Gridinsoft Logo
File Icon

7z2409-x64.exe Ransomware Dharma Analysis

Updated 25 days ago
Checked by Malaware Check
7z2409-x64.exe

Technical Analysis

File Name 7z2409-x64.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.216.174
Database Version 2025-05-12 21:00:24 UTC
⚠

Ransom.Win32.Dharma.tr

Malware family: Dharma

Dharma ransomware encrypts files on victim systems, rendering them inaccessible until ransom payment. It typically spreads through manual attacker intervention via Remote Desktop Protocol exploitation and represents part of an established ransomware family with multiple variants.
N/A
Detection Rate
1,637,343
File Size (bytes)
2025-05-12
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
6c73cc4c494be8f4e680de1a20262c8a
SHA1
28b53835fe92c3fa6e0c422fc3b17c6bc1cb27e0
SHA256
bdd1a33de78618d16ee4ce148b849932c05d0015491c34887846d431d29f308e
SHA512
2e8b746c51132f933cc526db661c2cb8cee889f390e3ce19dabbad1a2e6e13bed7a60f08809282df8d43c1c528a8ce7ce28e9e39fea8c16fd3fcda5604ae0c85
ImpHash
cf0d2de4fd6406302012e0f40060395f

PE Analysis

Basic Information

▼
Icon
Hash: e70ab6434b901bf0d86cad4f2e381b4b
Fuzzy: c0aeeb48c2783a270a993faae44e6ec1
dHash: 00b28eabababa600
Image Base 0x00400000
Entry Point 0x00407294
Compilation Time 2024-11-29 16:00:00
Checksum 0x00000000 (Actual: 0x00194365)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 6 libraries
ole32, USER32, ADVAPI32, SHELL32, MSVCRT, KERNEL32
Exports 0 functions
Resources 6 Resources
Sections 4 Sections

Version Information

▼
CompanyName Igor Pavlov
FileDescription 7-Zip Installer
FileVersion 24.09
InternalName 7zipInstall
LegalCopyright Copyright (c) 1999-2024 Igor Pavlov
OriginalFilename 7zipInstall.exe
ProductName 7-Zip
ProductVersion 24.09
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 26,094 bytes 26,112 bytes 6.61 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 5B5DF34CB537924353FA21521226C4B3
.rdata 0x00008000 4,934 bytes 5,120 bytes 4.62 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 752AF4C5B1CDEDAD97ADC4A080B6BE7D
.data 0x0000a000 14,572 bytes 512 bytes 0.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 598E1AAE6ECBD8237C4383F4BE94B9F1
.rsrc 0x0000e000 4,072 bytes 4,096 bytes 4.37 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3A91C3E1E6B1B04595D74A03C9BE3BAA
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 6 (3,626 bytes)
Resource Type Count Total Size Percentage
RT_ICON 2 1,040 bytes
28.7%
RT_DIALOG 1 374 bytes
10.3%
RT_GROUP_ICON 1 34 bytes
0.9%
RT_VERSION 1 720 bytes
19.9%
RT_MANIFEST 1 1,458 bytes
40.2%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Ransom.Win32.Dharma.tr Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win32.Dharma.tr without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware