External 2 4 exe Trojan Heuristic File Malware Analysis: 01bb70ae30bbfd308a9a82c32d99a3df
Gridinsoft Logo
File Icon

External 2.4.exe Trojan Heuristic Analysis

Updated 1 month ago
Checked by Malware Check
External 2.4.exe

Technical Analysis

File Name External 2.4.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.229.174
Database Version 2025-11-30 00:00:28 UTC
⚠

Trojan.Heur!.02254023

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
11,267,072
File Size (bytes)
2025-11-30
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
01bb70ae30bbfd308a9a82c32d99a3df
SHA1
7203d3cc140e8ba0aab57698d52f9d6eb87db39a
SHA256
8e5016e1357f6b5ed0ac0626b2cf4579ae63958fdef870c6657d7dda19dac075
SHA512
561d97a5179836bd744fe867f6fbc61994308a71e45e233f9c924a4810728b1dc4a1631fdb04c8a2a1d4ef5432017611034978523742e2b6904aa3106c911c83
ImpHash
a721083f763010c742f20c280515e703

PE Analysis

Basic Information

▼
Icon
Hash: 915a2c0435897a951c0bc37e76fad438
Fuzzy: 5d606a61f8a4b826c5c91b86bc9b93fb
dHash: f8f0a8b8b0e8f8f0
Image Base 0x140000000
Entry Point 0x1408576be
Compilation Time 2000-01-07 17:21:59
Checksum 0x00acb2ee (Actual: 0x00acb2ee)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 12 libraries
Exports 1 functions
Resources 30 Resources
Sections 10 Sections

Version Information

▼
FileDescription Advanced Graphics Processing Framework
ProductName Creation Engine Runtime
InternalName unityengine
CompanyName Anvil Engine Technologies
ProductVersion 10.29.4876.6203
LegalTrademarks Creation Engine Labs trademark.
LegalCopyright © 2018 Anvil Engine Technologies. All rights reserved.
FileVersion 10.29.4876.6203
OriginalFilename xrayengine.exe
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 1,821,044 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.rdata 0x001be000 315,406 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.data 0x0020c000 1,204,316 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.pdata 0x00333000 85,644 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.fptable 0x00348000 256 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x00349000 4,785,194 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
0x007da000 68,825 bytes 69,120 bytes 4.90 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 64EC822185411A075EF937FC908DEDBB
0x007eb000 11,009,564 bytes 11,010,048 bytes 7.82 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ A942AE97BFB0442CAA75555C4E6A013D
.reloc 0x0126b000 292 bytes 512 bytes 2.83 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ FF63999B05C7F6127EB9043E24814A69
.rsrc 0x0126c000 187,272 bytes 186,368 bytes 5.27 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 34B7E96D33653F5A1014F4E98CCF9EDA
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 30 (185,618 bytes)
Resource Type Count Total Size Percentage
RT_ICON 9 182,877 bytes
98.5%
RT_STRING 13 1,028 bytes
0.6%
RT_ACCELERATOR 5 184 bytes
0.1%
RT_GROUP_ICON 1 132 bytes
0.1%
RT_VERSION 1 1,016 bytes
0.5%
RT_MANIFEST 1 381 bytes
0.2%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.02254023 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.02254023 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware