Gridinsoft Logo
File Icon

The UEditorSnapscreen.exe File Analysis

Updated 2 months ago
Checked by Malaware Check
UEditorSnapscreen.exe

Technical Analysis

File Name UEditorSnapscreen.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
SSDEEP Hash
12288:QpLVD3wRO1Gl6Wqc8+IFfYt7RwTknRYhzohv8W8l6C:QpLSDnqcPIFfYtVwTWxk9lx
Scanner Version 1.0.210.174
Database Version 2025-03-12 03:00:48 UTC
⚠

Suspicious File Detected

Detected by 56 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

Sality virus incorporates rootkit and backdoor functionality with peer-to-peer communication capabilities. It enables botnet control of infected systems and primarily targets executable files using polymorphism and Entry Point Obscuration techniques.
77%
Detection Rate
589,568
File Size (bytes)
56/73
Engines Detected
2025-03-12
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
9101c0dcb51acf121b556debb967bddc
SHA1
2df3af348e154e7dceeb1ea83bc2c38bb6f6e969
SHA256
9cb7e750f43e975e4842922fae6add16a9b132b55b298c689dd5c9711bb7b42f
SHA512
46e48d36f4168706d75623e46f0950f07d603e124b202ea0ab4b7f6ee915118eba292c3d20faf965eed06d89d286c79240c173592c1d185273ac1d621ca0cc53
ImpHash
7fa974366048f9c551ef45714595665e

Security Engines with Detections (56 of 73)

Bkav
W32.Sality.PE Malicious
Elastic
malicious (high confidence) Malicious
Cynet
Malicious (score: 99) Malicious
CTX
exe.unknown.sality Malicious
CAT-QuickHeal
W32.Sality.U Malicious
Skyhigh
BehavesLike.Win32.Sality.hc Malicious
Cylance
Unsafe Malicious
Zillya
Virus.Sality.Win32.25 Malicious
K7AntiVirus
Virus ( f10001071 ) Malicious
K7GW
Virus ( f10001071 ) Malicious
CrowdStrike
win/malicious_confidence_90% (D) Malicious
huorong
Virus/Sality.c Malicious
Baidu
Win32.Virus.Sality.gen Malicious
VirIT
Win32.Sality.BH Malicious
Symantec
W32.Sality.AE Malicious
ESET-NOD32
Win32/Sality.NBA Malicious
APEX
Malicious Malicious
Kaspersky
Virus.Win32.Sality.sil Malicious
BitDefender
Win32.Sality.3 Malicious
NANO-Antivirus
Virus.Win32.Sality.beygb Malicious
MicroWorld-eScan
Win32.Sality.3 Malicious
Avast
Win32:SaliCode [Inf] Malicious
Tencent
Virus.Win32.TuTu.Gen.200004 Malicious
Emsisoft
Win32.Sality.3 (B) Malicious
F-Secure
Malware.W32/Sality.AT Malicious
DrWeb
Win32.Sector.30 Malicious
VIPRE
Win32.Sality.3 Malicious
TrendMicro
PE_SALITY.RL Malicious
Sophos
Mal/Sality-D Malicious
Ikarus
Virus.Win32.Sality Malicious
FireEye
Generic.mg.9101c0dcb51acf12 Malicious
Jiangmin
Win32/HLLP.Kuku.poly2 Malicious
Google
Detected Malicious
Avira
W32/Sality.AT Malicious
Fortinet
W32/Sality.AT!tr Malicious
Antiy-AVL
Virus/Win32.Sality.gen Malicious
Xcitium
Virus.Win32.Sality.gen@1egj5j Malicious
Arcabit
Win32.Sality.3 Malicious
ViRobot
Win32.Sality.Gen.A Malicious
ZoneAlarm
Mal/Sality-D Malicious
Microsoft
Virus:Win32/Sality.AT Malicious
Varist
W32/Sality.gen2 Malicious
AhnLab-V3
Win32/Kashu.E Malicious
McAfee
W32/Sality.gen.z Malicious
TACHYON
Virus/W32.Sality.D Malicious
VBA32
Virus.Win32.Sality.bakc Malicious
Panda
W32/Sality.AA Malicious
TrendMicro-HouseCall
PE_SALITY.RL Malicious
Rising
Virus.Sality!1.A5BD (CLASSIC) Malicious
Yandex
Win32.Sality.BL Malicious
SentinelOne
Static AI - Suspicious PE Malicious
MaxSecure
Virus.Sality.BH Malicious
GData
Win32.Virus.Sality.A Malicious
AVG
Win32:SaliCode [Inf] Malicious
DeepInstinct
MALICIOUS Malicious
alibabacloud
Virus:Win/Sality.NBA(dyn) Malicious
17 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 73ba0e7da4527d20015c032909f13073
Fuzzy: d9e53505a6a9840c8d5de5864cc37401
dHash: e8caeee2ece6f6ae
Image Base 0x00400000
Entry Point 0x004030cb
Compilation Time 2009-12-05 22:50:41
Checksum 0x00000000 (Actual: 0x0009247b)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Digital Signature No valid SignedData structure was found.
Imports 8 libraries
KERNEL32, USER32, GDI32, SHELL32, ADVAPI32, COMCTL32, ole32, VERSION
Exports 0 functions
Resources 10 Resources
Sections 5 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 22,738 bytes 23,040 bytes 6.45 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE FD120289CDE0F044EADDD8ECD3E5C3A6
.rdata 0x00007000 4,496 bytes 4,608 bytes 5.18 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A2C7710FA66FCBB43C7EF0AB9EEA5E9A
.data 0x00009000 110,456 bytes 1,024 bytes 4.62 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E59CDCB732E4BFBC84CC61DD68354F78
.ndata 0x00024000 36,864 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rsrc 0x0002d000 155,648 bytes 155,136 bytes 6.35 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A7E6E8152E4E9E1A7C5CA24B64700FC6

Resource Analysis

▼
Total Resources: 10 (84,459 bytes)
Resource Type Count Total Size Percentage
RT_ICON 4 82,656 bytes
97.9%
RT_DIALOG 4 1,208 bytes
1.4%
RT_GROUP_ICON 1 62 bytes
0.1%
RT_MANIFEST 1 533 bytes
0.6%

Certificate Chain Analysis

▼
Certificate Information
Certificate Chain Summary
GlobalSign CodeSigning CA - G2 #1 Primary
Validity Period: 2011-04-13 10:00:00 → 2019-04-13 10:00:00
Signature Algorithm: sha1RSA
Serial Number: 04 00 00 00 00 01 2F 4E E1 35 5C
Baidu (China) Co., Ltd. #2 Chain
Validity Period: 2012-02-22 09:18:27 → 2015-02-22 09:18:27
Signature Algorithm: sha1RSA
Serial Number: 11 21 DF 76 75 AA A0 8D 1B 49 A8 3A 48 0F 14 85 5D 24
COMODO Time Stamping Signer #3 Chain
Validity Period: 2010-05-10 00:00:00 → 2015-05-10 23:59:59
Signature Algorithm: sha1RSA
Serial Number: 47 8A 8E FB 59 E1 D8 3F 0C E1 42 D2 A2 87 07 BE

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
56 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware