The goodbyedpi exe File Malware Analysis

Technical Analysis

File Name	goodbyedpi.exe
File Type	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
Scanner Version	1.0.216.174
Database Version	2025-05-07 16:00:18 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	f99693d6f7de3e32b4884bda0335d18e
SHA1	d424f4644f5996c30f508a3b3f10ef8cf6bdbedd
SHA256	88099bc85a0f09aa1ab72eb586494b85e7708fbbbea15c1626240013097063f5
SHA512	0a9f8775b695986fa56ce073ac7c2d975601afc79c92fe67a6e89133b1a997f89bf9210fe5eb8ba6567dc2cacc96fea7a6f1350fe9333e9c2609916edb9c2fda
ImpHash	158df5f94865a639f7650d946c2d6fe8

PE Analysis

Basic Information

▼

Icon	Hash: ddb173f9c9aae9dab90fd170964a64d5 Fuzzy: c15b456ac283a583bcf7026e2f2410d8 dHash: 70ec9e33b396c8f1
Image Base	`0x00400000`
Entry Point	`0x004014c0`
Compilation Time	2024-10-06 02:41:34
Checksum	0x00026971 (Actual: 0x00026971)
OS Version	4.0
PEiD Signatures	`PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	5 libraries WinDivert, ADVAPI32, KERNEL32, msvcrt, WS2_32
Exports	0 functions
Resources	5 Resources
Sections	11 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	58,024 bytes	58,368 bytes	6.22 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`CA721348C4D18F457EB4C0E226417BD1`
`.data`	`0x00010000`	528 bytes	1,024 bytes	1.51 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8BBC4581113EA1BD43406B7A33C135E2`
`.rdata`	`0x00011000`	18,180 bytes	18,432 bytes	5.50 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F60F4B2B2D0ACCCCC6E21506803B899C`
`.eh_fram`	`0x00016000`	3,640 bytes	4,096 bytes	4.68 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`997ADE430560D9CC6CEE4C85ADDE60B3`
`.bss`	`0x00017000`	2,992 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.edata`	`0x00018000`	55 bytes	512 bytes	0.55 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`ADFF1EE935E1D1D20AE36423EEF57532`
`.idata`	`0x00019000`	2,892 bytes	3,072 bytes	5.06 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3BE3CC0C08FE6A6A56B56381E17AD6C2`
`.CRT`	`0x0001a000`	52 bytes	512 bytes	0.26 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`EE2EFDEC5549633F5AC540213A42B8F8`
`.tls`	`0x0001b000`	8 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x0001c000`	12,640 bytes	12,800 bytes	7.86 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3D2B808C31DB86FA6BE7D7AB743E490D`
`.reloc`	`0x00020000`	2,416 bytes	2,560 bytes	6.43 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`26376AA7B09323BFE8B69FB714A96ED8`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 5 (12,294 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	3	11,690 bytes	95.1%
RT_GROUP_ICON	1	48 bytes	0.4%
RT_MANIFEST	1	556 bytes	4.5%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The goodbyedpi.exe File Analysis