Gridinsoft Logo
File Icon

LDPlayer9_ru_39287323_ld.exe PUP ChinAd Analysis

Updated 1 year ago
Checked by Malware Check
LDPlayer9_ru_39287323_ld.exe

Technical Analysis

File Name LDPlayer9_ru_39287323_ld.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.180.174
Database Version 2024-06-26 19:00:18 UTC
⚠

PUP.Win32.ChinAd.mz!c

Malware family: ChinAd

N/A
Detection Rate
6,550,640
File Size (bytes)
2024-06-26
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
e0e91d2d5ecc36bde3a3ba87342c4442
SHA1
47dbd2d9ad2ac3c830339bada9f5daa1c7c993a2
SHA256
86e78c5424bca2e9f9b84c50e251118573dc22bcee6ff908362b6b0e37205bdc
SHA512
b1e2e7fb492158f5fa2ece54bd5a805a5dd97b1eca8d0da3d1ec2bfe8c55220acacf4627384e62745d440b263e1b416177094e33729b1bba97d414ebb575eb86
ImpHash
43a01e9edfe7a53d6e88d675117126c6

PE Analysis

Basic Information

▼
Icon
Hash: 8462a99ffa1b282cc7c67cd11645172f
Fuzzy: d741995a72279a7f7cf2833cdc40d038
dHash: f08c96232b9b8bf4
Image Base 0x00400000
Entry Point 0x004de5d9
Compilation Time 2023-05-29 03:57:01
Checksum 0x0064ea0d (Actual: 0x006446fc)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
PDB Path H:\trunk_en_4.0(多捆绑)\downloader2\bin\ldplayerinst.pdb
Digital Signature OK
Imports 18 libraries
Exports 0 functions
Resources 36 Resources
Sections 5 Sections

Version Information

▼
CompanyName XUANZHI CO., LIMITED
FileDescription LDPlayer
FileVersion 1.0.0
InternalName ldinst.exe
LegalCopyright Copyright (C) 2016
OriginalFilename ldinst.exe
ProductName LDPlayer
ProductVersion 1.0.0
Translation 0x0404 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 1,156,428 bytes 1,156,608 bytes 6.56 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 1CF78147176B3C864F7714E41DD2BDD0
.rdata 0x0011c000 286,942 bytes 287,232 bytes 5.20 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E56ABBB0E3AB62E7D97FE37114089D2A
.data 0x00163000 63,368 bytes 24,576 bytes 4.86 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 9C2304CC6CDC4C39FADB15FFD7371CAF
.rsrc 0x00173000 4,996,800 bytes 4,997,120 bytes 7.81 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 362F9DB0E9C3688E068080A3907C3E6C
.reloc 0x00637000 62,800 bytes 62,976 bytes 6.63 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 797F02934A09E296FFB25A6C118568F9
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 36 (4,994,800 bytes)
Resource Type Count Total Size Percentage
TXT 3 51,142 bytes
1%
ZIPRES 1 4,348,371 bytes
87.1%
RT_ICON 26 593,472 bytes
11.9%
RT_STRING 1 76 bytes
0%
RT_ACCELERATOR 1 16 bytes
0%
RT_GROUP_ICON 2 376 bytes
0%
RT_VERSION 1 696 bytes
0%
RT_MANIFEST 1 651 bytes
0%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

OK

PUP.Win32.ChinAd.mz!c Removal

Gridinsoft has the capability to identify and eliminate PUP.Win32.ChinAd.mz!c without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware