Gridinsoft Logo
File Icon

Getting Over It with Momoka.exe Trojan Heuristic Analysis

Updated 2 months ago
Checked by Malware Check
Getting Over It with Momoka.exe

Technical Analysis

File Name Getting Over It with Momoka.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.228.174
Database Version 2025-10-30 21:00:22 UTC
⚠

Trojan.Heur!.03052023

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
48,333,312
File Size (bytes)
2025-10-30
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
9b1428d9b26967cf93fbd228af6f50a6
SHA1
ffa8661ff44e7dbfd539da0b3eae3ed5f08eea63
SHA256
f22d8c4cd661d0d9afbf1125146e90778e2a36acc4f2b303b08d41b59172c5e4
SHA512
9d0f064069fbdf939cff64e7dc6333f4b93d319d63a357844d6ad6aa84ba06095f14f62942bab76d5f38735537b3bc7231fe056b2b805c7e9e0cfa58e350e913
ImpHash
88f70fb82598484a7ce88eef6418418b

PE Analysis

Basic Information

▼
Icon
Hash: 2840ad0fe7949ee848e4eda4fff63c51
Fuzzy: df5a0316d535aaa3af9dfaecb0d3cb27
dHash: 30f0ccdcd4f0f030
Image Base 0x140000000
Entry Point 0x140001260
Compilation Time 2024-12-02 22:56:07
Checksum 0x00000000 (Actual: 0x02e210c6)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path C:\build\output\unity\unity\artifacts\WindowsPlayer\Win_x64_VS2022_VB_nondev_m_r\WindowsPlayer_player_Master_mono_x64.pdb
Digital Signature No valid SignedData structure was found.
Imports 7 libraries
kernel32, oleaut32, user32, advapi32, ole32, ntdll, shlwapi
Exports 4 functions
Resources 12 Resources
Sections 9 Sections

Version Information

▼
FileVersion 6000.0.31.10618563
LegalCopyright (c) 2005-2024 Unity Technologies. All rights reserved.
ProductVersion 6000.0.31f1 (a206c360e2a8)
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 56,432 bytes 56,832 bytes 6.46 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ A5E0BF1E14A18380E4AA8FCFECD45CFD
.rdata 0x0000f000 38,778 bytes 38,912 bytes 4.70 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 1D2B215AD189F1D3D35C9D7E54530052
.data 0x00019000 7,544 bytes 3,072 bytes 1.90 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D284F7B260ED119794375A6998C5083C
.pdata 0x0001b000 3,876 bytes 4,096 bytes 0.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 620F0B67A91F7F74151BC5BE745B7110
_RDATA 0x0001c000 500 bytes 512 bytes 3.71 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ DD297010EA596C9B749DDC72FE421330
.rsrc 0x0001d000 565,280 bytes 565,760 bytes 4.76 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F60AED80D5FDE100E00055187199F2F7
.reloc 0x000a8000 1,624 bytes 2,048 bytes 4.87 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 79918E2814A23B917E4A5494067A35D5
.enigma1 0x000a9000 4,096 bytes 46,915,584 bytes 7.93 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 498699B16E669DC5B5E539BCD17044A7
.enigma2 0x000aa000 745,472 bytes 745,472 bytes 5.47 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE FB4D06CA063F9565ECDE127F1E089EFD
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼
Total Resources: 12 (564,581 bytes)
Resource Type Count Total Size Percentage
RT_ICON 9 562,568 bytes
99.6%
RT_GROUP_ICON 1 132 bytes
0%
RT_VERSION 1 532 bytes
0.1%
RT_MANIFEST 1 1,349 bytes
0.2%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.03052023 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.03052023 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware