File Name | jianpian_4.2.3.48_0828_Full.exe |
File Type |
PE32 executable (GUI) Intel 80386, for MS Windows
|
Scanner Version | 1.0.150.174 |
Database Version | 2023-12-01 19:01:21 UTC |
Malware family: Wacatac
Hash Type | Value | Action |
---|---|---|
MD5 |
43d6b723ba37edeef1bcb596acef2ed7
|
|
SHA1 |
58bf25cc73bcf728f0165951afb246ea307586a8
|
|
SHA256 |
fbcf00172a02cfd0bdadca286bfecf1fdf6e7652c81568ff67b2d89da7395664
|
|
SHA512 |
79b0afc77e8acdd7772756e8652a4b5af3c56c2877ef2d171e7e8e8ccb1cc465c11a532415400d3efd7086f4811fcfc3c39ab2d783f0cd94714ea8fa501f9c38
|
|
ImpHash |
d221b1dc8c3a08622f6512e7876527c8
|
Icon |
Hash: db8e1d5fcf65d544d3b8a66d0e9a32d3
Fuzzy: cefad0db8fee904d20e212dcbd12619b dHash: cc96b296ccc4f010 |
Image Base | 0x00400000 |
Entry Point | 0x00401d20 |
Compilation Time | 2011-01-31 17:44:13 |
Checksum | 0x0168cd8b (Actual: 0x0168cd8b) |
OS Version | 4.0 |
PEiD Signatures |
PE32 executable (GUI) Intel 80386, for MS Windows
|
Digital Signature | OK |
Imports |
3 libraries
KERNEL32, USER32, MSVCRT |
Exports | 0 functions |
Resources | 32 Resources |
Sections | 5 Sections |
DigiCert Trusted Root G4 | DigiCert Inc (US) |
DigiCert High Assurance EV Root CA | DigiCert Inc (US) |
DigiCert Trusted Root G4 | DigiCert, Inc. (US) |
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Chengdu Nuoxin Times Technology Co., Ltd. (CN) |
Comments | |
CompanyName | 荐片高清影音软件公司 |
FileDescription | jianpiansetup Setup |
FileVersion | 4.2.3.48 |
InternalName | setup |
LegalCopyright | Copyright ?2022 荐片高清影音软件公司 |
LegalTrademarks | |
OriginalFilename | setup.exe |
PrivateBuild | |
ProductName | jianpiansetup |
ProductVersion | 4.2.3.48 |
SpecialBuild | |
Translation | 0x0409 0x01b5 |
Name | Virtual Address | Virtual Size | Raw Size | Entropy | Characteristics | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
3,756 bytes | 4,096 bytes | 5.94 (Normal) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
9CE5929599C65C95975BF6E171805391 |
.rdata |
0x00002000 |
1,160 bytes | 4,096 bytes | 1.74 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
015DD3C04D84F61F565E42966779DEFF |
.data |
0x00003000 |
1,376 bytes | 4,096 bytes | 1.01 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D4A8A270215B2FEC747CAABFD58D8F7B |
.gentee |
0x00004000 |
71,720 bytes | 73,728 bytes | 7.94 (Packed/Encrypted) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F3D56FAD870AC776A293A5EAB833471B |
.rsrc |
0x00016000 |
612,220 bytes | 614,400 bytes | 3.98 (Normal) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
DBEB1895F7EE29B2B9B0124090369B1D |
1 section(s) with high entropy (≥7.5) detected - possible packing/encryption
Resource Type | Count | Total Size | Percentage |
---|---|---|---|
RT_ICON | 20 | 586,816 bytes | |
RT_DIALOG | 8 | 3,014 bytes | |
RT_RCDATA | 1 | 18,106 bytes | |
RT_GROUP_ICON | 1 | 286 bytes | |
RT_VERSION | 1 | 848 bytes | |
RT_MANIFEST | 1 | 1,221 bytes |
Subject |
DigiCert Trusted Root G4 DigiCert Inc US |
Issuer | DigiCert Trusted Root G4 |
Serial Number | 7451500558977370777930084869016614236 |
Subject |
DigiCert Trusted Root G4 DigiCert Inc US |
Issuer | DigiCert High Assurance EV Root CA |
Serial Number | 21027418832470288962299581843631674929 |
Subject |
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 DigiCert, Inc. US |
Issuer | DigiCert Trusted Root G4 |
Serial Number | 11533403529598586876501374841704918745 |
Subject |
Chengdu Nuoxin Times Technology Co., Ltd. Chengdu Nuoxin Times Technology Co., Ltd. CN |
Issuer | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
Serial Number | 13643670673736241152473941466292135099 |
OK
Gridinsoft has the capability to identify and eliminate Ransom.Win32.Wacatac.sa without requiring further user intervention.
Download Anti-MalwareFollow these steps to completely remove the threat from your system