The YandexPackLoader exe (Setup Downloader) File Malware Analysis
Gridinsoft Logo
File Icon

The YandexPackLoader.exe (Setup Downloader) File Analysis

Updated 10 months ago
Checked by Malware Check
YandexPackLoader.exe

Technical Analysis

File Name YandexPackLoader.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows
SSDEEP Hash
3072:E6GEtNEXN4wCq5/v46QC2mCm/lY9Kkj3c6QQaWAk0Ag5qAWKGETBKnF58it3kzMx:hGYk4wCq5x+9T3bQQaNlTwNt3kz
Scanner Version 1.0.193.174
Database Version 2024-10-17 17:00:20 UTC
⚠

Suspicious File Detected

Detected by 15 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
21%
Detection Rate
231,072
File Size (bytes)
15/72
Engines Detected
2024-10-17
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
913324e0966832fe5aaa17bee324f967
SHA1
251196524bc2c7a99ef13b09f389f15b1bdf9493
SHA256
8b6cb7ecc13714d920d7c91846b6c395f1d872f8670b208dd2ac3e7de723f642
SHA512
a7454d2fdf6600a4c4080dea5ae1920cfeb7b55d005032dc0cd2d6b24ab279a3e7a6a5c8732f670dd51c011b03d7a638f4eced6445f4cd08340d059e56f67253
ImpHash
9d4745b4b8ed18dda7e4fbf0015900e0

Security Engines with Detections (15 of 72)

Bkav
W32.AIDetectMalware Malicious
Elastic
malicious (moderate confidence) Malicious
CrowdStrike
win/grayware_confidence_100% (D) Malicious
ESET-NOD32
a variant of Win32/Yandex.K potentially unwanted Malicious
Paloalto
generic.ml Malicious
Ikarus
PUA.Yandex Malicious
Webroot
W32.Adware.Gen Malicious
Varist
W32/Yandex.H.gen!Eldorado Malicious
Antiy-AVL
GrayWare/Win32.Yandex Malicious
Gridinsoft
PUP.Win32.Downloader.oa!s1 Malicious
Google
Detected Malicious
VBA32
Riskware.PackagingUntrustworthyYandex Malicious
Malwarebytes
PUP.Optional.Downloader Malicious
Fortinet
Riskware/PackagingUntrustworthyYandex Malicious
DeepInstinct
MALICIOUS Malicious
57 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 392ef86c821c190403abcba071d4d503
Fuzzy: 7084d568ef659e35f736e2ccc91a8711
dHash: 4d6d6545e1e14565
Image Base 0x00400000
Entry Point 0x004074a6
Compilation Time 2023-05-19 13:34:48
Checksum 0x000454d1 (Actual: 0x000412ad)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
PDB Path C:\BuildAgent\work\4a73c29f3c4e6ac\downloader\Release\downloader.pdb
Digital Signature OK
Imports 12 libraries
Exports 0 functions
Resources 8 Resources
Sections 6 Sections

Version Information

▼
FileDescription Setup Downloader
FileVersion 0.1.0.33
InternalName download
LegalCopyright Copyright (C) 2015 Yandex LLC
OriginalFilename downloader.exe
ProductName Setup Downloader
ProductVersion 0.1.0.33
Translation 0x0419 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 143,196 bytes 143,360 bytes 6.64 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ B2F302DCDD2E298382279E8BA4E379A1
.rdata 0x00024000 37,256 bytes 37,376 bytes 4.98 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 037CDCA27407B5EDD2DA31AA892A6521
.data 0x0002e000 13,820 bytes 3,072 bytes 2.61 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B72A9D7AD331416726B4EB8310C842B5
.gfids 0x00032000 308 bytes 512 bytes 2.40 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C9416F2EC5469E88CA913957752DB93C
.rsrc 0x00033000 26,592 bytes 26,624 bytes 4.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 73E6F8B38237E248E97BA69E7DC19FBB
.reloc 0x0003a000 6,232 bytes 6,656 bytes 6.42 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ DC6A543A9687C2F2D25595A1F85F0CA0
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 8 (26,082 bytes)
Resource Type Count Total Size Percentage
RT_ICON 5 24,082 bytes
92.3%
RT_GROUP_ICON 1 76 bytes
0.3%
RT_VERSION 1 692 bytes
2.7%
RT_MANIFEST 1 1,232 bytes
4.7%

Certificate Chain Analysis

▼
Certificate Information
Product Setup Downloader
Description Setup Downloader
File Version 0.1.0.33
Original Name downloader.exe
Internal Name download
Copyright Copyright (C) 2015 Yandex LLC
Certificate Chain Summary
YANDEX LLC #1 Primary
Validity Period: 2022-05-06 08:44:54 → 2024-05-06 08:44:54
Signature Algorithm: sha256RSA
Serial Number: 79 04 D3 2E 74 FC 47 2B 66 C0 8A 38
GlobalSign GCC R45 EV CodeSigning CA 2020 #2 Chain
Validity Period: 2020-07-28 00:00:00 → 2030-07-28 00:00:00
Signature Algorithm: sha256RSA
Serial Number: 77 BD 0E 05 B7 59 0B B6 1D 47 61 53 1E 3F 75 ED
DigiCert Trusted Root G4 #3 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #4 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Timestamp 2022 - 2 #5 Chain
Validity Period: 2022-09-21 00:00:00 → 2033-11-21 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0C 4D 69 72 4B 94 FA 3C 2A 4A 3D 29 07 80 3D 5A

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
15 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware