Gridinsoft Logo
File Icon

The Wind0ws Load3r.exe File Analysis

Updated 1 year ago
Checked by Malaware Check
Wind0ws Load3r.exe

Technical Analysis

File Name Wind0ws Load3r.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
SSDEEP Hash
49152:uEYCFEtVeNug0t7oXVzyvJeQ4BIK44O8epuWV355FXw/+wuWV355FXw/+muWV35X:uEYzONutt7otywQiIK4l
Scanner Version 1.0.154.174
Database Version 2024-01-11 22:05:45 UTC
⚠

Suspicious File Detected

Detected by 45 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
63%
Detection Rate
3,389,431
File Size (bytes)
45/72
Engines Detected
2024-01-11
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
f43aab2eaca2ecfa91c5eb31f19ad070
SHA1
95a5bb53da9cd032666e032c70fe9fecd3a5d7f9
SHA256
e0a11866e9f34733712afa3c2e6b6a3eb8c16a4b3f3e03f85d1743e26a4acf2c
SHA512
5640c213f57354bd7db61e25966de8d3200427671821bc1c5e2ca5ddef6294cf2c0a9adab7fb9740e1d562884b1cb3e3b3e01fbe464f6e257543b30bc89176f7
ImpHash
ac2ed402c59cc91af94988a7c20ffd67

Security Engines with Detections (45 of 72)

Bkav
W32.AIDetectMalware Malicious
Lionic
Hacktool.Win32.Activator.3!c Malicious
MicroWorld-eScan
Application.Activator.J Malicious
FireEye
Generic.mg.f43aab2eaca2ecfa Malicious
Skyhigh
BehavesLike.Win32.Generic.wh Malicious
McAfee
Artemis!F43AAB2EACA2 Malicious
Cylance
unsafe Malicious
Sangfor
Trojan.Win32.Save.a Malicious
K7AntiVirus
Trojan ( 005a95c11 ) Malicious
K7GW
Trojan ( 005a95c11 ) Malicious
CrowdStrike
win/grayware_confidence_100% (W) Malicious
Arcabit
Application.Activator.J Malicious
BitDefenderTheta
Gen:NN.ZexaF.36608.opNfaCUzYHli Malicious
Symantec
Hacktool.Kms Malicious
Elastic
malicious (moderate confidence) Malicious
ESET-NOD32
a variant of Win32/HackTool.WinActivator.I potentially unsafe Malicious
Cynet
Malicious (score: 100) Malicious
ClamAV
Win.Malware.Generic-9950656-0 Malicious
Kaspersky
HackTool.Win32.KMSAuto.xc Malicious
BitDefender
Application.Activator.J Malicious
Tencent
Malware.Win32.Gencirc.118976f3 Malicious
Emsisoft
Application.Activator.J (B) Malicious
VIPRE
Application.Activator.J Malicious
TrendMicro
HKTL_WINACTIVATE Malicious
Sophos
Windows 7 Loader (PUA) Malicious
SentinelOne
Static AI - Suspicious PE Malicious
Webroot
W32.Hack.Tool Malicious
Varist
W32/A-aa93a15d!Eldorado Malicious
Antiy-AVL
Worm/Win32.AutoRun Malicious
Kingsoft
Win32.HackTool.KMSAuto.xc Malicious
ZoneAlarm
HackTool.Win32.KMSAuto.xc Malicious
GData
Application.Activator.J Malicious
Google
Detected Malicious
ALYac
Application.Activator.J Malicious
MAX
malware (ai score=99) Malicious
Malwarebytes
WinActivator.HackTool.RiskWare.DDS Malicious
Zoner
Trojan.Win32.99550 Malicious
TrendMicro-HouseCall
HKTL_WINACTIVATE Malicious
Rising
HackTool.WinLoader!8.118A6 (CLOUD) Malicious
Yandex
Trojan.Agent!5Gc5JnoWEdM Malicious
Ikarus
PUA.HackTool.Winactivator Malicious
MaxSecure
Trojan.Malware.110651339.susgen Malicious
Fortinet
Riskware/WINACTIVATE Malicious
Cybereason
malicious.3da9cd Malicious
DeepInstinct
MALICIOUS Malicious
27 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 7708abf59bbc452a0f3b55b3e16747c6
Fuzzy: f92eb7cee5078db53620536289663d12
dHash: 177165f0f071330f
Image Base 0x00400000
Entry Point 0x0061a9a0
Compilation Time 2007-10-31 16:53:19
Checksum 0x00000000 (Actual: 0x00346480)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Digital Signature The PE file does not contain a certificate table.
Imports 12 libraries
Exports 0 functions
Resources 16 Resources
Sections 3 Sections

Version Information

▼
CompanyName
FileVersion 2.0.0.0
Country
Release Final
FileDescription
LegalCopyright
ProductVersion
ProductName
OriginalFilename Windows Loader.exe
InternalName

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
UPX0 0x00001000 1,613,824 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
UPX1 0x0018b000 593,920 bytes 591,360 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 341600DEB9D8896C67745665DC888AB7
.rsrc 0x0021c000 28,672 bytes 27,136 bytes 5.78 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE AD1088C7693355D9A2111AA95654257D
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 16 (26,215 bytes)
Resource Type Count Total Size Percentage
PICKLE 1 8 bytes
0%
RT_CURSOR 3 924 bytes
3.5%
RT_ICON 6 22,384 bytes
85.4%
RT_GROUP_CURSOR 3 60 bytes
0.2%
RT_GROUP_ICON 1 90 bytes
0.3%
RT_VERSION 1 1,888 bytes
7.2%
RT_MANIFEST 1 861 bytes
3.3%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
45 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware