Gridinsoft Logo
File Icon

Kawaks loader Trojan Heuristic Analysis

Updated 1 year ago
Checked by Malware Check
kawaks loader

Technical Analysis

File Name kawaks loader
File Type
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Scanner Version 1.0.138.174
Database Version 2023-09-12 00:01:43 UTC
⚠

Trojan.Heur!.030121A9

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
84,480
File Size (bytes)
2023-09-12
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
3528123f3b8ccb494736b6a038f2011a
SHA1
1f06b821a3edd0fac2ffdb5c0a393af32c35ca4f
SHA256
c084854690cec0474e04e770aa8ba8b7d85d5a75637dea1e30d2e4b9ebe2d126
SHA512
1af2411ef0cb6980d9debf205b973771e0da2ae93c121610f58fd3599c6a5a203bbd395fdac555df646255f2f954b1285dc7206122a1aef14dbcfdfd084a58f9
ImpHash
22f878ed56c759e0e52e0b8d783401a6

PE Analysis

Basic Information

▼
Icon
Hash: d1b4399ea39bd71db2163d52a903c10b
Fuzzy: ca2f9baed2888a267e3a92ac70e8b255
dHash: 70ec28edb5f4e878
Image Base 0x00400000
Entry Point 0x00413001
Compilation Time 1970-01-01 00:00:00
Checksum 0x00000000 (Actual: 0x00015cd8)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Digital Signature The PE file does not contain a certificate table.
Imports 4 libraries
kernel32, mfc42, msvcrt, user32
Exports 0 functions
Resources 8 Resources
Sections 7 Sections

Version Information

▼
Comments [email protected]; [email protected]
CompanyName
FileDescription Loader for WinKawaks 1.55
FileVersion 1, 0, 0, 1
InternalName kawaks loader
LegalCopyright Copyright (C) 2006
LegalTrademarks
OriginalFilename loader.exe
PrivateBuild
ProductName
ProductVersion 1, 0, 0, 1
SpecialBuild
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
UPX0 0x00001000 32,768 bytes 7,168 bytes 7.83 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E7F608C3F0051A4A1CCF7028D6233F7F
UPX1 0x00009000 8,192 bytes 7,168 bytes 7.90 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5F051ABBA6A09DB1A383E91A1065B4F2
.rsrc 0x0000b000 24,576 bytes 1,024 bytes 1.76 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A150CD13C33E0BC6C48E6053FBC050F0
.idata 0x00011000 4,096 bytes 1,024 bytes 5.56 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 5DCF0F7E09B638B795D051512B49E9B5
.mackt 0x00012000 4,096 bytes 512 bytes 7.14 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 1352C0442932B24912AE9828F6D3842D
.aspack 0x00013000 28,672 bytes 27,648 bytes 4.60 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 884643E78D20B7788C7B1CE053F92A08
.adata 0x0001a000 38,506 bytes 38,912 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 31E14C04C60244FDC3737CC73A13AACD
Entropy Analysis Alert

2 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 8 (23,406 bytes)
Resource Type Count Total Size Percentage
RT_ICON 6 22,384 bytes
95.6%
RT_GROUP_ICON 1 90 bytes
0.4%
RT_VERSION 1 932 bytes
4%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.030121A9 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.030121A9 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware