Gridinsoft Logo

Solaris.exe Trojan Downloader Analysis

Updated 1 year ago
Checked by Malaware Check
Solaris.exe

Technical Analysis

File Name Solaris.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.175.174
Database Version 2024-05-13 05:01:05 UTC
⚠

Trojan.Win32.Downloader.oa!s1

Malware family: Downloader

Downloader Trojans specialize in retrieving and installing additional malware payloads. Unlike comprehensive malware, they focus specifically on payload delivery rather than direct system damage.
N/A
Detection Rate
48,706
File Size (bytes)
2024-05-13
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
05859c4616d5d3de2927122b4d5303b9
SHA1
7ebef99aedeb8a54fe3c70424282e462df954ef6
SHA256
af51004a01329780e0cf6c04a389de96163e61aa004833cff7d59abef2a053a6
SHA512
d73f6b8a9313a727931135107f800e8885d0e471aaccf1461928a50c6c2a4e2921a1ae6eff8a2a1755656af3cb380782a7e0744573bc29691d0e964c32920d15
ImpHash
a484ff622440442746a9dbf35bf73427

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x004012f0
Compilation Time 2021-05-06 12:46:28
Checksum 0x0000fb71 (Actual: 0x0000fb71)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 4 libraries
GDI32, KERNEL32, msvcrt, USER32
Exports 0 functions
Resources 0 Resources
Sections 14 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 13,876 bytes 14,336 bytes 6.14 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES 915EDC3D9651ACC397ECD42C97E4BB54
.data 0x00005000 24 bytes 512 bytes 0.22 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 952404825FDBB20EB9CCEA8E74F98B57
.rdata 0x00006000 1,824 bytes 2,048 bytes 4.74 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 3FDC319222571BB767EF8BA305F128D3
/4 0x00007000 2,808 bytes 3,072 bytes 4.60 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 61708C5C563D1B083F63904BF2F186D0
.bss 0x00008000 116 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES D41D8CD98F00B204E9800998ECF8427E
.idata 0x00009000 1,864 bytes 2,048 bytes 4.51 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 4DA389D2A005CF724ACF6CE7D404D15F
.CRT 0x0000a000 24 bytes 512 bytes 0.11 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES 7433C31B65A8548D78EE2BE257D1E89C
.tls 0x0000b000 32 bytes 512 bytes 0.22 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES DBAA23778292C6D288D44D99BACB648C
/14 0x0000c000 56 bytes 512 bytes 0.22 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES DECBCE5B375DD64E11D5AC9E15861A52
/29 0x0000d000 7,884 bytes 8,192 bytes 5.77 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 41B54DEDC9BC244F90E25D9895E3DDC6
/41 0x0000f000 329 bytes 512 bytes 3.29 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 4805CC47A2F835E4A4E68F369284C3C0
/55 0x00010000 456 bytes 512 bytes 4.33 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 79ADB672A59E5AC58CECCB20B00D6559
/67 0x00011000 56 bytes 512 bytes 0.68 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES 910D1662D282C7FAE1FE352F648C4669
/80 0x00012000 134 bytes 512 bytes 2.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES B0765A9C6FECE5E7D823CF4A91396070

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Downloader.oa!s1 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Downloader.oa!s1 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware