Gridinsoft Logo
File Icon

Sеtup.exe Trojan Heuristic Analysis

Updated 3 months ago
Checked by Malware Check
Sеtup.exe

Technical Analysis

File Name Sеtup.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.226.174
Database Version 2025-10-03 19:00:26 UTC
⚠

Trojan.Heur!.02056023

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
86,667,257
File Size (bytes)
2025-10-03
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
fe8aed7dc09a39f549c2a51be5876188
SHA1
9d910881f918fc6ad72be096e27652ee911bdb50
SHA256
9b1f1d92b4d9a3f021ca403498fc3e283218cca1e623725c9aaa03183325c244
SHA512
0405285badfdd662c5906bf5ee99385d0a835655b74e41c5f0451f75b71754ce5cda79c3fe115965c5cd31528b08d2fdc036009b9432b97e5b00e328ffac5bbb
ImpHash
0f8d40bd8c3b0c1577a8f1a7c2d04cd8

PE Analysis

Basic Information

▼
Icon
Hash: a5fb4f56d6a2cb6b2e9a8de997dd4bb8
Fuzzy: 99ccdd1ad73560692ea7bf6610dab8ee
dHash: 0470c88c9cace4c0
Image Base 0x140000000
Entry Point 0x141da7404
Compilation Time 2025-09-20 14:41:06
Checksum 0x052aa65c (Actual: 0x052aa65b)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path D:\23.8.0\out\Release\node.pdb
Digital Signature No valid SignedData structure was found.
Imports 12 libraries
Exports 8848 functions
Resources 14 Resources
Sections 7 Sections

Version Information

▼
CompanyName Unity Technologies
ProductName Unity Player
FileDescription Unity Runtime Player
FileVersion 2023.3.15f1
ProductVersion 2023.3.15f1
OriginalFilename unityplayer.exe
InternalName unityplayer
LegalCopyright © 2005-2025 Unity Technologies ApS
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 31,463,324 bytes 31,463,424 bytes 6.48 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 3946B08243DBBC4602FE7C7CB9CC0086
.rdata 0x01e03000 52,536,250 bytes 52,536,320 bytes 6.27 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 741077AB39F362CE49C2668EF4404DA3
.data 0x0501e000 3,199,812 bytes 316,928 bytes 3.78 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE FA60362C5521513A9DDE0072198CA84A
.pdata 0x0532c000 1,414,260 bytes 1,414,656 bytes 6.99 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D3DD71864CD60B09ED7ECC4E8F673971
.fptable 0x05486000 256 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BF619EAC0CDF3F68D496EA9344137E8B
.rsrc 0x05487000 88,187 bytes 88,576 bytes 7.17 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 191ED4BB7CA3DF4004CF1457E1A34CC2
.reloc 0x0549d000 160,176 bytes 160,256 bytes 5.49 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 2E070F7C9CAE57B51311BC912C4DA7FB
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 14 (87,349 bytes)
Resource Type Count Total Size Percentage
TEXT 1 796 bytes
0.9%
RT_ICON 10 84,972 bytes
97.3%
RT_GROUP_ICON 1 146 bytes
0.2%
RT_VERSION 1 788 bytes
0.9%
RT_MANIFEST 1 647 bytes
0.7%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.02056023 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.02056023 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware