ChilkatUtil.dll Ransomware STOP/Djvu Analysis

Ransomware STOP/Djvu

Updated on 2024-03-10 (8 months ago)

Online Virus Checker	v.1.0.168.174
DB Version:	2024-03-10 01:00:27

Ransom.Win32.STOP.tr!n

STOP/Djvu Ransomware, also known simply as STOP Ransomware or Djvu Ransomware, is a type of malicious software that encrypts the files on a victim's computer and demands a ransom for their decryption. This ransomware variant has been active for several years and has affected numerous users and organizations.

File	ChilkatUtil.dll
Checked	2024-03-09 23:34:53
MD5	42a540363489455ce9e766b4533fccd9
SHA1	fc0a0c6be66cea70576a5c06359076d62adc9611
SHA256	fe2090450e9761da52fcd037934553d061fd0b395ad260dff3b81c30c202a10c
SHA512	b857dfd6a1a07410a3ed2083c56eec16b70b6a5e1735f341e6dc2ec416b8859f83804736cd816793b581c66f0e992c32dd07188618b5808be08771153e580dfe
Imphash	e6acde8a85613da156de657f519387dc
File Size	660384 bytes

Ransom.Win32.STOP.tr!n Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win32.STOP.tr!n without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

Comments	http://www.chilkatsoft.com
CompanyName	Chilkat Software, Inc.
FileDescription	Chilkat Util ActiveX
FileVersion	3, 0, 0, 0
InternalName	ChilkatUtil
LegalCopyright	Copyright 2000-2007
LegalTrademarks
OLESelfRegister
OriginalFilename	ChilkatUtil.dll
PrivateBuild
ProductName	Chilkat Util
ProductVersion	3, 0, 0, 0
SpecialBuild
Translation	0x0409 0x04b0

Portable Executable Info

Image Base:	0x10000000
Entry Point:	0x100330e5
Compilation:	2007-04-20 11:35:10
Checksum:	0x000a4470 (Actual: 0x000a4470)
OS Version:	4.0
PEiD:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Sign:	OK
Sections:	5
Imports:	KERNEL32, USER32, GDI32, ADVAPI32, ole32, OLEAUT32,
Exports:	4
Resources:	15

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00001000	0x0004291a	0x00043000	564fe86288618aa7216ef075d2ee6ac7	6.49
.rdata	0x00044000	0x0000c468	0x0000d000	b9d573eb943d75973891ec8bbef5f336	4.62
.data	0x00051000	0x0003e290	0x0003c000	152ff92a0f0959651f60e36b7fd7cf41	6.10
.rsrc	0x00090000	0x000088c8	0x00009000	c78696c8b51f1327b790a9a5e5130021	5.40
.reloc	0x00099000	0x000090f2	0x0000a000	eddf9ca9101203cc3d6ce67653049480	4.48