Gridinsoft Logo

PgTE30OWbnvLK5W.dll Trojan Heuristic Analysis

Updated 2 days ago
Checked by Malware Check
pgTE30OWbnvLK5W.dll

Technical Analysis

File Name pgTE30OWbnvLK5W.dll
File Type
PE32+ executable (DLL) (console) x86-64, for MS Windows
Scanner Version 1.0.222.174
Database Version 2025-08-05 11:00:43 UTC
⚠

Trojan.Heur!.000120B2

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
70,071,680
File Size (bytes)
2025-08-05
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
5cf0724154cb8e35524041dd2ea39c15
SHA1
c6ef8733e8d594bc23923759931e781a3dff962d
SHA256
e4525ff15c5a360a556af9fedcd4c0655b81f6459c8713f2da9ab0a22cd8dedd
SHA512
2a84f18707d140d651c0d3e8b2afaf7cee8786abb43ad2d4b17f37ba6787d809fc0325f143c88d87e7199fb6fe51abb4fafac0f89731ae0ca54282adc9c207ca
ImpHash
5b93bd6daa81802a383f3d64c40eb533

PE Analysis

Basic Information

▼
Image Base 0x180000000
Entry Point 0x180317dcd
Compilation Time 2025-07-27 11:02:47
Checksum 0x00000000 (Actual: 0x042db9c8)
OS Version 6.0
PEiD Signatures PE32+ executable (DLL) (console) x86-64, for MS Windows
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 2 libraries
KERNEL32, ntdll
Exports 12 functions
Resources 0 Resources
Sections 10 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 499,072 bytes 499,200 bytes 6.58 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 1C6C3D792C16B6C9AA9EFBB7EE986AC2
.rdata 0x0007b000 112,820 bytes 113,152 bytes 5.44 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 30D0180CEDF9A8740D9148A0FA5C5A9D
.data 0x00097000 17,136 bytes 8,704 bytes 3.75 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 375B80EC402830A3CFE1F7BE28A56593
.pdata 0x0009c000 26,460 bytes 26,624 bytes 7.84 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ DEBD464A9EBFBF223D5DDC378F1D345B
_RDATA 0x000a3000 244 bytes 512 bytes 2.48 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C99E03D13D4D75E70945BD6EF426E79E
.q]1^ 0x000a4000 2,529,247 bytes 2,529,280 bytes 7.59 (Packed/Encrypted) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 626FC9983B7EDB5BCA3EE3779AE2CB57
.=P;r 0x0030e000 80 bytes 512 bytes 0.12 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 86C39B08A00294EADFB220147BD229AB
.hn(, 0x0030f000 1,867,664 bytes 1,867,776 bytes 7.46 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 4D96AC8905B5966EEDA0C28017B727D7
.reloc 0x004d7000 3,668 bytes 4,096 bytes 5.25 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 6A8ADA9CB91337038D774A8C2959935B
.vgslj 0x004d8000 65,011,720 bytes 65,012,224 bytes 0.00 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D75DC01A15A4A3847101817B133C992A
Entropy Analysis Alert

2 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.000120B2 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.000120B2 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware