Gridinsoft Logo
File Icon

NFL1.exe Trojan Sabsik Analysis

Updated 3 days ago
Checked by Malaware Check
NFL1.exe

Technical Analysis

File Name NFL1.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.217.174
Database Version 2025-06-01 20:00:19 UTC
⚠

Ransom.Win64.Sabsik.sa

Malware family: Sabsik

Sabsik is a malware variant capable of downloading additional payloads, including ransomware components. It can encrypt user files and initiate ransom demands. This threat represents a multi-stage attack where initial infection leads to more severe system compromise.
N/A
Detection Rate
3,510,784
File Size (bytes)
2025-06-01
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
abb0f51eb90a5371a08e322a2366f43b
SHA1
692712fec4be6c684680e2a6abd395eed0a03943
SHA256
84f6a1e5720f164b0f21686cd611eeaa418ca4162204a1609b4f617a0b9836fe
SHA512
26d87379974f8fc6457282ea43710f7e1f1d3d6f0466696de9b889a757637440c46e5084ad738e7e4c7f05f3806a5ecdf229a646b9d87401a1d6751214b857bd
ImpHash
055e3f3e659a81f413c7fd133a3e7587

PE Analysis

Basic Information

▼
Icon
Hash: 02278fdf83e7718ee6c2169411ac88f1
Fuzzy: 85078b52934aecd66e760d390e12c0fe
dHash: 2c8f272565313332
Image Base 0x140000000
Entry Point 0x140ef2fc4
Compilation Time 2073-04-09 04:49:05
Checksum 0x00030869 (Actual: 0x00367ffd)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 9 libraries
kernel32, user32, advapi32, oleaut32, gdi32, shell32, version, ole32, SHLWAPI
Exports 0 functions
Resources 13 Resources
Sections 10 Sections

Version Information

▼
CompanyName Epic Games, Inc.
LegalCopyright Fill out your copyright notice in the Description page of Project Settings.
ProductName BootstrapPackagedGame
ProductVersion UE5-CL-0
FileDescription BootstrapPackagedGame
InternalName UnrealEngine
OriginalFilename BootstrapPackagedGame-Win64-Shipping.exe
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 86,016 bytes 45,056 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 75EEDC29DDD7583B5831ECCDD69E1FC4
0x00016000 49,152 bytes 19,456 bytes 7.97 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE CCBDC61F0053FBF0D8962B2636F6E5C9
0x00022000 8,192 bytes 512 bytes 6.96 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E53065BFB52702A5DE18981907B0236C
0x00024000 8,192 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x00026000 4,096 bytes 512 bytes 4.72 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5CAA09921CBD08B6A5AF688FCD0EE07F
0x00027000 299,008 bytes 512 bytes 2.41 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 978C2EAF486DCAC88AA8171EEC9F4E08
0x00070000 4,096 bytes 1,536 bytes 7.14 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 100F7DAAC0D4270388DFBA7696C3AB71
.rsrc 0x00071000 299,008 bytes 295,424 bytes 5.07 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5ABD926C21484D95A0EC17780F9CC478
0x000ba000 12,054,528 bytes 278,528 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 55FA6276FC172B0413B88A47B9C3D0C1
0x00c39000 2,871,296 bytes 2,868,224 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A468D4EFAC409DF06D4C06E66C807112
Entropy Analysis Alert

4 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 13 (294,607 bytes)
Resource Type Count Total Size Percentage
RT_ICON 7 292,101 bytes
99.1%
RT_RCDATA 2 98 bytes
0%
RT_GROUP_ICON 2 124 bytes
0%
RT_VERSION 1 876 bytes
0.3%
RT_MANIFEST 1 1,408 bytes
0.5%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Ransom.Win64.Sabsik.sa Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win64.Sabsik.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware