Gridinsoft Logo
File Icon

易木清单小助手.vmp.exe Trojan Heuristic Analysis

Updated 3 months ago
Checked by Malware Check
易木清单小助手.vmp.exe

Technical Analysis

File Name 易木清单小助手.vmp.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.226.174
Database Version 2025-10-05 19:00:29 UTC
⚠

Trojan.Heur!.02252421

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
10,584,064
File Size (bytes)
2025-10-05
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
3d5625e3b8117d0b979b7f389379d243
SHA1
956c3a9c28304ce60bbf781601e9c0f2671a9562
SHA256
9a86bc9e7a4741092bd17591377dc1b81d4bfee8ce30c2eba39728e97d25d130
SHA512
edd8729aa67d37aca81a859fad672a9d5516450b687297ff4dfd9750b665ef8ffc15a1d2e38b9f856c696482dd591cd9f5c16d9488bdf6b47d4806494edca721
ImpHash
fb837980536f004e004a1240f57734d2

PE Analysis

Basic Information

▼
Icon
Hash: fb4f0cd1b3a4e7524e559c895ad338b9
Fuzzy: 1db8c319597f0dd81b2a90b75a1e4bd9
dHash: 2b23292929292900
Image Base 0x00400000
Entry Point 0x00d670c8
Compilation Time 2025-10-05 16:41:58
Checksum 0x00000000 (Actual: 0x00a235c8)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 15 libraries
Exports 12 functions
Resources 63 Resources
Sections 7 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 1,878,297 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.rdata 0x001cc000 1,043,457 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.data 0x002cb000 3,197,942 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.vmps0 0x005d8000 2,432,198 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D41D8CD98F00B204E9800998ECF8427E
.vmps1 0x0082a000 2,984 bytes 4,096 bytes 4.51 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 330776E0C8C06A6B3CE9D29729F22A73
.vmps2 0x0082b000 10,499,248 bytes 10,502,144 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ CDB5827677D57B06725A53E2AA371E62
.rsrc 0x0122f000 3,077,522 bytes 73,728 bytes 2.74 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3D904B9577332EEA876B80036A375BFA
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 63 (3,073,883 bytes)
Resource Type Count Total Size Percentage
DLL 1 2,986,414 bytes
97.2%
TEXTINCLUDE 3 370 bytes
0%
RT_CURSOR 4 1,104 bytes
0%
RT_BITMAP 17 7,276 bytes
0.2%
RT_ICON 3 68,664 bytes
2.2%
RT_MENU 2 656 bytes
0%
RT_DIALOG 14 6,188 bytes
0.2%
RT_STRING 12 2,380 bytes
0.1%
RT_GROUP_CURSOR 3 74 bytes
0%
RT_GROUP_ICON 3 60 bytes
0%
RT_MANIFEST 1 697 bytes
0%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.02252421 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.02252421 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware