File Name | updater.exe |
File Type |
PE32+ executable (GUI) x86-64, for MS Windows
|
Scanner Version | 1.0.158.174 |
Database Version | 2024-02-10 21:00:32 UTC |
Malware family: CoinMiner
Hash Type | Value | Action |
---|---|---|
MD5 |
5f09926fd269ec484401e9efb86c3e26
|
|
SHA1 |
a13058eaecb1be56fac34e11a4d1ca346380699c
|
|
SHA256 |
e39e9317a4945f93217e92e47c3dc17a2424d0dd22c18cb2fe577ae3dd7fa252
|
|
SHA512 |
99a7e6ccb315e579b98bbad24f8630d475fee2c0b9c7612f7e94c4ab10688f3cf3bf6cc1aebc85b7f8ce0c14d4dc72108d2d7331b18d5b679e8daf15631f4aca
|
|
ImpHash |
203d63d5d9a088e2d84cef737227986b
|
Icon |
Hash: ec33e9c521cbb640147e6041cf453e4e
Fuzzy: 8ae8e94646f2667c2b94734243825fef dHash: 898d3212564ccd4d |
Image Base | 0x140000000 |
Entry Point | 0x140001140 |
Compilation Time | 2024-01-23 11:47:13 |
Checksum | 0x00000000 (Actual: 0x00520632) |
OS Version | 6.0 |
PEiD Signatures |
PE32+ executable (GUI) x86-64, for MS Windows
|
Digital Signature | The expected hash does not match the digest in SpcInfo |
Imports |
2 libraries
msvcrt, KERNEL32 |
Exports | 0 functions |
Resources | 2 Resources |
Sections | 8 Sections |
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
35,238 bytes | 35,328 bytes | 6.18 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
61E45BDAB4F7AD993B609EB3449E987D |
.rdata |
0x0000a000 |
11,992 bytes | 12,288 bytes | 4.70 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F1B2AA8A2801EFE5B55DBAD859982DC9 |
.data |
0x0000d000 |
5,223,400 bytes | 5,215,232 bytes | 6.49 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
623B98B71060E40B217CF39C65C296CB |
.pdata |
0x00509000 |
384 bytes | 512 bytes | 3.13 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
56947665CC3DF105C866DCA15B3F6B7F |
.00cfg |
0x0050a000 |
16 bytes | 512 bytes | 0.15 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
B18C7380298E104ADF73576FA46BCCC1 |
.tls |
0x0050b000 |
16 bytes | 512 bytes | 0.00 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x0050c000 |
49,296 bytes | 49,664 bytes | 7.96 (Packed/Encrypted) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BB58BF55629F6C75A590F42729046B22 |
.reloc |
0x00519000 |
120 bytes | 512 bytes | 1.42 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
8D35DC6B73A8835F45783BF89BE743BE |
1 section(s) with high entropy (≥7.5) detected - possible packing/encryption
Resource Type | Count | Total Size | Percentage |
---|---|---|---|
RT_ICON | 1 | 49,112 bytes | |
RT_GROUP_ICON | 1 | 20 bytes |
This file is not digitally signed.
⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources
The expected hash does not match the digest in SpcInfo
Recommendation: Verify the file source and ensure it comes from a trusted publisher.
Gridinsoft has the capability to identify and eliminate Trojan.Win64.CoinMiner.sa without requiring further user intervention.
Download Anti-MalwareFollow these steps to completely remove the threat from your system