The CudoMiner.exe File Analysis

Updated 3 days ago

Checked by Malware Check

CudoMiner.exe

Technical Analysis

File Name	CudoMiner.exe
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive`
SSDEEP Hash	24576:KbZgOflTcS7Mr6dU7rsoEDOr7S9ji4NVjK4HX7CspPIWx+:KbZgoMW3omOi9jHN9KM7CKPIB
Scanner Version	1.0.224.174
Database Version	2025-09-09 20:00:56 UTC

⚠

Suspicious File Detected

Detected by 35 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

49%

Detection Rate

945,032

File Size (bytes)

35/72

Engines Detected

2025-09-09

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	e3082028116b8dc0c19446f223cd6c44
SHA1	0cccfea92f34ffb45897036549d1359a316013e2
SHA256	b6a16a9794c048b191274fb2ab9d8489497074df1ba278ba984ac7b507b03ae3
SHA512	98d609daa49ea81e0bafb48f2b632bf983163a23c09e21d8446d58c14d6c70f6afbfd2abf508f57862cea286539d8b3355a5cac49ab68a5030c4c6e299e32428
ImpHash	eb0806dae800674e97000f10e2ec3aa2

Security Engines with Detections (35 of 72)

Bkav

W32.AIDetectMalware Malicious

Lionic

Riskware.Win32.CudoMiner.1!c Malicious

AVG

Other:Malware-gen [Trj] Malicious

Elastic

malicious (moderate confidence) Malicious

CTX

exe.trojan.generic Malicious

CAT-QuickHeal

Trojan.LazyFC.S32598984 Malicious

Skyhigh

Artemis!Trojan Malicious

Cylance

Unsafe Malicious

Zillya

Tool.CudoMiner.Win64.7 Malicious

CrowdStrike

win/grayware_confidence_90% (D) Malicious

Alibaba

RiskWare:Win32/Miners.01b1be81 Malicious

VirIT

Trojan.Win32.Genus.WSO Malicious

Symantec

PUA.Gen.2 Malicious

ESET-NOD32

Win32/CoinMiner.KF potentially unwanted Malicious

APEX

Malicious Malicious

Paloalto

generic.ml Malicious

Kaspersky

not-a-virus:HEUR:RiskTool.Win64.CudoMiner.gen Malicious

Avast

Other:Malware-gen [Trj] Malicious

Rising

PUA.CoinMiner!8.4639 (CLOUD) Malicious

McAfeeD

ti!B6A16A9794C0 Malicious

Trapmine

malicious.moderate.ml.score Malicious

Sophos

Generic Reputation PUA (PUA) Malicious

Varist

W32/ABApplication.IAON-8169 Malicious

Kingsoft

Win32.Troj.Agent.cks Malicious

Xcitium

ApplicUnwnt@#ysx66xqk86fk Malicious

Arcabit

Application.CoinMiner Malicious

Google

Detected Malicious

VBA32

suspected of Trojan.Downloader.gen Malicious

Malwarebytes

RiskWare.CoinMiner Malicious

Panda

PUP/CoinMiner Malicious

TrendMicro-HouseCall

TROJ_GEN.R002H07AK24 Malicious

Tencent

Win32.Trojan.FalseSign.Eplw Malicious

TrellixENS

Artemis!E3082028116B Malicious

MaxSecure

Trojan.Malware.218665841.susgen Malicious

DeepInstinct

MALICIOUS Malicious

37 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: 3e10b6b366ef428e3bad1c3421bdb15d Fuzzy: 14a2c821702ba3b415275d1e0a54b509 dHash: f096aa4d49b296f0
Image Base	`0x00400000`
Entry Point	`0x004042e6`
Compilation Time	2020-08-29 19:32:12
Checksum	0x000f4e05 (Actual: 0x000f4e05)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive`
Digital Signature	Chain verification from CN=Cudo Ventures\, Ltd., O=Cudo Ventures\, Ltd., ST=Dorset, C=GB, businessCategory=Private Organization, jurisdictionOfIncorporationCountryName=GB, serialNumber=11065412 (serial:118766608540164905958007824795681012614, sha1:7bb211d4b1cfee805e8dd7f8ce290665cdfa3b11) failed: The path could not be validated because the end-entity certificate expired 2024-08-09 23:59:59Z
Imports	7 libraries ADVAPI32, COMCTL32, GDI32, KERNEL32, ole32, SHELL32, USER32
Exports	0 functions
Resources	8 Resources
Sections	7 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	36,732 bytes	36,864 bytes	6.09 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`1E58FE90B13D350FD5D26B9288F1487B`
`.data`	`0x0000a000`	232 bytes	512 bytes	1.50 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`A78502EA0EAE96A3084679427F64CAB6`
`.rdata`	`0x0000b000`	29,752 bytes	30,208 bytes	7.21 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_32BYTES`	`6DDE0BC09ACA0747DAB0B4618D16CB86`
`.bss`	`0x00013000`	152,032 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00039000`	4,984 bytes	5,120 bytes	5.37 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`BF333CD621E6990C9EE35906DB406569`
`.ndata`	`0x0003b000`	90,112 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x00051000`	31,344 bytes	31,744 bytes	7.78 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`877376B9A248E6E6FD8ADE7F13C9A70D`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 8 (30,824 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	1	28,318 bytes	91.9%
RT_DIALOG	5	1,412 bytes	4.6%
RT_GROUP_ICON	1	20 bytes	0.1%
RT_MANIFEST	1	1,074 bytes	3.5%

Certificate Chain Analysis

▼

Certificate Information

Verification Status	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
Signers	Cudo Ventures, Ltd.; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)

Certificate Chain Summary

Sectigo Public Code Signing Root R46 #1 Primary

Validity Period: 2021-05-25 00:00:00 → 2028-12-31 23:59:59

Signature Algorithm: sha384RSA

Serial Number: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16

Sectigo Public Code Signing CA EV R36 #2 Chain

Validity Period: 2021-03-22 00:00:00 → 2036-03-21 23:59:59

Signature Algorithm: sha384RSA

Serial Number: 33 D7 08 A8 91 40 53 19 E2 A5 BB D3 39 B9 AD 6E

Cudo Ventures, Ltd. #3 Chain

Validity Period: 2021-08-10 00:00:00 → 2024-08-09 23:59:59

Signature Algorithm: sha256RSA

Serial Number: 59 59 9D E5 2B 1B 41 3E CE 67 5F C1 26 D9 BB 86

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

Chain verification from CN=Cudo Ventures\, Ltd., O=Cudo Ventures\, Ltd., ST=Dorset, C=GB, businessCategory=Private Organization, jurisdictionOfIncorporationCountryName=GB, serialNumber=11065412 (serial:118766608540164905958007824795681012614, sha1:7bb211d4b1cfee805e8dd7f8ce290665cdfa3b11) failed: The path could not be validated because the end-entity certificate expired 2024-08-09 23:59:59Z

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

35 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1