Gridinsoft Logo

The begonia.jpg File Analysis

Updated 3 months ago
Checked by Malware Check
begonia.jpg

Technical Analysis

File Name begonia.jpg
File Type
Win32 DLL
Magic Bytes PE32+ executable (DLL) (GUI) x86-64, for MS Windows
SSDEEP Hash
24576:yptr9EpN/nzgKQlG342FDrU2KVaaJfufdU4f0vC7szuWGaLTmDZkXs:yPmpdzgKQlGvFDrgaasdESWGwTmDx
Scanner Version 1.0.225.174
Database Version 2025-09-25 18:00:34 UTC
⚠

Suspicious File Detected

Detected by 44 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
61%
Detection Rate
1,798,752
File Size (bytes)
44/72
Engines Detected
2025-09-25
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
c459b978b310dd37f9fe43401a441c54
SHA1
a746e189ae87c9718b26bd402091511aa358b27f
SHA256
cd7bc397ef12fa884dd717066ab377165bbb7a335f8909ebf4d61328b1d77e6c
SHA512
5f893dd0bf6e135cf2470304acf0e94b7a33aeec3bb6615d23393ef7a50d20bcb3a7c50f6283da05d4f16ab058f6b12d4b1307dbc31b9975b25ddf1b0d258e11
ImpHash
aa2bcd89d4f697641e0f38701fb8e4ee

Security Engines with Detections (44 of 72)

Bkav
W32.Common.03CA9BCF Malicious
Lionic
Trojan.Win32.Agentb.X!c Malicious
Elastic
malicious (moderate confidence) Malicious
MicroWorld-eScan
Trojan.GenericKD.76242464 Malicious
CAT-QuickHeal
cld.trojan.packunwan Malicious
Skyhigh
Artemis!Trojan Malicious
ALYac
Trojan.GenericKD.76242464 Malicious
Malwarebytes
Neshta.Virus.FileInfector.DDS Malicious
VIPRE
Trojan.GenericKD.76242464 Malicious
K7AntiVirus
Riskware ( 00584baa1 ) Malicious
Alibaba
Trojan:Win64/MalwareX.c04b4efd Malicious
K7GW
Riskware ( 00584baa1 ) Malicious
CrowdStrike
win/malicious_confidence_100% (W) Malicious
Symantec
ML.Attribute.HighConfidence Malicious
ESET-NOD32
a variant of Win64/Kantu.A potentially unwanted Malicious
TrendMicro-HouseCall
Trojan.Win64.PURECRYPTER.AA Malicious
Paloalto
generic.ml Malicious
Kaspersky
Trojan.Win64.Agentb.lcwb Malicious
BitDefender
Trojan.GenericKD.76242464 Malicious
Avast
Win64:MalwareX-gen [Misc] Malicious
Emsisoft
Trojan.GenericKD.76242464 (B) Malicious
Zillya
Trojan.Badur.Win64.72 Malicious
TrendMicro
Trojan.Win64.PURECRYPTER.AA Malicious
McAfeeD
ti!CD7BC397EF12 Malicious
CTX
dll.trojan.agentb Malicious
Sophos
Generic Reputation PUA (PUA) Malicious
GData
Trojan.GenericKD.76242464 Malicious
Jiangmin
Trojan.Agentb.raw Malicious
Google
Detected Malicious
Varist
W64/ABTrojan.PVTS-6060 Malicious
Kingsoft
Win64.Troj.Downloader.wj Malicious
Arcabit
Trojan.Generic.D48B5E20 Malicious
Microsoft
PUA:Win32/Packunwan Malicious
AhnLab-V3
Trojan/Win.Agent.C5779487 Malicious
Cylance
Unsafe Malicious
Panda
Trj/Agent.FUM Malicious
Rising
[email protected] (CERT:vCOwHl4fu+DL8kAl6w1Xdg) Malicious
TrellixENS
Artemis!C459B978B310 Malicious
huorong
Adware/Downware.n Malicious
MaxSecure
Trojan.Malware.8426628.susgen Malicious
Fortinet
W32/PossibleThreat Malicious
AVG
Win64:MalwareX-gen [Misc] Malicious
DeepInstinct
MALICIOUS Malicious
alibabacloud
Trojan:Win/Kantu.A Malicious
28 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Image Base 0x180000000
Entry Point 0x180019104
Compilation Time 2025-03-31 10:02:09
Checksum 0x001baf3e (Actual: 0x001baf3e)
OS Version 6.0
PEiD Signatures PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Digital Signature OK
Imports 9 libraries
KERNEL32, USER32, ADVAPI32, SHELL32, ole32, OLEAUT32, SHLWAPI, WININET, IPHLPAPI
Exports 1 functions
Resources 15 Resources
Sections 6 Sections

Version Information

▼
FileVersion 6.3.5.1
LegalCopyright Wuxi Suihanshan Information Technology Co., Ltd
ProductVersion 6.3.5.1
Translation 0x0804 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 192,500 bytes 192,512 bytes 6.47 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 8E9E48F5C76F24D8115FC45CD5DB2A83
.rdata 0x00030000 93,502 bytes 93,696 bytes 5.07 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 79D45C7E5EF4EC68F8D4E62C9C1422D2
.data 0x00047000 12,348 bytes 3,584 bytes 2.34 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D213433AE2A727196E40A8D43445C21A
.pdata 0x0004b000 8,796 bytes 9,216 bytes 5.33 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6F7B2D626B5779469217D5441E16E4B9
.rsrc 0x0004e000 1,482,824 bytes 1,483,264 bytes 7.74 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 8A8CBEF4CBA8D38E478CC095A3354A04
.reloc 0x001b9000 2,828 bytes 3,072 bytes 5.28 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ AF28867005769F41D3A9C1460A44B6F7
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 15 (1,481,871 bytes)
Resource Type Count Total Size Percentage
RT_RIBBON_XML 1 897 bytes
0.1%
RT_BITMAP 1 1,475,920 bytes
99.6%
RT_STRING 10 3,418 bytes
0.2%
RT_ACCELERATOR 1 112 bytes
0%
RT_VERSION 1 452 bytes
0%
RT_MANIFEST 1 1,072 bytes
0.1%

Certificate Chain Analysis

▼
Certificate Information
File Version 6.3.5.1
Signing Date 10:07 AM 03/31/2025 (285 days ago)
Verification Status Signed
Signers Shanghai Yuesong Information Technology Co., Ltd.; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)
Counter Signers DigiCert Timestamp 2024; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4; DigiCert
Copyright Wuxi Suihanshan Information Technology Co., Ltd
Certificate Chain Summary
AAA Certificate Services #1 Primary
Validity Period: 2004-01-01 00:00:00 → 2028-12-31 23:59:59
Signature Algorithm: sha1RSA
Serial Number: 01
Sectigo Public Code Signing Root R46 #2 Chain
Validity Period: 2021-05-25 00:00:00 → 2028-12-31 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16
DigiCert Trusted Root G4 #3 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A
Sectigo Public Code Signing CA EV R36 #4 Chain
Validity Period: 2021-03-22 00:00:00 → 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 33 D7 08 A8 91 40 53 19 E2 A5 BB D3 39 B9 AD 6E
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #5 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Timestamp 2024 #6 Chain
Validity Period: 2024-09-26 00:00:00 → 2035-11-25 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0B AE 66 BC 5A BA 7F 95 87 C6 F9 E9 04 E3 33 04
Shanghai Yuesong Information Technology Co., Ltd. #7 Chain
Validity Period: 2024-05-14 00:00:00 → 2025-05-14 23:59:59
Signature Algorithm: sha256RSA
Serial Number: B7 A7 CA F4 F4 60 E8 29 E9 EC 62 42 65 6E 9E BC

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
44 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware