Gridinsoft Logo
File Icon

[FreeTP.Org]The-Quarry-Multiplayer-Fix-Online.exe Adware AI Analysis

Updated 1 year ago
Checked by Malaware Check
[FreeTP.Org]The-Quarry-Multiplayer-Fix-Online.exe

Technical Analysis

File Name [FreeTP.Org]The-Quarry-Multiplayer-Fix-Online.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, InstallShield self-extracting archive
Scanner Version 1.0.177.174
Database Version 2024-05-24 14:00:21 UTC
⚠

Adware.Win32.AI.cl

Malware family: AI

AI-based detection enhances traditional signature-based antivirus methods by identifying behavioral patterns and anomalies. This approach improves detection of new and polymorphic malware variants that may evade conventional security measures.
N/A
Detection Rate
1,040,865
File Size (bytes)
2024-05-24
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
23e62342dd126faae35a1ed20a8e3fb8
SHA1
008bc591382dd6bf44ccf31d24ea4f46743b027d
SHA256
984a759928f33cc8e854372637ca4bddd83195d6971986c6c8fdf3966a7e6031
SHA512
8a446aa8b19af7749107596b04aeb563d8deaa6090abe57b61695a31f8ba3eb3f94d18aa61ac4c1419e42c79bab84e62aaaaac3037b3461f2030b2a92a8076e8
ImpHash
8c3778afa13b3d377c866f9d4e868b85

PE Analysis

Basic Information

▼
Icon
Hash: efd91d4d402e6c1263ebeae6d92a8497
Fuzzy: b1b95401fa8317fecabce5152314b810
dHash: f0f0ea29a9f2ec70
Image Base 0x00400000
Entry Point 0x00430130
Compilation Time 2012-10-02 05:04:04
Checksum 0xf14c5341 (Actual: 0x00108e2f)
OS Version 5.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, InstallShield self-extracting archive
Digital Signature The PE file does not contain a certificate table.
Imports 5 libraries
advapi32, comctl32, KERNEL32, oleaut32, user32
Exports 0 functions
Resources 16 Resources
Sections 3 Sections

Version Information

▼
Comments This installation was built with Inno Setup.
CompanyName FreeTP.Org - The Quarry Multiplayer Fix
FileDescription The Quarry
FileVersion
LegalCopyright
ProductName The Quarry
ProductVersion 1-1
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
UPX0 0x00001000 147,456 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
UPX1 0x00025000 49,152 bytes 48,640 bytes 7.97 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 223EA7E9151743A5C9839915195DA376
.rsrc 0x00031000 20,480 bytes 19,968 bytes 5.73 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BCD1A24E7383A671BFC9AE102EA6AAA9
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 16 (55,394 bytes)
Resource Type Count Total Size Percentage
RT_ICON 3 15,352 bytes
27.7%
RT_STRING 6 3,200 bytes
5.8%
RT_RCDATA 4 34,004 bytes
61.4%
RT_GROUP_ICON 1 48 bytes
0.1%
RT_VERSION 1 1,208 bytes
2.2%
RT_MANIFEST 1 1,582 bytes
2.9%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Adware.Win32.AI.cl Removal

Gridinsoft has the capability to identify and eliminate Adware.Win32.AI.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware