Gridinsoft Logo

1 Trojan Agent Analysis

Updated 1 year ago
Checked by Malaware Check
1

Technical Analysis

File Name 1
File Type
PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Scanner Version 1.0.167.174
Database Version 2024-02-27 07:00:21 UTC
⚠

Trojan.Win64.Agent.oa!s1

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
20,992
File Size (bytes)
2024-02-27
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
8596cd4e4cd44928d9621ca7a17a4697
SHA1
067e1d4bfeec7fa10ee72145df2eec3a61c8d1e0
SHA256
a3207a4e241d81d510eb7f8f713b961680084a0f4f673f0b086d57dbc5a3b15d
SHA512
da89c43f339352379b6a8b78e11cd55f97a76e72c018a57805d815be3e5fc8ed37ca478026e78d26507f34cf74dd479f4cbc20aceb54da8e6c482143ba627d16
ImpHash
148bb19e5f2a9444caa6c1588ccb3a58

PE Analysis

Basic Information

▼
Image Base 0x6bac0000
Entry Point 0x6bac13d0
Compilation Time 2063-07-26 01:20:36
Checksum 0x00011dd1 (Actual: 0x000116da)
OS Version 4.0
PEiD Signatures PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 3 libraries
ADVAPI32, KERNEL32, msvcrt
Exports 1 functions
Resources 0 Resources
Sections 11 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 8,416 bytes 8,704 bytes 5.89 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES 4818188BD731779A291C9263EFFB331E
.data 0x00004000 2,128 bytes 2,560 bytes 5.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES FA855EB5549931CA4D028A7692FC9A3B
.rdata 0x00005000 1,312 bytes 1,536 bytes 3.91 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES F9DF8766F0FD989719DA866B889DB95D
.pdata 0x00006000 552 bytes 1,024 bytes 2.41 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 631361500672B9383611948E5A8D8F58
.xdata 0x00007000 472 bytes 512 bytes 3.74 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES C3A25D1B45D7CF05FDC08F3528D177C3
.bss 0x00008000 2,352 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES D41D8CD98F00B204E9800998ECF8427E
.edata 0x00009000 76 bytes 512 bytes 0.70 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 55210AB235AE55CCD6CAF9F2EB16C38E
.idata 0x0000a000 2,704 bytes 3,072 bytes 3.87 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES BDFC2F8F5069406D40A06E2D19E6136A
.CRT 0x0000b000 88 bytes 512 bytes 0.20 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES CC1B1B5D666AEE5B54F79D24B47058A0
.tls 0x0000c000 104 bytes 512 bytes 0.26 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES 049282ED3B402B40B4347D0F9AD2526C
.reloc 0x0000d000 912 bytes 1,024 bytes 5.73 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 911C05653202BAA0DBD36D475189C200

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Agent.oa!s1 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Agent.oa!s1 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware