Gridinsoft Logo
File Icon

The LOLSkinChanger.exe File Analysis

Updated 1 month ago
Checked by Malware Check
LOLSkinChanger.exe

Technical Analysis

File Name LOLSkinChanger.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
SSDEEP Hash
49152:rAOlkQ1X/3FvdMv3W+LHcfC8wIn7LoUNJI0rne4vrngwR2ZgK9cxD1yq0l:bV3FLv0l
Scanner Version 1.0.229.174
Database Version 2025-11-18 03:00:24 UTC
⚠

Suspicious File Detected

Detected by 10 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
16%
Detection Rate
3,000,704
File Size (bytes)
10/62
Engines Detected
2025-11-18
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
90318d123b65724eb64592b786643f10
SHA1
37ae569b220055cc1ee47c2eccfb3632a0649465
SHA256
bc31836652fc18999e6b7aab6e4d6004036769443c16e39d5a30964ff4268129
SHA512
16bb7a00f72dc55a7dff1c839ff430f085b2df75fa0b6616a8addd95448c1e4a3266eddf5449061949b828e9ec5f49a51d0844853d269b2ff54a7e02afa1fb5f
ImpHash
f0ea7b7844bbc5bfa9bb32efdcea957c

Security Engines with Detections (10 of 62)

Bkav
W64.AIDetectMalware Malicious
Elastic
malicious (moderate confidence) Malicious
Avast
Win64:Evo-gen [Trj] Malicious
Tencent
Trojan.Win64.kryptik.16002667 Malicious
McAfeeD
ti!BC31836652FC Malicious
Ikarus
Trojan.Win32.Cab Malicious
Microsoft
Trojan:Win32/Wacatac.H!ml Malicious
Google
Detected Malicious
Malwarebytes
Malware.AI.4275969589 Malicious
AVG
Win64:Evo-gen [Trj] Malicious
52 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 8f96100de0c7e791392a04ba813d6d52
Fuzzy: f3b13e66b18d17b7a5680751878f73a0
dHash: 8e676765e5a58100
Image Base 0x00400000
Entry Point 0x0045cb20
Compilation Time 1970-01-01 00:00:00
Checksum 0x002e1171 (Actual: 0x002e1171)
OS Version 6.1
PEiD Signatures PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 1 libraries
kernel32
Exports 0 functions
Resources 41 Resources
Sections 7 Sections

Version Information

▼
CompanyName Canva Pty Ltd
FileDescription
FileVersion 1.117.1
LegalCopyright © Canva
ProductName Canva
ProductVersion 1.117.1
Translation 0x0409 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 902,468 bytes 902,656 bytes 6.19 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 9A667A23B4EF2CCB1F2F0A28A87A33AD
.rdata 0x000de000 1,344,816 bytes 1,345,024 bytes 4.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ FE061D3E1BE4E1977EF64D69AAE36470
.data 0x00227000 440,496 bytes 82,944 bytes 4.05 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B1F0CD741BEC0D458C6E330B8731F7F3
.idata 0x00293000 1,168 bytes 1,536 bytes 3.61 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B247820F097E74A82BB817CB8E0AEF76
.reloc 0x00294000 13,322 bytes 13,824 bytes 5.39 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ F633639F049AD154391167AFBC608A90
.symtab 0x00298000 121,485 bytes 121,856 bytes 5.15 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ A47F251BD29A0B4C554864F42144209E
.rsrc 0x002b6000 522,528 bytes 522,752 bytes 6.36 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 252926D2171CA24E13DB6F4D0FF60EDD

Resource Analysis

▼
Total Resources: 41 (520,399 bytes)
Resource Type Count Total Size Percentage
RT_ICON 20 513,779 bytes
98.7%
RT_DIALOG 18 5,808 bytes
1.1%
RT_GROUP_ICON 2 292 bytes
0.1%
RT_VERSION 1 520 bytes
0.1%

Certificate Chain Analysis

▼
Certificate Information
Product Canva
File Version 1.117.1
Signing Date 10:06 PM 10/19/2025 (81 days ago)
Verification Status The digital signature of the object did not verify.
Signers Canva; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert
Counter Signers DigiCert SHA256 RSA4096 Timestamp Responder 2025 1; DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1; DigiCert Trusted Root G4; DigiCert
Copyright © Canva
Certificate Chain Summary
Canva #1 Primary
Validity Period: 2025-01-24 00:00:00 → 2028-01-26 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 05 30 53 93 8E 4D F9 B8 49 9F 4C 89 27 DF FE 44
DigiCert SHA256 RSA4096 Timestamp Responder 2025 1 #2 Chain
Validity Period: 2025-06-04 00:00:00 → 2036-09-03 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0A 80 EF 18 4B 8D F1 05 82 D1 C4 76 A7 95 74 68
DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1 #3 Chain
Validity Period: 2025-05-07 00:00:00 → 2038-01-14 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0D C7 AC 57 05 FF 21 99 2E 40 43 22 0C 3A 49 86
DigiCert Trusted Root G4 #4 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
10 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware