File Name | Photo.scr |
File Type |
PE32 executable (GUI) Intel 80386, for MS Windows
|
Scanner Version | 1.0.217.174 |
Database Version | 2025-05-30 11:00:21 UTC |
Malware family: Miner
Hash Type | Value | Action |
---|---|---|
MD5 |
5616a3471565d34d779b5b3d0520bb70
|
|
SHA1 |
42df726156bee4a54ea328bd72a659602ab7d03e
|
|
SHA256 |
9194b57673209c8534888f61b0cdefa34f463ae50cd78f72ab2b3348220baaf9
|
|
SHA512 |
21f70509a14eaf5dd63b533df612b64b07ff0e991d3a4ba3c17c9618bc952bccb61e189c04ca234fb374d2c75779aff108fd9bc7c44857e4034887b861058c1e
|
|
ImpHash |
91ae93ed3ff0d6f8a4f22d2edd30a58e
|
Icon |
Hash: d6008637fb1c9c6c260bf666e29afd7b
Fuzzy: 722d400d8042249b5ecbbf8701b85490 dHash: 7c70747474d67274 |
Image Base | 0x00400000 |
Entry Point | 0x004079d3 |
Compilation Time | 2018-09-04 14:43:33 |
Checksum | 0x00000000 (Actual: 0x005fdbdc) |
OS Version | 5.1 |
PEiD Signatures |
PE32 executable (GUI) Intel 80386, for MS Windows
|
Digital Signature | No valid SignedData structure was found. |
Imports |
3 libraries
USER32, KERNEL32, WS2_32 |
Exports | 0 functions |
Resources | 9 Resources |
Sections | 6 Sections |
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
125,748 bytes | 125,952 bytes | 6.65 (Compressed) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
B890E400D99968920E1C17687E7AC67E |
.rdata |
0x00020000 |
45,412 bytes | 45,568 bytes | 6.10 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
DBEC49ED3AFBA72976334E346469B13F |
.data |
0x0002c000 |
59,016 bytes | 2,560 bytes | 1.92 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
0A359BF3E4D26B21BD09E8DEFB96CFDA |
.gfids |
0x0003b000 |
184 bytes | 512 bytes | 1.84 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D3A9D75E2AF6094B152ED4410D6349D6 |
.rsrc |
0x0003c000 |
67,080 bytes | 67,584 bytes | 7.26 (Compressed) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
C52AD6EC56F99AC20E7A0A3ED3046770 |
.reloc |
0x0004d000 |
6,068 bytes | 6,144 bytes | 6.65 (Compressed) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
B724F5EA0591CAA6E37E6C39A6F073B0 |
3 section(s) with elevated entropy (≥6.5) - possible compression
Resource Type | Count | Total Size | Percentage |
---|---|---|---|
RT_ICON | 7 | 66,460 bytes | |
RT_GROUP_ICON | 2 | 124 bytes |
This file is not digitally signed.
⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources
No valid SignedData structure was found.
Recommendation: Verify the file source and ensure it comes from a trusted publisher.
Gridinsoft has the capability to identify and eliminate Worm.Win32.Miner.cld without requiring further user intervention.
Download Anti-MalwareFollow these steps to completely remove the threat from your system