Gridinsoft Logo
File Icon

The aTube_Catcher_v1.494.683.890.exe (aTube Installer) File Analysis

Updated 2 days ago
Checked by Malware Check
aTube_Catcher_v1.494.683.890.exe

Technical Analysis

File Name aTube_Catcher_v1.494.683.890.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
SSDEEP Hash
24576:dMEjd0+q2i/QY8WY45MzzOJ+gLFdKMi3PagB70S+K7VQy6yXiJC0ABKPamoLi+tz:7jd0+q2i/QwdmagB70S+K7VQy6yXiJCT
Scanner Version 1.0.222.174
Database Version 2025-08-11 16:00:47 UTC
⚠

Suspicious File Detected

Detected by 13 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
18%
Detection Rate
1,330,176
File Size (bytes)
13/72
Engines Detected
2025-08-11
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
cf683fb82ff7bdc6fc69b199e612ab64
SHA1
e238b0e03d245ebd0398856cf2a2c648e3ff11ae
SHA256
fb47befad7297b41c8e13623e3b396091687add0652d705e0e6b345698570141
SHA512
ef49faa277d4701da7d5762162529502b778c330b87f020a80cc0263c68afe3f71b151805858576519ac237c1824b4c51e0ad71c3a16e7af28fd94ac62ff34e7
ImpHash
f34d5f2d4577ed6d9ceec516c1f5a744

Security Engines with Detections (13 of 72)

Elastic
malicious (moderate confidence) Malicious
Cylance
Unsafe Malicious
CrowdStrike
win/grayware_confidence_90% (D) Malicious
SentinelOne
Static AI - Suspicious PE Malicious
Ikarus
Trojan.Win32.Yomal Malicious
Webroot
W32.Adware.Gen Malicious
Microsoft
PUADlManager:Win32/Sepdot Malicious
Google
Detected Malicious
AhnLab-V3
Malware/Win.Generic.C5701379 Malicious
Rising
Trojan.Agent!8.B1E (CLOUD) Malicious
TrellixENS
Artemis!CF683FB82FF7 Malicious
MaxSecure
Trojan.Malware.326501685.susgen Malicious
Fortinet
PossibleThreat Malicious
59 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: bdc7dbd71b9afc590596a31af10935a6
Fuzzy: 1cf2a6b2d3f958548b426bbfc7054b3e
dHash: 18e8eafad6f87182
Image Base 0x00400000
Entry Point 0x005186fe
Compilation Time 2025-05-19 17:35:33
Checksum 0x0014e742 (Actual: 0x0014e742)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Digital Signature OK
Imports 1 libraries
mscoree
Exports 0 functions
Resources 10 Resources
Sections 3 Sections

Version Information

▼
Translation 0x0000 0x04b0
Comments aTube Installer
CompanyName
FileDescription aTube Installer
FileVersion 5.0.0.111
InternalName aTube.exe
LegalCopyright Copyright aTube 2022
LegalTrademarks
OriginalFilename aTube.exe
ProductName aTube Installer
ProductVersion 5.0.0.111
Assembly Version 5.0.0.111

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00002000 1,140,484 bytes 1,140,736 bytes 6.91 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 52F2B5249F73B39C78B11425229CC734
.rsrc 0x0011a000 178,016 bytes 178,176 bytes 5.60 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE E5BA063F485BB807084630A9BA530CBF
.reloc 0x00146000 12 bytes 512 bytes 0.08 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ B79AEEE760972888E963BA243340D9FC
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 10 (177,421 bytes)
Resource Type Count Total Size Percentage
RT_ICON 7 173,333 bytes
97.7%
RT_GROUP_ICON 1 104 bytes
0.1%
RT_VERSION 1 852 bytes
0.5%
RT_MANIFEST 1 3,132 bytes
1.8%

Certificate Chain Analysis

▼
Certificate Information
Product aTube Installer
Description aTube Installer
File Version 5.0.0.111
Original Name aTube.exe
Signing Date 05:35 PM 05/19/2025 (86 days ago)
Verification Status Signed
Signers DS NET CORP SA DE CV; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4
Counter Signers Sectigo Public Time Stamping Signer R36; Sectigo Public Time Stamping CA R36; Sectigo Public Time Stamping Root R46
Internal Name aTube.exe
Copyright Copyright aTube 2022
Certificate Chain Summary
Sectigo Public Time Stamping CA R36 #1 Primary
Validity Period: 2021-03-22 00:00:00 → 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 7A 23 AE DA 53 69 96 0F 91 C8 3E 5C F4 C7 E3 3F
Sectigo Public Time Stamping Signer R36 #2 Chain
Validity Period: 2025-03-27 00:00:00 → 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: A4 29 3B 6E 1E DD D7 A7 34 08 87 AD 7A 4E B7 24
Sectigo Public Time Stamping Root R46 #3 Chain
Validity Period: 2021-03-22 00:00:00 → 2038-01-18 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 36 C2 B0 BD 7C 1B 3A E7 A3 B3 DD 36 CB C9 75 68
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 #4 Chain
Validity Period: 2021-04-29 00:00:00 → 2036-04-28 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 08 AD 40 B2 60 D2 9C 4C 9F 5E CD A9 BD 93 AE D9
DS NET CORP SA DE CV #5 Chain
Validity Period: 2025-05-15 00:00:00 → 2026-05-14 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 02 8C 9A C4 EF 1A 7C 2C 7C CE E5 6B 2B C5 2E 42

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
13 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware