Gridinsoft Logo

The roboot64.exe (WinThruster) File Analysis

Updated 1 year ago
Checked by Malware Check
roboot64.exe

Technical Analysis

File Name roboot64.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (native) x86-64, for MS Windows
SSDEEP Hash
384:vTfnnL0U3+Nap8l0MUHEeG7D+j3mirILWR59eMP:DgU+MOycD+KIILSJ
Scanner Version 1.0.171.174
Database Version 2024-04-12 03:00:39 UTC
⚠

Suspicious File Detected

Detected by 18 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
25%
Detection Rate
19,888
File Size (bytes)
18/71
Engines Detected
2024-04-12
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
4233f5196ad66ed816848843fcd7ea11
SHA1
9ce5f659bdd89907624541cb98681224ca75d886
SHA256
ad9fb93f7dd16a98d7b41b5fb206d7af1dcc087d0e2611af566689ff62a86461
SHA512
dd73c8c65dd37349fcf0a5efa81a84c910cbc7f7ea2b627bb9f491dc8b4d70afdcf348a3c4e7268f9d99dd41e426515f2a7962fa18c29daa9858007758aa5740
ImpHash
ed5a3a383829201280c888ce42a14b82

Security Engines with Detections (18 of 71)

Elastic
malicious (high confidence) Malicious
CAT-QuickHeal
Trojan.IGENERIC Malicious
Cylance
unsafe Malicious
ClamAV
Win.Malware.Agent-6347351-0 Malicious
SUPERAntiSpyware
PUP.Systweak/Variant Malicious
DrWeb
Program.Unwanted.750 Malicious
Zillya
Trojan.Tweaker.Win32.35 Malicious
TrendMicro
PUA.Win64.SysTweak.A.component Malicious
Jiangmin
Trojan/Tweaker.m Malicious
Google
Detected Malicious
Xcitium
ApplicUnwnt@#1ijgu1r4qasqv Malicious
Microsoft
PUA:Win32/Systweak Malicious
ViRobot
Adware.Systweak.19888 Malicious
GData
Win32.Application.SysTweak.J Malicious
Malwarebytes
PUP.Optional.WinThruster Malicious
TrendMicro-HouseCall
PUA.Win64.SysTweak.A.component Malicious
Ikarus
PUA.Systweak Malicious
DeepInstinct
MALICIOUS Malicious
53 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Image Base 0x100000000
Entry Point 0x10000247c
Compilation Time 2012-09-26 07:40:40
Checksum 0x00011d8e (Actual: 0x00011d8e)
OS Version 6.0
PEiD Signatures PE32+ executable (native) x86-64, for MS Windows
PDB Path e:\apps\aso3-rebrands-ken_deb_ds\core\programs\regopt\native\objfre_wlh_amd64\amd64\ROBoot.pdb
Digital Signature OK
Imports 1 libraries
ntdll
Exports 0 functions
Resources 1 Resources
Sections 5 Sections

Version Information

▼
ProductName WinThruster
Product Version 1.0.0.0
Build Date 24/01/2011 - 14:19:00UTC
Comments http://www.solvusoft.com/
CompanyName solvusoft
FileVersion 1.0.0.0
InternalName WinThruster
LegalCopyright © 2012 Systweak Inc. All rights reserved.
LegalTrademarks WinThruster
FileDescription WinThruster
OriginalFilename WinThruster.exe
Translation 0x0409 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 9,314 bytes 9,728 bytes 5.82 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 219FECD3CFDA4D8B10045F836868DCF3
.data 0x00004000 1,688 bytes 512 bytes 0.30 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 043C46095689123E1F5BE96C109C2F46
.pdata 0x00005000 180 bytes 512 bytes 1.59 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 522E7ECE45FC23EF8ECF7D65EA5148E5
.rsrc 0x00006000 1,064 bytes 1,536 bytes 2.47 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 897DB0F45A8E15165A9EE3089B2A5A0E
.reloc 0x00007000 60 bytes 512 bytes 0.12 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 4C69442F94342F01C9EECC224C99F9B1

Resource Analysis

▼
Total Resources: 1 (964 bytes)
Resource Type Count Total Size Percentage
RT_VERSION 1 964 bytes
100%

Certificate Chain Analysis

▼
Certificate Information
Product WinThruster
Description WinThruster
File Version 1.0.0.0
Original Name WinThruster.exe
Signing Date 11:31 AM 10/15/2012 (4641 days ago)
Verification Status Signed
Signers Solvusoft Corporation; VeriSign Class 3 Code Signing 2010 CA; VeriSign
Counter Signers Symantec Time Stamping Services Signer - G3; VeriSign Time Stamping Services CA; Thawte Timestamping CA
Internal Name WinThruster
Copyright © 2012 Systweak Inc. All rights reserved.
Certificate Chain Summary
Symantec Time Stamping Services Signer - G3 #1 Primary
Validity Period: 2012-05-01 00:00:00 → 2012-12-31 23:59:59
Signature Algorithm: sha1RSA
Serial Number: 79 A2 A5 85 F9 D1 15 42 13 D9 B8 3E F6 B6 8D ED
VeriSign Time Stamping Services CA #2 Chain
Validity Period: 2003-12-04 00:00:00 → 2013-12-03 23:59:59
Signature Algorithm: sha1RSA
Serial Number: 47 BF 19 95 DF 8D 52 46 43 F7 DB 6D 48 0D 31 A4
Solvusoft Corporation #3 Chain
Validity Period: 2011-07-15 00:00:00 → 2013-07-13 23:59:59
Signature Algorithm: sha1RSA
Serial Number: 4D 1E 69 14 2E 0E 55 9A CB 79 A2 C3 EC 3A A4 79

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
18 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware