File Name | Xml viewer.exe |
File Type |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
Scanner Version | 1.0.167.174 |
Database Version | 2024-02-27 22:00:16 UTC |
Malware family: DealPly
Hash Type | Value | Action |
---|---|---|
MD5 |
382a9017257aa65d79e80c60d2d38d19
|
|
SHA1 |
82f697f64dded98e7c039637d64a473d76a4faf6
|
|
SHA256 |
abace9ea8d89c45c9b01172525f1628cde94487c2e90a749c88267aba24e795d
|
|
SHA512 |
3073b67e4eb32e019681a160df3e422115eb0039fa52d462a9acb75d484dd879603468f52f29c59549730b96827aab0d0e24dd24bd7c988af3964f7648472662
|
|
ImpHash |
f4639a0b3116c2cfc71144b88a929cfd
|
Icon |
Hash: ededff98662a85c64089ca7bf8a7f906
Fuzzy: 06d127e552b00921f96d8446e5a454bb dHash: 71c08cf8d8dcc870 |
Image Base | 0x00400000 |
Entry Point | 0x0040350f |
Compilation Time | 2023-07-02 02:09:29 |
Checksum | 0x00000000 (Actual: 0x0002364a) |
OS Version | 4.0 |
PEiD Signatures |
PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
|
Digital Signature | The PE file does not contain a certificate table. |
Imports |
7 libraries
ADVAPI32, SHELL32, ole32, COMCTL32, USER32, GDI32, KERNEL32 |
Exports | 0 functions |
Resources | 12 Resources |
Sections | 5 Sections |
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
26,289 bytes | 26,624 bytes | 6.47 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
FC80EF3332BA3A0DD802B98A9723E67D |
.rdata |
0x00008000 |
4,952 bytes | 5,120 bytes | 5.10 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F0B500FF912DDA10F31F36DA3EFC8A1E |
.data |
0x0000a000 |
3,793,784 bytes | 1,536 bytes | 4.03 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
89FFA2C22129E298AD6A3ABF19EB19B0 |
.ndata |
0x003a9000 |
135,168 bytes | 0 bytes | 0.00 (Normal) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rsrc |
0x003ca000 |
16,656 bytes | 16,896 bytes | 6.01 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
63F4A2F85D511F72877A09C2D7D40732 |
Resource Type | Count | Total Size | Percentage |
---|---|---|---|
RT_ICON | 7 | 13,784 bytes | |
RT_DIALOG | 3 | 1,000 bytes | |
RT_GROUP_ICON | 1 | 104 bytes | |
RT_MANIFEST | 1 | 1,070 bytes |
This file is not digitally signed.
⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources
The PE file does not contain a certificate table.
Recommendation: Verify the file source and ensure it comes from a trusted publisher.
Gridinsoft has the capability to identify and eliminate Adware.Win32.DealPly.dd!s1 without requiring further user intervention.
Download Anti-MalwareFollow these steps to completely remove the threat from your system