Gridinsoft Logo
File Icon

GlassWire.exe Trojan Wacapew Analysis

Updated 1 month ago
Checked by Malware Check
GlassWire.exe

Technical Analysis

File Name GlassWire.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.229.174
Database Version 2025-11-14 05:00:22 UTC
⚠

Trojan.Win32.Wacapew.ca

Malware family: Wacapew

Wacapew belongs to a malware family with data exfiltration, system compromise, and payload deployment capabilities. It can introduce additional malicious components including ransomware to compromised systems.
N/A
Detection Rate
35,313,664
File Size (bytes)
2025-11-14
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
88ade694101fc21fb3430ddc4b2fcf00
SHA1
91a344b497d9199216b9b4dc9fa905a00ed22079
SHA256
cf0a36610c4e55d8e12493a810cabd97b236c4966f0e0e2d53f44b24edd402ae
SHA512
5f8681e9d2b5ca8ab6037449abbdb279be040d6ae7dac88c463a31b365b1fed28e5e186cfae1a015b06e1a672f4b64057f86fd56dd07010f51c8f94262d01617
ImpHash
8149fd8d70043002baabb0deb62e24c6

PE Analysis

Basic Information

▼
Icon
Hash: 834c83f263a4ba94f03412337e4f36a2
Fuzzy: 1aa5af93d52d14bf03fc969f88980e3e
dHash: 71cc968aa282ce7c
Image Base 0x00fe0000
Entry Point 0x00fe2f90
Compilation Time 2024-12-20 16:08:13
Checksum 0x021b3a7f (Actual: 0x021b18ea)
OS Version 6.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 26 libraries
Exports 37 functions
Resources 10 Resources
Sections 21 Sections

Version Information

▼
CompanyName GlassWire
FileDescription GlassWire
InternalName GlassWire
LegalCopyright © 2024 GlassWire
ProductName GlassWire
ProductVersion 3.4.768.0
FileVersion 3.4.768.0
Translation 0x0409 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 13,258,752 bytes 13,257,216 bytes 5.64 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 79D3C6B4BC41F99705194E43BAE1BE19
0x00ca6000 7,647,232 bytes 7,645,184 bytes 5.66 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 8F76BF6DE376AD1C49FDBBEE8AD69EC6
0x013f1000 614,400 bytes 583,168 bytes 4.48 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 482CBEC8CC9EE7C4FC6E59FA25AE23C4
0x01487000 229,376 bytes 41,472 bytes 5.66 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E0A3B575A714619889D80399A8D749DE
0x014bf000 208,896 bytes 172,544 bytes 5.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 1E32CA6E62EBD5CFF532CDC1B5CA4E26
0x014f2000 4,096 bytes 512 bytes 0.08 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E577272A51932C28734E117125BFFB0A
0x014f3000 4,096 bytes 512 bytes 0.06 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 98D39C691A81FC2BA5AFC2BA47A6B1D4
0x014f4000 4,096 bytes 512 bytes 0.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 6CE423CD9C28B0A8A0F16698835F6D64
0x014f5000 4,096 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
0x014f6000 4,096 bytes 512 bytes 0.15 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 60E7E50D6C3E2F15D9E00A86803931C6
0x014f7000 163,840 bytes 134,656 bytes 5.56 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6774E386F6261E38A92EF5231978BC51
0x0151f000 778,240 bytes 680,960 bytes 6.63 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 57628C41872E11A7ADFEE60F3353BAFC
.debug 0x015dd000 4,096 bytes 512 bytes 2.64 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 7474A0E98A5606EC8F8C96C31814C60D
.edata 0x015de000 4,096 bytes 4,096 bytes 5.14 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F99E0BA2988E4B60C46B204C3BCAE8DC
.idata 0x015df000 4,096 bytes 2,560 bytes 5.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 32EA3E7618821345891679514E7B166F
.tls 0x015e0000 4,096 bytes 1,024 bytes 0.24 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 96D2C30CF38DB5F3F3A68976412C1F93
.rsrc 0x015e1000 135,168 bytes 134,144 bytes 5.58 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 99895317CF471EF9F41F70534BDD53A9
.themida 0x01602000 7,782,400 bytes 7,782,400 bytes 6.57 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BA75D12F86D5BBE48C9443DD528C7714
.boot 0x01d6e000 4,685,824 bytes 4,685,312 bytes 7.91 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ DF18497FFE5CDDA2714D3A0E0DA20D8D
.reloc 0x021e6000 4,096 bytes 1,024 bytes 4.03 (Normal) IMAGE_SCN_MEM_READ 253C332F48BE72ABE444F0A95848F7D1
.SCY 0x021e7000 184,320 bytes 183,808 bytes 5.78 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C7F5BD0261BC5636CB7954E25D31DCE2
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 10 (133,271 bytes)
Resource Type Count Total Size Percentage
RT_ICON 7 132,170 bytes
99.2%
RT_GROUP_ICON 1 104 bytes
0.1%
RT_VERSION 1 616 bytes
0.5%
RT_MANIFEST 1 381 bytes
0.3%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Wacapew.ca Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Wacapew.ca without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware