Gridinsoft Logo
File Icon

Granblue_fantasy_relink.exe Trojan Heuristic Analysis

Updated 13 hours ago
Checked by Malaware Check
granblue_fantasy_relink.exe

Technical Analysis

File Name granblue_fantasy_relink.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.217.174
Database Version 2025-06-04 22:00:22 UTC
⚠

Trojan.Heur!.00052033

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
103,855,736
File Size (bytes)
2025-06-04
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
c9832540f0e43abfa7504c7b770e361f
SHA1
86f6974e95ca13e52150891be9a8cb615eabe2b4
SHA256
b3a432e96ff1cb2f4ea39652e274b7b62c72cbcb1e5f591542e95757266c7784
SHA512
4396bd8f5b6f04444c560caa44b4814ae7a45d44e584f520d846d0c1da101f728eee8f0460a3b23e712230e522d3f7df809dc34ee106f415d357ae9e18d63bda
ImpHash
230930ef969b80a8f7a56244ead89c14

PE Analysis

Basic Information

▼
Icon
Hash: d30cd70e8beea674a419296ca95eee61
Fuzzy: 7c790aca3a65b2450ae76977a9bb60b7
dHash: 2b343060e5352960
Image Base 0x140000000
Entry Point 0x143ca5f30
Compilation Time 2024-06-11 06:34:27
Checksum 0x0631a374 (Actual: 0x06313b86)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path D:\jenkins\workspace\tsubasa\Branch\release_shipping_v1_3_0\Deploy\Deploy_x64_SteamMaster\build\.build\vs2022-clang\tsubasa_app\bin\Windows_x64\Master\tsubasa_app.pdb
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 21 libraries
Exports 374 functions
Resources 9 Resources
Sections 12 Sections

Version Information

▼
CompanyName © Cygames, Inc.
FileDescription Granblue Fantasy: Relink
FileVersion 1.3.2
InternalName
LegalCopyright © Cygames, Inc.
OriginalFilename Granblue Fantasy: Relink
ProductName Granblue Fantasy: Relink
ProductVersion 1.3.2
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 63,905,302 bytes 63,905,792 bytes 6.60 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 21571A792AA66A7257B9D24232988ED1
.rdata 0x03cf3000 30,751,820 bytes 30,752,256 bytes 6.49 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CD34DF2DB93CF26582E55F00B6F511D3
.data 0x05a47000 15,283,932 bytes 4,147,200 bytes 4.95 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4BAD551FAE3B53349384C19A594735A3
.pdata 0x068db000 2,810,940 bytes 2,811,392 bytes 7.13 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 37D7285EB05F6957112C965642628553
.00cfg 0x06b8a000 56 bytes 512 bytes 0.51 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ A69C4BC68BFC97A96E7860B674F6AFA8
.gxfg 0x06b8b000 14,304 bytes 14,336 bytes 5.24 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D1A77D8908B164D7F2B3ABE987E9AF74
.retplne 0x06b8f000 116 bytes 512 bytes 1.12 (Normal) 0x00000000 5B9AE538AE2A6135B6C4750C10AD0A45
.tls 0x06b90000 5,809 bytes 6,144 bytes 0.05 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 2580AEBF210B1404147AD918BB0052AA
_RDATA 0x06b92000 9,068 bytes 9,216 bytes 6.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 52D6D77750B762DB3D635BACF49FA993
.rsrc 0x06b95000 361,152 bytes 361,472 bytes 5.32 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 8E09539B3600AAF04E36211E682198FE
.reloc 0x06bee000 1,629,156 bytes 1,629,184 bytes 5.47 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ CD22DBA81F07CBF4F180612772885C15
.bind 0x06d7c000 206,104 bytes 206,104 bytes 7.95 (Packed/Encrypted) IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 393A7B6156B233BD1A862E48FC8BCB1E
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 9 (360,566 bytes)
Resource Type Count Total Size Percentage
USER_DEFINED_PARAMS 2 32 bytes
0%
RT_ICON 4 359,200 bytes
99.6%
RT_GROUP_ICON 1 62 bytes
0%
RT_VERSION 1 744 bytes
0.2%
RT_MANIFEST 1 528 bytes
0.1%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.00052033 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.00052033 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware