The GoToTags Setup exe File Malware Analysis

Technical Analysis

File Name	GoToTags-Setup.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.217.174
Database Version	2025-06-01 19:00:21 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	f5708fa260706056e84a7dbc02545d50
SHA1	774371e8d4d9e22d648414cd49b532b9e2ae8386
SHA256	fd3e30e384be2a20f54eb2f3c3b3dbdd26a59f8ec35a53b034f9c8f3327b6ffa
SHA512	f3d9cfd9cced20a09e48ab87a73d3da8afde9b320e64883818d28ad45e8112f24f6d686aac6e6bfae1d32a4b035fa41215e95bb8878e96d002057c0b0621dd13
ImpHash	e76f839937e2de472afd35e5f60ca1b2

PE Analysis

Basic Information

▼

Icon	Hash: 065a96c6276cf4f10118a5cf64027fd8 Fuzzy: 4df6ac9dfd10951d290cafbc17a8ca09 dHash: 1c376b4d5571170c
Image Base	`0x140000000`
Entry Point	`0x140028dec`
Compilation Time	2024-01-15 17:49:06
Checksum	0x000ab399 (Actual: 0x000ab399)
OS Version	6.0
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB Path	`Z:\IdeaProjects\product\modules\hydraulic.conveyor.launcher\msixstub\x64\Release\MSIXInstallStub.pdb`
Digital Signature	An error occurred while validating the countersignature: The root Certum Trusted Network CA 2 lists its extended key usages, but {'time_stamping'} are not present
Imports	13 libraries
Exports	0 functions
Resources	11 Resources
Sections	7 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	360,400 bytes	360,448 bytes	6.39 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2488D8744BEF6732DCB92374843F0BBD`
`.rdata`	`0x00059000`	153,464 bytes	153,600 bytes	4.60 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`721C3D06391B91A1989128CCB4A7DF5B`
`.data`	`0x0007f000`	66,340 bytes	58,368 bytes	4.79 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`C71F54419BBA9904B1CD305EB6AF3D02`
`.pdata`	`0x00090000`	18,804 bytes	18,944 bytes	5.68 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9E2085F5650359B7C13359CB7F1C37C6`
`_RDATA`	`0x00095000`	500 bytes	512 bytes	4.22 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BAF64A1D2575DD8A2539E56F1D640D04`
`.rsrc`	`0x00096000`	27,136 bytes	27,136 bytes	7.81 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`14935C4E3860AC07D044E89B77FC6D2E`
`.reloc`	`0x0009d000`	4,528 bytes	4,608 bytes	5.38 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`9E5781D6B89C34CFAD1D111FBE897E7E`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 11 (26,245 bytes)

Resource Type	Count	Total Size	Percentage
AFX_DIALOG_LAYOUT	1	2 bytes	0%
PNG	2	8,097 bytes	30.9%
RT_ICON	5	16,835 bytes	64.1%
RT_DIALOG	1	308 bytes	1.2%
RT_GROUP_ICON	1	76 bytes	0.3%
RT_MANIFEST	1	927 bytes	3.5%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

An error occurred while validating the countersignature: The root Certum Trusted Network CA 2 lists its extended key usages, but {'time_stamping'} are not present

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The GoToTags-Setup.exe File Analysis