Gridinsoft Logo

The j1phz1wk4t996xe2n8kx8tib2.exe File Analysis

Technical Analysis

File Name j1phz1wk4t996xe2n8kx8tib2.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (GUI) x86-64, for MS Windows
SSDEEP Hash
393216:aFaHQ3V5zteCx7/XLD39iGF1aODBNZcreB11Tnyh/y8u8:JQ3VKqn39lU2LZc61T+Lu8
Scanner Version 1.0.219.174
Database Version 2025-06-30 08:00:23 UTC

Suspicious File Detected

Detected by 37 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
51%
Detection Rate
16,376,848
File Size (bytes)
37/72
Engines Detected
2025-06-30
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
2916bef5389417272aae0b5a2f01e0cb
SHA1
97f161e4a7127a4181c023800d64f4c531c3ae4d
SHA256
cfdc30708b377e9ed07068a09aa3fccb6da04722345a79574eeada22547fe24c
SHA512
8002f9a12117ca775612507de4570a3f767c0bb13d8027b28a7ecb02a4bc5e7796849959afb681d77ebe3d3b105afe101d2e4d5a84c3737fa1ad0dee2463e84d
ImpHash
4da4b237ff618d18332922582449381f

Security Engines with Detections (37 of 72)

Bkav
W64.AIDetectMalware Malicious
Lionic
Trojan.Win32.Generic.4!c Malicious
tehtris
Generic.Malware Malicious
MicroWorld-eScan
Trojan.Generic.38117130 Malicious
CTX
exe.trojan.generic Malicious
CAT-QuickHeal
Trojan.Ghanarava.175093217401e0cb Malicious
Skyhigh
BehavesLike.Win64.Generic.wc Malicious
ALYac
Trojan.Generic.38117130 Malicious
Malwarebytes
Malware.AI.4271484647 Malicious
VIPRE
Trojan.Generic.38117130 Malicious
Sangfor
Suspicious.Win32.Save.a Malicious
K7AntiVirus
Trojan ( 005ada971 ) Malicious
K7GW
Trojan ( 005ada971 ) Malicious
CrowdStrike
win/malicious_confidence_100% (W) Malicious
Symantec
ML.Attribute.HighConfidence Malicious
Elastic
malicious (high confidence) Malicious
ESET-NOD32
a variant of Win64/Packed.Themida.Q suspicious Malicious
APEX
Malicious Malicious
TrendMicro-HouseCall
TROJ_GEN.R002H09FN25 Malicious
Paloalto
generic.ml Malicious
BitDefender
Trojan.Generic.38117130 Malicious
Avast
Win64:MalwareX-gen [Misc] Malicious
Emsisoft
Trojan.Generic.38117130 (B) Malicious
Google
Detected Malicious
McAfeeD
Real Protect-LS!2916BEF53894 Malicious
Trapmine
suspicious.low.ml.score Malicious
Sophos
Mal/Generic-S Malicious
Varist
W64/Trojan.GKA.gen!Eldorado Malicious
Microsoft
Trojan:Win32/Wacatac.B!ml Malicious
Arcabit
Trojan.Generic.D2459F0A Malicious
GData
Win64.Trojan.Agent.GDL856 Malicious
Cylance
Unsafe Malicious
TrellixENS
Artemis!2916BEF53894 Malicious
Fortinet
Riskware/Application Malicious
AVG
Win64:MalwareX-gen [Misc] Malicious
DeepInstinct
MALICIOUS Malicious
alibabacloud
VirTool:Win/Sabsik.FE Malicious
35 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

Image Base 0x140000000
Entry Point 0x141829058
Compilation Time 2025-06-08 20:51:26
Checksum 0x00f9f055 (Actual: 0x00f9f055)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 32 libraries
Exports 0 functions
Resources 1 Resources
Sections 12 Sections

PE Sections

Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 1,022,286 bytes 517,632 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ E4A7E1C5D5F0F422354043B06BC58FD8
0x000fb000 391,430 bytes 137,728 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 112D4D81AE74265698B68546CAB61C2C
0x0015b000 476,616 bytes 396,800 bytes 7.94 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F030FF1417E0E6C4F60A8B68BD12548E
0x001d0000 47,748 bytes 28,160 bytes 7.64 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 47C1C626708F2C7F76D9D4605436D689
0x001dc000 13,040 bytes 13,312 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 204172BFAC46203CF2F25432837D138C
0x001e0000 5,780 bytes 2,560 bytes 7.58 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 5057830C97C378B200119D7C24D12CC1
.idata 0x001e2000 4,096 bytes 2,560 bytes 4.07 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE F2666EF747A4B696402733C3891C6BC4
.tls 0x001e3000 4,096 bytes 512 bytes 0.28 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 38C4D8FE6A77F31FBE8D43DC92718895
.rsrc 0x001e4000 4,096 bytes 512 bytes 4.72 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 01FF5EA24A134733E23C1DC268BA575D
.themida 0x001e5000 23,347,200 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.boot 0x01829000 15,275,520 bytes 15,275,520 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7943682552DB132D7A6276979C379FF7
.reloc 0x026bb000 4,096 bytes 16 bytes 2.47 (Normal) IMAGE_SCN_MEM_READ 3727A05BD5F2E2E50A8236AFA082DE18
Entropy Analysis Alert

7 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

Total Resources: 1 (381 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 381 bytes
100%

Certificate Chain Analysis

No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
37 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Gridinsoft Anti-Malware