The Nuevo pedido (1M85700).exe (Jones Apparel Group Inc.) File Analysis

Updated 2 months ago

Checked by Malaware Check

Nuevo pedido (1M85700).exe

Technical Analysis

File Name	Nuevo pedido (1M85700).exe
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive`
SSDEEP Hash	24576:Q3HYcxXrV+rB4vjXqqH3y7wwopt5/i6noItfef9q+qF6YaDWt6n:Q3TtIB4WqHC7wwopt9i6oUAq+qFSWt6n
Scanner Version	1.0.211.174
Database Version	2025-03-24 23:01:10 UTC

⚠

Suspicious File Detected

Detected by 10 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

14%

Detection Rate

1,097,776

File Size (bytes)

10/72

Engines Detected

2025-03-25

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	666231157a1aa72b467c82c7aba16653
SHA1	1fed551514389221dd64979a4f705804d0d6f660
SHA256	dde6b5b337fbb0c75ba9198962dedc4eb0a1c0d33372096033e995379aca7e60
SHA512	7574475068136867f7341723cd7de3d6436ad3d3c30a486d5e6305712a944d31a67db596cd3347e7a03cc9b6b4d31f49e6f34579c4fe7fb8f3f8934482eb31b2
ImpHash	6e7f9a29f2c85394521a08b9f31f6275

Security Engines with Detections (10 of 72)

Bkav

W32.AIDetectMalware Malicious

Elastic

malicious (high confidence) Malicious

CrowdStrike

win/malicious_confidence_90% (D) Malicious

APEX

Malicious Malicious

Kaspersky

HEUR:Trojan.Win32.Makoob.gen Malicious

Avast

FileRepMalware [Inj] Malicious

Microsoft

Trojan:Win32/Sonbokli.A!cl Malicious

huorong

Trojan/Injector.bud Malicious

AVG

FileRepMalware [Inj] Malicious

DeepInstinct

MALICIOUS Malicious

62 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: 310d854139d6fe74c65164a466bd1868 Fuzzy: 9101b376392060382757729bdb5b7c09 dHash: 2939dc1cdcccfc7c
Image Base	`0x00400000`
Entry Point	`0x004034a2`
Compilation Time	2020-08-01 02:41:11
Checksum	0x00119a2c (Actual: 0x00119a2c)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive`
Digital Signature	Chain verification from CN=Unprovidedly, [email protected], O=Unprovidedly, L=Montjean-sur-Loire, ST=Pays de la Loire, C=FR (serial:678703297495775971713106741614318929653135395691, sha1:64de851f3d53b8b129d9c67feeaf1c3eca066338) failed: The X.509 certificate provided is self-signed - "Common Name: Unprovidedly, Email Address: [email protected], Organization: Unprovidedly, Locality: Montjean-sur-Loire, State/Province: Pays de la Loire, Country: FR"
Imports	7 libraries ADVAPI32, SHELL32, ole32, COMCTL32, USER32, GDI32, KERNEL32
Exports	0 functions
Resources	15 Resources
Sections	5 Sections

Version Information

▼

Comments	Federal Express Corp.
FileDescription	Jones Apparel Group Inc.
LegalTrademarks	ACT Manufacturing Inc.
OriginalFilename	tsarrigets.exe
ProductName	Greif Bros. Corporation
Translation	0x0409 0x04e4

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	25,964 bytes	26,112 bytes	6.47 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`12117AD2476C7A7912407AF0DCFCB8A7`
`.rdata`	`0x00008000`	5,016 bytes	5,120 bytes	5.14 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E3E8D62E1D2308B175349EB9DAA266C8`
`.data`	`0x0000a000`	3,795,832 bytes	1,536 bytes	4.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`2020CA26E010546720FD467C5D087B57`
`.ndata`	`0x003a9000`	167,936 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rsrc`	`0x003d2000`	29,752 bytes	30,208 bytes	3.79 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A9810D2A4A50E720BA796A4F629DB203`

Resource Analysis

▼

Total Resources: 15 (28,890 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	8	26,560 bytes	91.9%
RT_DIALOG	4	760 bytes	2.6%
RT_GROUP_ICON	1	118 bytes	0.4%
RT_VERSION	1	620 bytes	2.1%
RT_MANIFEST	1	832 bytes	2.9%

Certificate Chain Analysis

▼

Certificate Information

Product	Greif Bros. Corporation
Description	Jones Apparel Group Inc.
Original Name	tsarrigets.exe
Verification Status	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
Signers	Unprovidedly

Certificate Chain Summary

Unprovidedly #1 Primary

Validity Period: 2024-12-24 05:51:43 → 2025-12-24 05:51:43

Signature Algorithm: sha256RSA

Serial Number: 76 E2 1B C2 3A 13 57 3D 75 ED 49 43 79 31 0E B2 DC 71 4B 6B

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

Chain verification from CN=Unprovidedly, [email protected], O=Unprovidedly, L=Montjean-sur-Loire, ST=Pays de la Loire, C=FR (serial:678703297495775971713106741614318929653135395691, sha1:64de851f3d53b8b129d9c67feeaf1c3eca066338) failed: The X.509 certificate provided is self-signed - "Common Name: Unprovidedly, Email Address: [email protected], Organization: Unprovidedly, Locality: Montjean-sur-Loire, State/Province: Pays de la Loire, Country: FR"

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

10 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1