The NewChipstars Skype.com (Acrobroker Sqlite Setup) File Analysis

Updated 1 year ago

Checked by Malware Check

NewChipstars Skype.com

Technical Analysis

File Name	NewChipstars Skype.com
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	49152:a21mFjbTkUPWR15HZShCpPx6x8L6jX1qogfMEcNZFJZUQD69w0ww5:a21MfTtP43cJX1dgyJOQe9wTE
Scanner Version	1.0.166.174
Database Version	2024-02-22 15:00:27 UTC

⚠

Suspicious File Detected

Detected by 7 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

10%

Detection Rate

3,769,664

File Size (bytes)

7/72

Engines Detected

2024-02-22

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	ece14d7083ef06d52ffa65f62cfd0a33
SHA1	a3703c19dfd8cf3f7b2aed86abf9b10c5f1f228a
SHA256	fe2850e35930a2543975a5ba0de31937cd3967eb90b6f6834b43930244a195ae
SHA512	d50a1656d0fe1f70d52fd2ecc1f4abaec465a3402da60f438b2f8ef49dcdae2cda55204a3035d951aa6428e019779433232d17f942824a5adee5a541aafbaa52
ImpHash	ca2ed0b01e23f4e23e30dd15bdc59373

Security Engines with Detections (7 of 72)

Skyhigh

BehavesLike.Win32.Dropper.wc Malicious

McAfee

Artemis!ECE14D7083EF Malicious

Kaspersky

UDS:Trojan.Win32.Agent Malicious

VIPRE

Gen:Variant.Fragtor.505504 Malicious

ALYac

Gen:Variant.Fragtor.505504 Malicious

ZoneAlarm

UDS:Trojan-Dropper.Win32.Agent Malicious

Cylance

unsafe Malicious

65 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: 8441256cf53e58887f3f5856b1d7d7eb Fuzzy: 9f4341933d3836964ce2c77f964446e8 dHash: f8f89c9ed193fce4
Image Base	`0x00400000`
Entry Point	`0x00675dcc`
Compilation Time	2024-01-11 07:55:06
Checksum	0x00000000 (Actual: 0x0039b3d4)
OS Version	6.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	The PE file does not contain a certificate table.
Imports	13 libraries
Exports	3 functions
Resources	91 Resources
Sections	11 Sections

Version Information

▼

CompanyName	Adobe Systems Incorporated
FileDescription	Acrobroker Sqlite Setup
FileVersion	23.6.20320.0
LegalCopyright	Adobe Systems Incorporated
ProductName	Acrobroker Sqlite
ProductVersion	23.6.20320.0
Comments	This installation was built with Actual Installer: http://www.actualinstaller.com
ProgramID	com.embarcadero.Setup
Translation	0x0409 0x04e4

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	2,567,364 bytes	2,567,680 bytes	6.48 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`8BBCE10709264CCFFF2861ADF810D8D9`
`.itext`	`0x00274000`	7,740 bytes	8,192 bytes	6.17 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AC23FF2CCDE77A03A34194EC3CC22EBE`
`.data`	`0x00276000`	42,848 bytes	43,008 bytes	6.17 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5D50EBCA00744F7A2977B08A9D217CFF`
`.bss`	`0x00281000`	29,376 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00289000`	14,896 bytes	15,360 bytes	5.19 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`C1997A75464084A17BDEEC34FF7E2713`
`.didata`	`0x0028d000`	3,298 bytes	3,584 bytes	4.17 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5C6E479927A8A7633685D9BED70444C7`
`.edata`	`0x0028e000`	151 bytes	512 bytes	1.84 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8AD40748A4E60A51C481A5D4E1BDB6A7`
`.tls`	`0x0028f000`	84 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00290000`	93 bytes	512 bytes	1.37 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E2D254D8EF6ED4CACE1B3B4D60B685F5`
`.reloc`	`0x00291000`	220,416 bytes	220,672 bytes	6.72 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`3290DD7BC3932710F598DF69CE74B54C`
`.rsrc`	`0x002c7000`	292,652 bytes	292,864 bytes	6.82 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A9C53AC07FB1FF8F119CD53C2C3BB8B1`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 91 (287,171 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	7	2,156 bytes	0.8%
RT_BITMAP	11	2,304 bytes	0.8%
RT_ICON	9	162,517 bytes	56.6%
RT_STRING	27	25,176 bytes	8.8%
RT_RCDATA	27	92,136 bytes	32.1%
RT_GROUP_CURSOR	7	140 bytes	0%
RT_GROUP_ICON	1	132 bytes	0%
RT_VERSION	1	940 bytes	0.3%
RT_MANIFEST	1	1,670 bytes	0.6%

Certificate Chain Analysis

▼

Certificate Information

Product	Acrobroker Sqlite
Description	Acrobroker Sqlite Setup
File Version	23.6.20320.0
Copyright	Adobe Systems Incorporated

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

7 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1