Gridinsoft Logo

Main.exe Susp WebDownload Analysis

Updated 13 days ago
Checked by Malaware Check
main.exe

Technical Analysis

File Name main.exe
File Type
PE32 executable (console) Intel 80386, for MS Windows
Scanner Version 1.0.217.174
Database Version 2025-05-25 14:00:16 UTC
⚠

Susp.U.WebDownload.sd!yf

Malware family: WebDownload

N/A
Detection Rate
7,340,032
File Size (bytes)
2025-05-25
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
a3e4dc2a3a174fc0deace2890f00c035
SHA1
26dea0e777b8689187da0002771996defcf512e1
SHA256
faf93d1c5bc1fc22359c2ffe23855c96ee36eb0ee9ad9f766a94df8672b62fef
SHA512
79270dea286ec066141f7c0437437f8b09a631339f2c10d5ec9eb670ead384c68dd2ad7e32cd556a53bef9567a93cd4946f68c9d7db4f3d62bfeb0b12be4eda1
ImpHash
4f2f006e2ecf7172ad368f8289dc96c1

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x00469790
Compilation Time 1970-01-01 00:00:00
Checksum 0x00000000 (Actual: 0x00701db0)
OS Version 6.1
PEiD Signatures PE32 executable (console) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 1 libraries
kernel32
Exports 0 functions
Resources 0 Resources
Sections 13 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 2,510,901 bytes 2,511,360 bytes 6.04 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 7DB3139692B1F4974143B8DBFAF875CD
.rdata 0x00267000 2,190,632 bytes 2,190,848 bytes 5.74 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 33D5C34A4B20F02A614897ED6C39F2A8
.data 0x0047e000 376,840 bytes 185,344 bytes 5.90 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 1466894055E99B60B57BC02DBC3297EF
/4 0x004db000 297 bytes 512 bytes 5.08 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 17F62672C8506464AE13ECCC2EB6CB94
/19 0x004dc000 418,914 bytes 419,328 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 0C7DF5326AFFF3D8E435325E486F2BF8
/32 0x00543000 76,735 bytes 76,800 bytes 7.98 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 570B107EF6CDD2E7186C7F329587D9A1
/46 0x00556000 54 bytes 512 bytes 0.97 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 47BDDBAC5524BB91437982B55229E4B7
/65 0x00557000 737,029 bytes 737,280 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 4756C1A25406DC2DB1C7DF3B815F8EAF
/78 0x0060b000 611,454 bytes 611,840 bytes 8.00 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 4A8689CE2D66C37E50D07BA908004B91
/90 0x006a1000 171,146 bytes 171,520 bytes 7.94 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES 84C964C1CB0DB2FE5973D12D4FE1D74F
.idata 0x006cb000 1,118 bytes 1,536 bytes 3.86 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 9B7B250975AA7751C9BEBDF97D3A43D7
.reloc 0x006cc000 106,770 bytes 107,008 bytes 6.66 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ B8428D617200F3F83368FA7934FECC94
.symtab 0x006e7000 324,819 bytes 325,120 bytes 5.28 (Normal) IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 3323CDFAFC751FF6D59F243C5743EFFB
Entropy Analysis Alert

5 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Susp.U.WebDownload.sd!yf Removal

Gridinsoft has the capability to identify and eliminate Susp.U.WebDownload.sd!yf without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware