Gridinsoft Logo
File Icon

The velat.exe (Windows System Assessment Tool) File Analysis

Updated 2 days ago
Checked by Malware Check
velat.exe

Technical Analysis

File Name velat.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (GUI) x86-64, for MS Windows
SSDEEP Hash
196608:G0UpNcv/OJE1j9fZwQRCgjmpXHIEGn7jDsfPjRMsqeXL2yrjAnDkyh:Mp2OJ2w8ERIEUsfPjSDNWCkyh
Scanner Version 1.0.219.174
Database Version 2025-06-25 13:00:19 UTC
⚠

Suspicious File Detected

Detected by 31 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
43%
Detection Rate
11,486,269
File Size (bytes)
31/72
Engines Detected
2025-06-25
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
a78d242327268afc7f511961ded6a257
SHA1
0952b3a1a2029b4bbc4d268fec4b3df7befa2892
SHA256
9cd0786706bf53ee0a3bf4da78f3919ea7cf8290d1f4b980f18fd0a6347799b2
SHA512
701b79815af3e97f87d096af007bc2d86d040b6fa60673727cb918b6ee29682a9d436f567ba06cff340ca0e215070b4b30ef700453cf798f0ebc61dc438f27f0
ImpHash
c990338f8145dc29c6f38fb73cf05c77

Security Engines with Detections (31 of 72)

Bkav
W64.AIDetectMalware Malicious
Elastic
malicious (high confidence) Malicious
MicroWorld-eScan
Generic.Znyonm.A.A16CC0AF Malicious
Skyhigh
BehavesLike.Win64.Dropper.vc Malicious
ALYac
Generic.Znyonm.B.46984ABB Malicious
Malwarebytes
Malware.AI.1697382365 Malicious
VIPRE
Generic.Znyonm.A.A16CC0AF Malicious
K7AntiVirus
Trojan ( 005c34b91 ) Malicious
BitDefender
Generic.Znyonm.A.A16CC0AF Malicious
K7GW
Trojan ( 005c34b91 ) Malicious
ESET-NOD32
Python/TrojanDropper.Agent.DW Malicious
Cynet
Malicious (score: 99) Malicious
APEX
Malicious Malicious
Kaspersky
Trojan-Spy.Win32.Agent.dffz Malicious
Rising
Spyware.Agent/PYC!1.EA8F (CLASSIC) Malicious
Emsisoft
Generic.Znyonm.A.A16CC0AF (B) Malicious
F-Secure
Heuristic.HEUR/AGEN.1364963 Malicious
DrWeb
Python.Packed.104 Malicious
Zillya
Trojan.Agent.Win32.4270125 Malicious
McAfeeD
ti!9CD0786706BF Malicious
SentinelOne
Static AI - Suspicious PE Malicious
CTX
exe.unknown.znyonm Malicious
Ikarus
Trojan-Spy.BlankC Malicious
Avira
HEUR/AGEN.1364963 Malicious
Antiy-AVL
RiskWare/Win32.Kryptik.a Malicious
Microsoft
Trojan:Win32/Wacatac.B!ml Malicious
Arcabit
Generic.Znyonm.A.A16CC0AF [many] Malicious
GData
Generic.Znyonm.A.A16CC0AF Malicious
Google
Detected Malicious
huorong
TrojanSpy/Python.Stealer.d Malicious
Fortinet
Python/Blank.C!tr Malicious
41 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: f3fe946504f4d887bd96dde21eb2c23b
Fuzzy: c0d773241056bad299723404d967d30e
dHash: 4896cc69b2320810
Image Base 0x140000000
Entry Point 0x14000d0d0
Compilation Time 2025-06-23 12:25:48
Checksum 0x00af971d (Actual: 0x00afd502)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 5 libraries
USER32, COMCTL32, KERNEL32, ADVAPI32, GDI32
Exports 0 functions
Resources 10 Resources
Sections 7 Sections

Version Information

▼
CompanyName Microsoft Corporation
FileDescription Windows System Assessment Tool
FileVersion 10.0.19041.3636 (WinBuild.160101.0800)
InternalName WinSAT
LegalCopyright © Microsoft Corporation. All rights reserved.
OriginalFilename WinSAT.exe
ProductName Microsoft® Windows® Operating System
ProductVersion 10.0.19041.3636
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 174,144 bytes 174,592 bytes 6.48 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 0B31E33FE5C337AB5001FD0E9827E967
.rdata 0x0002c000 78,384 bytes 78,848 bytes 5.72 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 0CA11398AC833B42D998693EDD8ACC5D
.data 0x00040000 20,720 bytes 3,584 bytes 1.82 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 197F989242DC6660F50D74CF584E262C
.pdata 0x00046000 8,892 bytes 9,216 bytes 5.34 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3FAE02FA227E618EBD6D494E5835F23D
.fptable 0x00049000 256 bytes 512 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BF619EAC0CDF3F68D496EA9344137E8B
.rsrc 0x0004a000 31,048 bytes 31,232 bytes 7.86 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 27AE26BBECCFDDAABB5092DA943C4EEC
.reloc 0x00052000 1,900 bytes 2,048 bytes 5.27 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 98C9699B10085BB8E0533706E3897132
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 10 (30,449 bytes)
Resource Type Count Total Size Percentage
RT_ICON 7 28,124 bytes
92.4%
RT_GROUP_ICON 1 104 bytes
0.3%
RT_VERSION 1 928 bytes
3%
RT_MANIFEST 1 1,293 bytes
4.2%

Certificate Chain Analysis

▼
Certificate Information
Product Microsoft® Windows® Operating System
Description Windows System Assessment Tool
File Version 10.0.19041.3636 (WinBuild.160101.0800)
Original Name WinSAT.exe
Signing Date 11:11 PM 04/25/2023 (794 days ago)
Verification Status The digital signature of the object did not verify.
Signers Akeo Consulting; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)
Counter Signers Symantec SHA256 TimeStamping Signer - G3; Symantec SHA256 TimeStamping CA; VeriSign Universal Root Certification Authority
Internal Name WinSAT
Copyright © Microsoft Corporation. All rights reserved.
Certificate Chain Summary
Sectigo Public Code Signing Root R46 #1 Primary
Validity Period: 2021-05-25 00:00:00 → 2028-12-31 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16
Sectigo Public Code Signing CA EV R36 #2 Chain
Validity Period: 2021-03-22 00:00:00 → 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 33 D7 08 A8 91 40 53 19 E2 A5 BB D3 39 B9 AD 6E
Akeo Consulting #3 Chain
Validity Period: 2021-09-29 00:00:00 → 2024-09-28 23:59:59
Signature Algorithm: sha256RSA
Serial Number: BF B1 50 01 BB F5 92 D4 96 2A 77 97 EA 73 6F A3
Symantec SHA256 TimeStamping CA #4 Chain
Validity Period: 2016-01-12 00:00:00 → 2031-01-11 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 7B 05 B1 D4 49 68 51 44 F7 C9 89 D2 9C 19 9D 12
Symantec SHA256 TimeStamping Signer - G3 #5 Chain
Validity Period: 2017-12-23 00:00:00 → 2029-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 7B D4 E5 AF BA CC 07 3F A1 01 23 04 22 41 4D 12

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
31 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware