Gridinsoft Logo
File Icon

ForzaHorizon5_loader.exe Ransomware Wacapew Analysis

Updated 9 months ago
Checked by Malaware Check
ForzaHorizon5_loader.exe

Technical Analysis

File Name ForzaHorizon5_loader.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.183.174
Database Version 2024-08-05 12:00:30 UTC
⚠

Ransom.Win64.Wacapew.sa

Malware family: Wacapew

Wacapew belongs to a malware family with data exfiltration, system compromise, and payload deployment capabilities. It can introduce additional malicious components including ransomware to compromised systems.
N/A
Detection Rate
141,824
File Size (bytes)
2024-08-05
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
e7ab388b72808203689ced8f51ce32e2
SHA1
439c12112259d8faba1197cdb42526786427e00d
SHA256
c594c9f97fc9740f2eeabf4f564c1ffbb5cd9492a9266d3aa3c8a5318c6da21d
SHA512
9374ab0f6be7a9f82c60dd2bae1004a57dc746b28ecd8600e339ea3b824f8b46daf9089c8cf39fc2c368c7359d5d3dc2954385c900bf23575c7ec32845d728bf
ImpHash
b8bc26ff69071c04c4875d4869e7afa7

PE Analysis

Basic Information

▼
Icon
Hash: 08243de278b2ab59b93a1709f857555b
Fuzzy: 09453d01fde6534a0a3a504b32fcbb9a
dHash: 70f0ba8aa692e070
Image Base 0x140000000
Entry Point 0x140005480
Compilation Time 2023-03-28 18:27:04
Checksum 0x00000000 (Actual: 0x00027501)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 2 libraries
KERNEL32, USER32
Exports 0 functions
Resources 4 Resources
Sections 7 Sections

Version Information

▼
CompanyName Online-Fix.Me
FileDescription Forza Horizon 5 Injector
FileVersion 1.0.0.0
LegalCopyright Copyright (C) 2023, 0xdeadc0de
ProductVersion 1.0.0.0
Translation 0x0407 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 74,816 bytes 75,264 bytes 6.37 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ CD58C25CA29F76DD07F6C7461B66442A
.rdata 0x00014000 46,998 bytes 47,104 bytes 4.65 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 445625A4AAA1A1ED40A869094BB1A08E
.data 0x00020000 7,776 bytes 3,584 bytes 2.40 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 576BC2C5B9BC13FDD640607D0574FFFD
.pdata 0x00022000 6,420 bytes 6,656 bytes 4.83 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 1057074587CA3DC24CD10573A8CB55AA
_RDATA 0x00024000 348 bytes 512 bytes 2.80 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 56065482CD67668FF8868B0AF2A687DC
.rsrc 0x00025000 5,552 bytes 5,632 bytes 4.66 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 15EF5DFBF9092F81695E2F2F9A2C9063
.reloc 0x00027000 1,896 bytes 2,048 bytes 5.29 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 12D7522F3E33F48439822EBECB3594BC

Resource Analysis

▼
Total Resources: 4 (5,237 bytes)
Resource Type Count Total Size Percentage
RT_ICON 1 4,264 bytes
81.4%
RT_GROUP_ICON 1 20 bytes
0.4%
RT_VERSION 1 572 bytes
10.9%
RT_MANIFEST 1 381 bytes
7.3%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Ransom.Win64.Wacapew.sa Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win64.Wacapew.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware