The 迅雷v11.1.12.1692.exe File Analysis

Updated 26 days ago

Checked by Malaware Check

迅雷v11.1.12.1692.exe

Technical Analysis

File Name	迅雷v11.1.12.1692.exe
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	1572864:jbHpBUpbLbiSUq8Ne5R3Dyg00j6pHXtUFgUp4jn9CAERTX:HHpmpGUR3kdpHXtUF+9CAyz
Scanner Version	1.0.216.174
Database Version	2025-05-11 19:00:19 UTC

⚠

Suspicious File Detected

Detected by 9 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

14%

Detection Rate

69,176,840

File Size (bytes)

9/66

Engines Detected

2025-05-11

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	2e0c3cba0ea892f1e46728b5a4506ea5
SHA1	f6e691bca8cf8c75a0eb78a6aaef7acbf1413665
SHA256	8ba3be1cd5254bf9001966725a0a41b1b56b3d2ec89a6b9b2e9a682ccb90f8e5
SHA512	11a44aae5f753e53418590421cd206ad1cd484173c7667a2be332d8cf66f4759b8dae725ac56bac9990bdd70ef0e94d0bbe3e222451f66ffb80f7cad9c45ca20
ImpHash	fcf1390e9ce472c7270447fc5c61a0c1

Security Engines with Detections (9 of 66)

Bkav

W32.AIDetectMalware Malicious

NANO-Antivirus

Trojan.Win32.Agentc.jyxigf Malicious

McAfeeD

ti!8BA3BE1CD525 Malicious

Ikarus

Gen.Crifi Malicious

Antiy-AVL

Trojan[Backdoor]/Win32.LightStone Malicious

Google

Detected Malicious

Cylance

Unsafe Malicious

Fortinet

W32/PossibleThreat Malicious

DeepInstinct

MALICIOUS Malicious

57 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: 018f4c2dd3e0a838bc58d5c9adc566f7 Fuzzy: 2ab290a0843f68ad76a3d8fa586002f0 dHash: d4ece0f2bcbac8f0
Image Base	`0x00400000`
Entry Point	`0x0041e239`
Compilation Time	2019-12-05 07:37:23
Checksum	0x04207faf (Actual: 0x042076c2)
OS Version	5.1
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb`
Digital Signature	No valid SignedData structure was found.
Imports	2 libraries KERNEL32, gdiplus
Exports	0 functions
Resources	28 Resources
Sections	6 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	198,159 bytes	198,656 bytes	6.69 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`5C34491FEE255555D49145E7743274FB`
`.rdata`	`0x00032000`	41,986 bytes	42,496 bytes	5.20 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`46BA011F50AD8D65A6B8D983B050AC7F`
`.data`	`0x0003d000`	145,584 bytes	4,608 bytes	3.84 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`CE7EE73DF4E6A3A0F245A2D8FA63B9DF`
`.gfids`	`0x00061000`	232 bytes	512 bytes	2.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`79C1564768C1621D256D8D36E32E89FA`
`.rsrc`	`0x00062000`	443,284 bytes	443,392 bytes	7.20 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`ADD1F8FB73DE51B90212850D2D6C11F1`
`.reloc`	`0x000cf000`	8,492 bytes	8,704 bytes	6.62 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`3E4166C697FACADAC24F07E8B3E0774B`

Entropy Analysis Alert

3 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 28 (441,606 bytes)

Resource Type	Count	Total Size	Percentage
PNG	1	258,132 bytes	58.5%
RT_ICON	9	177,904 bytes	40.3%
RT_DIALOG	6	1,880 bytes	0.4%
RT_STRING	10	1,958 bytes	0.4%
RT_GROUP_ICON	1	132 bytes	0%
RT_MANIFEST	1	1,600 bytes	0.4%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

9 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1