Gridinsoft Logo
File Icon

The CHITUBOX Pro.exe File Analysis

Updated 2 months ago
Checked by Malaware Check
CHITUBOX Pro.exe

Technical Analysis

File Name CHITUBOX Pro.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (GUI) x86-64, for MS Windows
SSDEEP Hash
196608:/xZ7IXZlpeVRYWqaloKLHI1bUfoHeHC9HgEMVmTjMw19CWPlZHARQOvYdERHdxiC:pCXFeVRY7ooyohUfo+HC9H5MVgoUJZHu
Scanner Version 1.0.211.174
Database Version 2025-03-26 17:01:11 UTC
⚠

Suspicious File Detected

Detected by 38 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
52%
Detection Rate
12,039,192
File Size (bytes)
38/73
Engines Detected
2025-03-26
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
af5fc6c1016cd504d9d467cb5ecbe16c
SHA1
d27a9135656e99499950a66dff831ea8bffda111
SHA256
d4f8cfa8ad56df2272c5223f14457f3a333e97747718ac89d469c700dbc9301d
SHA512
f72e8e8eb7a8c5536b801a05f8e2021cee66ca70da314d1dbb96c3d8e2aa3355ac0a724364f7d5af5ec6cd1f7bdce80bc72029a52f67ea18171214b5dfd61d9b
ImpHash
c5c114a79dbd12f4f8454f98bde0f370

Security Engines with Detections (38 of 73)

Bkav
W64.AIDetectMalware Malicious
Lionic
Trojan.Win32.Themida.4!c Malicious
Elastic
malicious (high confidence) Malicious
MicroWorld-eScan
Adware.GenericKD.61045151 Malicious
CAT-QuickHeal
Trojan.Ghanarava.1742549727cbe16c Malicious
Skyhigh
BehavesLike.Win64.Fake.wc Malicious
ALYac
Adware.GenericKD.61045151 Malicious
Cylance
Unsafe Malicious
Sangfor
Adware.Win64.Packed.Vc3l Malicious
K7AntiVirus
Trojan ( 0057a5231 ) Malicious
Alibaba
Packed:Win64/Themida.14c2863a Malicious
K7GW
Trojan ( 0057a5231 ) Malicious
CrowdStrike
win/malicious_confidence_60% (W) Malicious
Symantec
ML.Attribute.HighConfidence Malicious
ESET-NOD32
a variant of Win64/Packed.Themida.L suspicious Malicious
TrendMicro-HouseCall
TROJ_GEN.R002H09CK25 Malicious
Paloalto
generic.ml Malicious
BitDefender
Adware.GenericKD.61045151 Malicious
Avast
Win64:MalwareX-gen [Trj] Malicious
Emsisoft
Adware.GenericKD.61045151 (B) Malicious
Google
Detected Malicious
VIPRE
Adware.GenericKD.61045151 Malicious
McAfeeD
ti!D4F8CFA8AD56 Malicious
CTX
exe.trojan.themida Malicious
Sophos
Generic Reputation PUA (PUA) Malicious
Ikarus
PUA.Themida Malicious
FireEye
Adware.GenericKD.61045151 Malicious
Varist
W64/ABApplication.CCLJ-6399 Malicious
Fortinet
Riskware/Application Malicious
Antiy-AVL
GrayWare/Win32.Wacapew Malicious
Arcabit
Adware.Generic.D3A3799F Malicious
McAfee
Artemis!AF5FC6C1016C Malicious
Malwarebytes
Malware.AI.4289626062 Malicious
MaxSecure
Trojan.Malware.325188728.susgen Malicious
GData
Adware.GenericKD.61045151 Malicious
AVG
Win64:MalwareX-gen [Trj] Malicious
DeepInstinct
MALICIOUS Malicious
alibabacloud
VirTool:Win/Puwaders.C9nj Malicious
35 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: cc242cfc48b77f4ede38c17b4524ffbe
Fuzzy: 9077934e9aef66f42ffe83c175991978
dHash: ccb2b0e8e8f2b2cc
Image Base 0x140000000
Entry Point 0x141603058
Compilation Time 2025-01-08 03:04:39
Checksum 0x00b7cce2 (Actual: 0x00b7cce2)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 40 libraries
Exports 124 functions
Resources 12 Resources
Sections 13 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
0x00001000 9,910,411 bytes 3,989,504 bytes 7.99 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 38B565119B627F7CA7139317F1357C4C
0x00975000 3,450,280 bytes 1,357,312 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3CFD66D953C3B51AE85E7E89402000E2
0x00cc0000 350,768 bytes 70,656 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 29C614B7C3A9B0A69DF4BB2D97B64E3E
0x00d16000 374,892 bytes 214,016 bytes 7.71 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ A0D6D1959067DB6A8128078FB20AC1C3
0x00d72000 229,280 bytes 95,744 bytes 7.96 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9924311F746F98283141409F72B3B59E
0x00daa000 107,644 bytes 40,448 bytes 7.91 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 03556EADE7E6581C869CA3C6FE50B149
.edata 0x00dc5000 6,656 bytes 6,656 bytes 5.46 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 37179B2C277A3A1F9DF0A93B8DEF3DEC
.idata 0x00dc7000 4,096 bytes 4,096 bytes 4.46 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 272A3366638BE8FE8D891AF5AACB4813
.tls 0x00dc8000 4,096 bytes 512 bytes 0.28 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BB7BF6F839A6F46B045A9647E1588620
.rsrc 0x00dc9000 229,376 bytes 229,376 bytes 6.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 5929186251320A6E8A72B1FB56D5A009
.themida 0x00e01000 8,396,800 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.boot 0x01603000 6,018,560 bytes 6,018,560 bytes 7.94 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 1CFBB2A358EED90FF23372B27603D9D7
.reloc 0x01bc1000 4,096 bytes 16 bytes 2.47 (Normal) IMAGE_SCN_MEM_READ 1E5F58258CC937D9ACA74D8B893A25A2
Entropy Analysis Alert

7 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 12 (228,578 bytes)
Resource Type Count Total Size Percentage
RT_ICON 10 228,051 bytes
99.8%
RT_GROUP_ICON 1 146 bytes
0.1%
RT_MANIFEST 1 381 bytes
0.2%

Certificate Chain Analysis

▼
Certificate Information
Certificate Chain Summary
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 #1 Primary
Validity Period: 2021-04-29 00:00:00 → 2036-04-28 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 08 AD 40 B2 60 D2 9C 4C 9F 5E CD A9 BD 93 AE D9
Shenzhen CBD Technology Co., Ltd. #2 Chain
Validity Period: 2022-12-05 00:00:00 → 2025-12-03 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0C CA 2A 9B 09 72 0F 0C C7 EB 99 33 5A 6D 7E BE
DigiCert Timestamp 2024 #3 Chain
Validity Period: 2024-09-26 00:00:00 → 2035-11-25 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0B AE 66 BC 5A BA 7F 95 87 C6 F9 E9 04 E3 33 04
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #4 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Trusted Root G4 #5 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
38 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware