GetUid x86 exe Trojan Agent File Malware Analysis: 00bab554c9e525722c1fc73fd682bdea
Gridinsoft Logo
File Icon

GetUid-x86.exe Trojan Agent Analysis

Updated 9 days ago
Checked by Malware Check
GetUid-x86.exe

Technical Analysis

File Name GetUid-x86.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.231.174
Database Version 2025-12-28 17:00:35 UTC
⚠

Trojan.Win32.Agent.ns

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
153,088
File Size (bytes)
2025-12-28
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
00bab554c9e525722c1fc73fd682bdea
SHA1
25acfcc197e1fade2cbc27da07dc0192a0e2a986
SHA256
d165a65ea4be164850b5713e76f29d68ab424c90c9e84beddd74a261dedea4b7
SHA512
56985eb02f6abcf67791f875c9cd5d13c631258f4376ad2a786cfb8153c34b1ea13b423534cda5cc1aabe2b09804eb1cb8dae23a0226ff9680d2eb60fe2c8d16
ImpHash
2cc60ca1d05de4ee85459786d7e5b2e1

PE Analysis

Basic Information

▼
Icon
Hash: 0304a765b7d1981a90d07ce1b4f8148c
Fuzzy: 00f093ca5233c12c497c0f3fc1557273
dHash: 909280a2a280a2a0
Image Base 0x00400000
Entry Point 0x00401505
Compilation Time 2005-07-01 15:44:06
Checksum 0x00000000 (Actual: 0x0002b432)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
PDB Path c:\_bred\getuid\Release\getuid.pdb
Digital Signature No valid SignedData structure was found.
Imports 3 libraries
KERNEL32, USER32, ADVAPI32
Exports 0 functions
Resources 20 Resources
Sections 6 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 21,192 bytes 21,504 bytes 6.68 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D7D8168A49E31CA506C686D3DAD73D33
.rdata 0x00007000 5,416 bytes 5,632 bytes 4.78 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CDE55ED30CE9199D7A5B3B222967457C
.data 0x00009000 7,320 bytes 2,048 bytes 1.79 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 7E5864B19283C31462A78C0750734CC1
.rsrc 0x0000b000 74,968 bytes 75,264 bytes 4.68 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ AA6C2352714E41B681C6F38EE0FCB102
.vmp0 0x0001e000 46,241 bytes 46,592 bytes 7.89 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE B01EFEBB6AFD577B04D776E4FE40253D
.vmp1 0x0002a000 540 bytes 1,024 bytes 3.71 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 96B7D2B2867787B0B69799A2CCEB7F77
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 20 (73,856 bytes)
Resource Type Count Total Size Percentage
RC_BINARY 1 26,624 bytes
36%
RT_ICON 16 46,848 bytes
63.4%
RT_DIALOG 1 148 bytes
0.2%
RT_GROUP_ICON 2 236 bytes
0.3%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Agent.ns Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Agent.ns without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware