentage
RT_ICON 5 100,874 bytes
98.3%
RT_GROUP_ICON 1 76 bytes
0.1%
RT_VERSION 1 824 bytes
0.8%
RT_MANIFEST 1 884 bytes
0.9%

Certificate Chain Analysis

▼
Certificate Information
Product ReShade
Description ReShade Setup
File Version 6.1.1.0
Original Name ReShade Setup.exe
Signing Date 01:05 PM 04/14/2024 (487 days ago)
Verification Status A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Signers ReShade
Internal Name ReShade Setup.exe
Copyright Copyright © 2014. All rights reserved.
Certificate Chain Summary
ReShade #1 Primary
Validity Period: 2019-03-16 13:59:52 → 2039-12-31 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 77 82 D6 29 97 92 5A A1 46 AB 3B 81 72 65 AB CA
DigiCert Trusted Root G4 #2 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #3 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Timestamp 2023 #4 Chain
Validity Period: 2023-07-14 00:00:00 → 2034-10-13 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 05 44 AF F3 94 9D 08 39 A6 BF DB 3F 5F E5 61 16

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

Chain verification from CN=ReShade, [email protected] (serial:158857473820933528650258895346321435594, sha1:589690208a5e52fb96980c4a6698f50acd47c49f) failed: The X.509 certificate provided is self-signed - "Common Name: ReShade, Email Address: [email protected]"

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
7 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware