Gridinsoft Logo

The ngrok.exe (The ngrok agent gets you online in one line.) File Analysis

Updated 10 months ago
Checked by Malware Check
ngrok.exe

Technical Analysis

File Name ngrok.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (console) x86-64, for MS Windows
SSDEEP Hash
393216:69q1NHrHlC/47rSfHocR5mMf31I/HXZlT12VQir+FKeLf:Iq1NHrFC/47r/tf
Scanner Version 1.0.183.174
Database Version 2024-07-28 20:00:21 UTC
⚠

Suspicious File Detected

Detected by 26 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
35%
Detection Rate
29,523,688
File Size (bytes)
26/74
Engines Detected
2024-07-28
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
d0b7c78ee341e83d50b03cbd31e085ad
SHA1
bc23497a4761c620555895218bee22cc59e2e158
SHA256
d50c84c1fca607a10250be1d2e22ec95dfe48a1abfbff56ef0e2ca7160e26f78
SHA512
7306f32f59c031f8aea494c25a115fd00266f0eb7fc6dbc727122be8f7e8bf598d68d2ed094c16ca564d541e9f0ccd7a8ec0bb057ca9a19c2fb39fe3106bb1b4
ImpHash
07361a3a7f515bf56ca93120b2aca73b

Security Engines with Detections (26 of 74)

Bkav
W32.Common.A34E86C5 Malicious
Skyhigh
Artemis Malicious
McAfee
Artemis!D0B7C78EE341 Malicious
Cylance
Unsafe Malicious
K7AntiVirus
Unwanted-Program ( 005b19331 ) Malicious
K7GW
Unwanted-Program ( 005b19331 ) Malicious
ESET-NOD32
a variant of WinGo/Ngrok.B potentially unsafe Malicious
Paloalto
generic.ml Malicious
Kaspersky
not-a-virus:HEUR:NetTool.Multi.Ngrok.a Malicious
NANO-Antivirus
Riskware.Win64.Ngrok.kpzzkb Malicious
Avast
FileRepPup [PUP] Malicious
F-Secure
Trojan.TR/AVI.Agent.otivf Malicious
DrWeb
Tool.Ngrok.1 Malicious
McAfeeD
ti!D50C84C1FCA6 Malicious
Sophos
Generic Reputation PUA (PUA) Malicious
GData
Win64.Trojan.Agent.BXHR66 Malicious
Webroot
Pua.Ngrok Malicious
Google
Detected Malicious
Avira
PUA/Ngrok.mpcrs Malicious
ZoneAlarm
not-a-virus:HEUR:NetTool.Multi.Ngrok.a Malicious
Varist
W64/ABApplication.KTNC-1167 Malicious
Malwarebytes
Malware.AI.4226923702 Malicious
MaxSecure
Trojan.Malware.234992274.susgen Malicious
Fortinet
Adware/Ngrok Malicious
AVG
FileRepPup [PUP] Malicious
DeepInstinct
MALICIOUS Malicious
48 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x0047b120
Compilation Time 1970-01-01 00:00:00
Checksum 0x01c36f22 (Actual: 0x01c36f22)
OS Version 6.1
PEiD Signatures PE32+ executable (console) x86-64, for MS Windows
Digital Signature Chain verification from [email protected], CN=Ngrok\, Inc., O=Ngrok\, Inc., L=San Diego, ST=California, C=US (serial:10936332555649019308070740469481071607, sha1:7a54eb0d199484eb8caea931c90a744bcf02a7e0) failed: Unable to build a validation path for the certificate "Email Address: [email protected]; Common Name: Ngrok, Inc.; Organization: Ngrok, Inc.; Locality: San Diego; State/Province: California; Country: US" - no issuer matching "Common Name: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; Organization: DigiCert, Inc.; Country: US" was found
Imports 1 libraries
kernel32
Exports 0 functions
Resources 1 Resources
Sections 9 Sections

Version Information

▼
FileDescription The ngrok agent gets you online in one line.
ProductName ngrok agent
ProductVersion 3.13.0
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 10,802,511 bytes 10,802,688 bytes 6.13 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7E04F2C8D262024EC5C4767D09D1C536
.rdata 0x00a4f000 17,245,264 bytes 17,245,696 bytes 4.78 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 5D043DC2F5D61AF37646DDAFAC9BBA9B
.data 0x01ac2000 1,615,664 bytes 970,752 bytes 4.13 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 85CE2B2B08C99F91DA2987E8419572F6
.pdata 0x01c4d000 262,752 bytes 263,168 bytes 5.89 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 8E736EBF05CA252CF4E38151333984D9
.xdata 0x01c8e000 180 bytes 512 bytes 1.76 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9426B63182379023A7B7C8245DBE6EAD
.idata 0x01c8f000 1,424 bytes 1,536 bytes 4.34 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE BA80ECB5D59B35672E2F7932BBFC8D9A
.reloc 0x01c90000 227,674 bytes 227,840 bytes 5.46 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ BE5E402458149CD577F334AE8609ADA0
.symtab 0x01cc8000 4 bytes 512 bytes 0.02 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 07B5472D347D42780469FB2654B7FC54
.rsrc 0x01cc9000 552 bytes 1,024 bytes 1.87 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ A44F6755425D0817AB6E2F346EB3F614

Resource Analysis

▼
Total Resources: 1 (460 bytes)
Resource Type Count Total Size Percentage
RT_VERSION 1 460 bytes
100%

Certificate Chain Analysis

▼
Certificate Information
Product ngrok agent
Description The ngrok agent gets you online in one line.
Signing Date 05:50 PM 07/18/2024 (333 days ago)
Verification Status Signed
Signers Ngrok, Inc.; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4; DigiCert
Counter Signers DigiCert Timestamp 2023; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4; DigiCert
Certificate Chain Summary
Ngrok, Inc. #1 Primary
Validity Period: 2024-05-30 00:00:00 → 2027-08-27 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 08 3A 42 D3 31 C1 5F D9 8D 28 31 5D 15 D9 E3 F7
DigiCert Trusted Root G4 #2 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #3 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Timestamp 2023 #4 Chain
Validity Period: 2023-07-14 00:00:00 → 2034-10-13 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 05 44 AF F3 94 9D 08 39 A6 BF DB 3F 5F E5 61 16

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

Chain verification from [email protected], CN=Ngrok\, Inc., O=Ngrok\, Inc., L=San Diego, ST=California, C=US (serial:10936332555649019308070740469481071607, sha1:7a54eb0d199484eb8caea931c90a744bcf02a7e0) failed: Unable to build a validation path for the certificate "Email Address: [email protected]; Common Name: Ngrok, Inc.; Organization: Ngrok, Inc.; Locality: San Diego; State/Province: California; Country: US" - no issuer matching "Common Name: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; Organization: DigiCert, Inc.; Country: US" was found

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
26 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware