The EFT Ultima.exe File Analysis

Updated 1 second ago

Checked by Malware Check

EFT Ultima.exe

Technical Analysis

File Name	EFT Ultima.exe
File Type	Win32 EXE
Magic Bytes	`PE32+ executable (GUI) x86-64, for MS Windows`
SSDEEP Hash	98304:p02MslQgDYN1QssJiHTttPg27gu09V8/V3EMxttEFSWmCLXDFmgWTJ+KRo0f3aZ/:pJlQgkNOJiRtPd1c8lEMx/VWmCLTMg60
Scanner Version	1.0.220.174
Database Version	2025-07-13 00:00:17 UTC

⚠

Suspicious File Detected

Detected by 20 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

29%

Detection Rate

6,053,809

File Size (bytes)

20/70

Engines Detected

2025-07-13

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	f7bb28db411bb8613b29a0fb802e51ed
SHA1	ff608d94479fb7aac893b08c847ad7faabfc42d4
SHA256	85fc95f7c62b8897cc06fbea7b7639577d1a8cdd403397af751598223f336ff2
SHA512	5133189f34b6e8d522cd874dc4863b921137ac9288763ddda1ea0de485dc1b84c796d92d40051c67a2dbafc24493e3a739bdb2cf5d2a465aee0d38b2b4af1367
ImpHash	20076f34bef964871e9a20ea815aa4e5

Security Engines with Detections (20 of 70)

Bkav

W64.AIDetectMalware Malicious

AVG

Win64:Evo-gen [Trj] Malicious

Elastic

malicious (high confidence) Malicious

Skyhigh

BehavesLike.Win64.Trojan.th Malicious

Cylance

Unsafe Malicious

Sangfor

Trojan.Win32.Save.a Malicious

CrowdStrike

win/malicious_confidence_90% (W) Malicious

Symantec

ML.Attribute.HighConfidence Malicious

Paloalto

generic.ml Malicious

Kaspersky

UDS:Trojan.Win32.InjectorNetT.azm Malicious

Avast

Win64:Evo-gen [Trj] Malicious

McAfeeD

ti!85FC95F7C62B Malicious

Ikarus

Trojan.Win64.Agent Malicious

Microsoft

Trojan:Win32/Wacatac.B!ml Malicious

GData

Win32.Application.Coinminer.44EHT3 Malicious

Google

Detected Malicious

TrellixENS

Artemis!F7BB28DB411B Malicious

Fortinet

W32/PossibleThreat Malicious

DeepInstinct

MALICIOUS Malicious

alibabacloud

Trojan Malicious

50 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Image Base	`0x140000000`
Entry Point	`0x14000132b`
Compilation Time	1970-01-01 00:00:00
Checksum	0x005c76c3 (Actual: 0x005c76c3)
OS Version	4.0
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	5 libraries ADVAPI32, KERNEL32, msvcrt, SHELL32, USER32
Exports	0 functions
Resources	1 Resources
Sections	18 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	120,496 bytes	120,832 bytes	6.24 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`353A46A9BF79E0EF7A4331AB6ABC8299`
`.data`	`0x0001f000`	5,496,928 bytes	5,497,344 bytes	6.79 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5F2A7F70CBFF5EB89C250C25ACD3AFB4`
`.rdata`	`0x0055e000`	19,872 bytes	19,968 bytes	4.96 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D3431D24290DC2DB1170D70D7FE3A871`
`.pdata`	`0x00563000`	14,388 bytes	14,848 bytes	5.31 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`DB2CB59C93715B043121CC6D95352531`
`.xdata`	`0x00567000`	11,816 bytes	12,288 bytes	4.01 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4EF270DED23238443FF42EBB7A13A9E3`
`.bss`	`0x0056a000`	3,152 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0056b000`	4,840 bytes	5,120 bytes	4.03 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D3E570E8CEDB7F4A0D2A6462531ED69B`
`.tls`	`0x0056d000`	16 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x0056e000`	776 bytes	1,024 bytes	4.29 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`20E58CAFC7276D8FB416D2F8842BD66A`
`.reloc`	`0x0056f000`	1,096 bytes	1,536 bytes	4.52 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`CF45CCE496EE57D1A9EF49E345BA6757`
`/4`	`0x00570000`	176 bytes	512 bytes	0.60 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`09DD3107161D725B9A922BFE28A3C1AA`
`/19`	`0x00571000`	18,956 bytes	19,456 bytes	5.77 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`B070C3C2ADBA3AE2CE0550D10F088DA0`
`/31`	`0x00576000`	2,118 bytes	2,560 bytes	4.38 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`98FB64F9EC8915CB5A4825473806EF6B`
`/45`	`0x00577000`	2,249 bytes	2,560 bytes	4.52 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`49AC02202032C6CB8088CDFE32A68902`
`/57`	`0x00578000`	984 bytes	1,024 bytes	3.67 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`524C545FE15C0557E634CCC33F0DADC0`
`/70`	`0x00579000`	168 bytes	512 bytes	2.41 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`A11AD7E3390329ABC69674049C407B58`
`/81`	`0x0057a000`	738 bytes	1,024 bytes	4.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`56A99C417E2BE861C632F9976BF651BF`
`/97`	`0x0057b000`	1,541 bytes	2,048 bytes	3.95 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`A2C63FA49DD99FB65D2F6B7E48D810C7`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 1 (681 bytes)

Resource Type	Count	Total Size	Percentage
RT_MANIFEST	1	681 bytes	100%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

20 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1