Gridinsoft Logo
File Icon

CupFixer.exe Trojan Sabsik Analysis

Updated 1 month ago
Checked by Malaware Check
CupFixer.exe

Technical Analysis

File Name CupFixer.exe
File Type
PE32+ executable (console) x86-64, for MS Windows
Scanner Version 1.0.212.174
Database Version 2025-04-08 05:01:03 UTC
⚠

Ransom.Win64.Sabsik.sa

Malware family: Sabsik

Sabsik is a malware variant capable of downloading additional payloads, including ransomware components. It can encrypt user files and initiate ransom demands. This threat represents a multi-stage attack where initial infection leads to more severe system compromise.
N/A
Detection Rate
9,089,536
File Size (bytes)
2025-04-08
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
1f2ef76d1e445de858ded5a0b2834630
SHA1
03d0bdfbfc8069fc057e5c70a2a9d0e8a37c5576
SHA256
84be47f95a3422f33b93fa9549b916885ff113258f21c13aa2ffbab7aea5cfd4
SHA512
ffc92eadbb7469c86c6087bdb41a5767bd138ad76123b03acecf19e2a95cc4456e4ef39719dd2df45b365e1eac1c252b7a8254fb2db691674a26c68a57b58eda
ImpHash
072aee2c576b75532c896fe3505ff741

PE Analysis

Basic Information

▼
Icon
Hash: 66fe123b0daeb469fac1208ce66977d5
Fuzzy: 234d1706426dcd1d609ff33a797f004f
dHash: 30f18ee4e8d4e830
Image Base 0x140000000
Entry Point 0x142dd8f24
Compilation Time 2023-03-21 12:53:37
Checksum 0x00000000 (Actual: 0x008b76e2)
OS Version 6.0
PEiD Signatures PE32+ executable (console) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 28 libraries
Exports 0 functions
Resources 3 Resources
Sections 9 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 577,536 bytes 238,592 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 10AEBF4ED7EA7AE18E11C694B582ED74
0x0008e000 118,784 bytes 39,424 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 220AE22C6847AAF4C379F7CBD77894A7
0x000ab000 8,192 bytes 512 bytes 7.00 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2684AE78AE6ACB2F9E4D5CACF66CB9A4
0x000ad000 20,480 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x000b2000 81,920 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x000c6000 4,096 bytes 1,536 bytes 6.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 83ED7112FAD6447DD3F2D2991F5BDC76
.rsrc 0x000c7000 81,920 bytes 78,848 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ A171AD0940C5AD3F124A8E68BD31BC1B
0x000db000 38,760,448 bytes 295,936 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F3111BBA0315CC2CB292CA667C18A7B4
0x025d2000 8,433,664 bytes 8,433,664 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 66FF6F88BCD62D032EEF3F99AD827AA0
Entropy Analysis Alert

5 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 3 (78,241 bytes)
Resource Type Count Total Size Percentage
RT_ICON 1 77,829 bytes
99.5%
RT_GROUP_ICON 1 20 bytes
0%
RT_MANIFEST 1 392 bytes
0.5%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Ransom.Win64.Sabsik.sa Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win64.Sabsik.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware