The utorrent_installer.exe (µT® Classic) File Analysis
Technical Analysis
| File Name | utorrent_installer.exe |
| File Type |
Win32 EXE
|
| Magic Bytes | PE32 executable (GUI) Intel 80386, for MS Windows |
| SSDEEP Hash |
24576:qXNrSLScusMmOvjjhzvLJyuRZvf+A1VeQ/+g0Fi4ETLRXuFU6zj8GXYL5GfrIwir:1uI2hZHV1l+g0Fi4cRXMsm4MfrIpCqz
|
| Scanner Version | 1.0.252.174 |
| Database Version | 2026-08-23 11:00:24 UTC |
Suspicious File Detected
Detected by 20 security engines - requires caution
This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
28%
Detection Rate
2,155,920
File Size (bytes)
20/71
Engines Detected
2026-08-23
Analysis Date
Scan Another File
File Identification
| Hash Type | Value | Action |
|---|---|---|
| MD5 |
c6c39d2a563696a0ce9b941771fac395
|
|
| SHA1 |
578c955322d93550e97d4ed194cb80444bc93a79
|
|
| SHA256 |
81763a5c5a91e53c0e9d730975dc56b3231f381b077bf448c447d1ce21cdcc90
|
|
| SHA512 |
6be9b7abeab2a34ae34aaf5b50e514d5f3a2a5cf65de8c0e1b68aeabc052e37ddae8e736bd7b686f7271e462023879b8b27f847aad5259e97eaffad97156f0cd
|
|
| ImpHash |
88016fcdef7f227c62171d0afad9aae4
|
Security Engines with Detections (20 of 71)
MicroWorld-eScan
Gen:Variant.Application.Bundler.491
Malicious
CTX
exe.unknown.bundler
Malicious
ALYac
Gen:Variant.Application.Bundler.491
Malicious
VIPRE
Gen:Variant.Application.Bundler.491
Malicious
CrowdStrike
win/grayware_confidence_60% (D)
Malicious
BitDefender
Gen:Variant.Application.Bundler.491
Malicious
K7GW
Unwanted-Program ( 005ce0ab1 )
Malicious
K7AntiVirus
Unwanted-Program ( 005ce0ab1 )
Malicious
Arcabit
Trojan.Application.Bundler.491
Malicious
Symantec
ML.Attribute.HighConfidence
Malicious
Elastic
malicious (moderate confidence)
Malicious
ESET-NOD32
Win32/OfferCore.E potentially unwanted application
Malicious
Emsisoft
Gen:Variant.Application.Bundler.491 (B)
Malicious
Microsoft
PUABundler:Win32/uTorrent_BundleInstaller
Malicious
GData
Gen:Variant.Application.Bundler.491
Malicious
AhnLab-V3
PUP/Win.OfferCore.R785502
Malicious
DeepInstinct
MALICIOUS
Malicious
Malwarebytes
PUP.Optional.Utorrent
Malicious
Rising
Adware.OfferCore/IFPS!1.FD26 (CLASSIC)
Malicious
Fortinet
Riskware/OfferCore
Malicious
51 engines reported no threats -
Only engines with detections are shown above for clarity
PE Analysis
Basic Information
▼| Icon |
Hash: 7ec2b329075d5006effa6bbc04f44475
Fuzzy: d5b4c97d99af0de364dcff143e5b7173 dHash: f8cacecc9c69b8f8 |
| Image Base | 0x00400000 |
| Entry Point | 0x004b1e60 |
| Compilation Time | 2026-02-11 11:40:27 |
| Checksum | 0x0021436d (Actual: 0x0021436d) |
| OS Version | 6.1 |
| PEiD Signatures |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| Digital Signature | OK |
| Imports |
5 libraries
kernel32, comctl32, user32, oleaut32, advapi32 |
| Exports | 2 functions |
| Resources | 23 Resources |
| Sections | 11 Sections |
Version Information
▼| Comments | This installation was built with Inno Setup. |
| CompanyName | |
| FileDescription | µT® Classic |
| FileVersion | 3.6 |
| LegalCopyright | ©2026 BitTorrent Limited. All Rights Reserved |
| OriginalFileName | |
| ProductName | µT® Classic |
| ProductVersion | 3.6 |
| Translation | 0x0000 0x04b0 |
PE Sections
▼| Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
718,860 bytes | 719,360 bytes | 6.38 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
1A67260023DFD031935BB7A42ED8C8B4 |
.itext |
0x000b1000 |
6,348 bytes | 6,656 bytes | 6.04 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
CF1AF4B55684ED040CE1BBD7F61E0612 |
.data |
0x000b3000 |
16,188 bytes | 16,384 bytes | 5.18 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
572B4D77EAD34AC8988AFD3CC57C4CEF |
.bss |
0x000b7000 |
29,516 bytes | 0 bytes | 0.00 (Normal) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x000bf000 |
4,200 bytes | 4,608 bytes | 4.82 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
4A48C59CBAA4D331B6913C45047362EF |
.didata |
0x000c1000 |
420 bytes | 512 bytes | 2.76 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
F4DCDCD030805001DF20B0FDD6C46CB2 |
.edata |
0x000c2000 |
113 bytes | 512 bytes | 1.34 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
962159C3600D79CC1A32BD757EB6AD75 |
.tls |
0x000c3000 |
24 bytes | 0 bytes | 0.00 (Normal) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x000c4000 |
93 bytes | 512 bytes | 1.38 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
4077D1DBE397A22F8D8C62A9AC2F87A2 |
.reloc |
0x000c5000 |
73,708 bytes | 73,728 bytes | 6.70 (Compressed) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
AA09D180BCB91FF38898AB2932FB8C55 |
.rsrc |
0x000d7000 |
54,280 bytes | 54,784 bytes | 6.70 (Compressed) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
97BF9C7E2462B4705982F7747A2298BB |
Entropy Analysis Alert
2 section(s) with elevated entropy (≥6.5) - possible compression
Resource Analysis
▼
Total Resources: 23
(52,958 bytes)
| Resource Type | Count | Total Size | Percentage |
|---|---|---|---|
| RT_ICON | 5 | 39,474 bytes | |
| RT_STRING | 12 | 8,788 bytes | |
| RT_RCDATA | 3 | 1,248 bytes | |
| RT_GROUP_ICON | 1 | 76 bytes | |
| RT_VERSION | 1 | 1,412 bytes | |
| RT_MANIFEST | 1 | 1,960 bytes |
Certificate Chain Analysis
▼Certificate Information
| Product | µT® Classic |
| Description | µT® Classic |
| File Version | 3.6 |
| Signing Date | 07:38 AM 08/23/2026 |
| Verification Status | Signed |
| Signers | RainCo HK Limited; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert |
| Counter Signers | DigiCert SHA256 RSA4096 Timestamp Responder 2025 1; DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1; DigiCert Trusted Root G4; DigiCert |
| Copyright | ©2026 BitTorrent Limited. All Rights Reserved |
Certificate Chain Summary
RainCo HK Limited #1
Primary
Validity Period: 2026-07-07 00:00:00 → 2027-07-06 23:59:59
Signature Algorithm: sha256RSA
Serial Number:
05 AD 03 DA 40 D6 A5 B6 29 A1 25 C4 37 C9 38 82
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 #2
Chain
Validity Period: 2021-04-29 00:00:00 → 2036-04-28 23:59:59
Signature Algorithm: sha384RSA
Serial Number:
08 AD 40 B2 60 D2 9C 4C 9F 5E CD A9 BD 93 AE D9
DigiCert SHA256 RSA4096 Timestamp Responder 2025 1 #3
Chain
Validity Period: 2025-06-04 00:00:00 → 2036-09-03 23:59:59
Signature Algorithm: sha256RSA
Serial Number:
0A 80 EF 18 4B 8D F1 05 82 D1 C4 76 A7 95 74 68
DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 #4
Chain
Validity Period: 2025-05-07 00:00:00 → 2038-01-14 23:59:59
Signature Algorithm: sha256RSA
Serial Number:
0D C7 AC 57 05 FF 21 99 2E 40 43 22 0C 3A 49 86
DigiCert Trusted Root G4 #5
Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number:
0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A✓ This file has been digitally signed and the certificate chain has been verified
- The signature ensures file integrity and authenticity from the publisher
- Timestamping proves when the signature was applied
Certificate Verification Status
OK
Remember: This is Result of Online Virus Scanner
Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:
Download Anti-MalwareKeep Your System Protected
This file appears clean, but regular security maintenance is important
-
1
Weekly Quick Scans: Set a reminder to run a scan every Sunday. Most infections are caught within the first week, so regular checks give you peace of mind.
-
2
Update Everything: Those annoying update popups exist for a reason — they patch security holes. Windows, browsers, Adobe, Java — keep them all current.
-
3
Download Smart: Stick to official websites and app stores. If a "free" version of paid software sounds too good to be true, it probably comes with unwanted extras.
-
4
Think Before You Click: Malware loves email attachments and "urgent" links. Even if an email looks like it's from your bank or a friend, verify suspicious requests through a different channel.
Proactive Protection
20 security engines flagged this file. Could be a real threat, or could be a false alarm — common with keygens, game trainers, and legitimate system utilities. Check if the file has a valid digital signature and whether it came from the official source.
Leave a Comment
Gridinsoft Anti-Malware
Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware
Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!
