The FOLHA exe File Malware Analysis

Technical Analysis

File Name	FOLHA.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.229.174
Database Version	2025-12-03 16:00:39 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	760a934f61a0ba3ff559786a9629be57
SHA1	0c699c36dd25c27d3f6d3c7ef24142e3165ff265
SHA256	bdf64b77374596b44be51b5557cb0543fb0bee34d9c5dbaa6beedd9e8342b7a0
SHA512	e934bc99ae79522e6e90648edca23b5fa57ccf51a0a50f0d13bdca16e6bbcd84f0740bf7b5675dcd3860b7cb4de604ddb2b372ebd47c72a6215d071a4816d324
ImpHash	bbd7bd298530c9165dfed38179eca400

PE Analysis

Basic Information

▼

Icon	Hash: 151d8840f812ce4bc205e10918234b1d Fuzzy: 475b426c1ab3f27c6c437037e22ed9c5 dHash: 448f373553130e8d
Image Base	`0x00400000`
Entry Point	`0x0171560c`
Compilation Time	1992-06-19 22:22:17
Checksum	0x00000000 (Actual: 0x030d91bc)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	23 libraries
Exports	0 functions
Resources	800 Resources
Sections	8 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`CODE`	`0x00001000`	20,007,232 bytes	20,007,424 bytes	6.50 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D3F0D26CC303331348368AD4B0074591`
`DATA`	`0x01316000`	221,024 bytes	221,184 bytes	6.05 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`FA779E18DEA0BA804D010D5AAB8D9254`
`BSS`	`0x0134c000`	133,641 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0136d000`	17,722 bytes	17,920 bytes	5.26 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3EB0CF242D23049878044D78B38B7A55`
`.tls`	`0x01372000`	152 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x01373000`	24 bytes	512 bytes	0.28 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`F8F6476A9A246E94395A40B147C30655`
`.reloc`	`0x01374000`	1,167,368 bytes	1,167,872 bytes	6.78 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`269789ED7E9478F073F6D9A7F0F4683C`
`.rsrc`	`0x01492000`	29,790,720 bytes	29,790,720 bytes	6.17 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`670DE93A118986C1EF1FA282E48BDCB8`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 800 (29,729,559 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	16	4,928 bytes	0%
RT_BITMAP	195	62,564 bytes	0.2%
RT_ICON	4	31,968 bytes	0.1%
RT_DIALOG	1	82 bytes	0%
RT_STRING	124	124,466 bytes	0.4%
RT_RCDATA	443	29,505,169 bytes	99.2%
RT_GROUP_CURSOR	16	320 bytes	0%
RT_GROUP_ICON	1	62 bytes	0%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The FOLHA.exe File Analysis