Gridinsoft Logo
File Icon

DRIVERINSTALL.exe Trojan Agent Analysis

Updated 3 days ago
Checked by Malware Check
DRIVERINSTALL.exe

Technical Analysis

File Name DRIVERINSTALL.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.222.174
Database Version 2025-08-11 17:00:36 UTC
⚠

Trojan.Win32.Agent.cld

Malware family: Agent

Trojan Agent malware disguises itself as legitimate software while performing unauthorized activities including data theft and providing remote system access to threat actors.
N/A
Detection Rate
1,121,792
File Size (bytes)
2025-08-11
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
6fd30ef07c69f29e3cf88e5307e0daf0
SHA1
c47f16ddb9331509a80758eac4e6a486c68c81e2
SHA256
fe3ffae8899c44632cfcea619b48de2202d79c124e16dc0f621185af26673c0d
SHA512
f2e7c72c0ee757c5c0164390903867b5d97525f6377b4f7ae62dbf229cde3418ebb0109467bd4458182b05a3ee88ed9ecb2708b318f5caad3af97861f7e754cf
ImpHash
00ccddaa08538aa2f0ff349663d26acf

PE Analysis

Basic Information

▼
Icon
Hash: fcbcfdcf647e677fa8cf852162062ab0
Fuzzy: 8724951dc1936ac7d8b2e508a33cb6bc
dHash: 89adace1e18e0183
Image Base 0x00400000
Entry Point 0x0046b7ac
Compilation Time 1992-06-19 22:22:17
Checksum 0x00000000 (Actual: 0x00120dd4)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 9 libraries
kernel32, user32, advapi32, oleaut32, version, gdi32, comctl32, shell32, comdlg32
Exports 0 functions
Resources 73 Resources
Sections 8 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
CODE 0x00001000 436,212 bytes 436,224 bytes 6.53 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 438ABFCC3475F2134B493DC4A16A2D50
DATA 0x0006c000 6,140 bytes 6,144 bytes 4.11 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 7565E283404484162DEB5F629E2A9A59
BSS 0x0006e000 3,181 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.idata 0x0006f000 9,330 bytes 9,728 bytes 4.94 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE AE9F5A259B7D94ABF6D270D83E1A5F9E
.tls 0x00072000 16 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x00073000 24 bytes 512 bytes 0.21 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 82711B487912BCCA4151D284B8724B34
.reloc 0x00074000 30,640 bytes 30,720 bytes 6.65 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ F573A952C38E5EFEFB93DD6910D4987A
.rsrc 0x0007c000 636,999 bytes 637,440 bytes 2.66 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ A2DDC06325EC373A9950A91E7128C224
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 73 (593,553 bytes)
Resource Type Count Total Size Percentage
RT_CURSOR 8 2,464 bytes
0.4%
RT_BITMAP 26 26,692 bytes
4.5%
RT_ICON 4 4,640 bytes
0.8%
RT_DIALOG 1 82 bytes
0%
RT_STRING 21 11,944 bytes
2%
RT_RCDATA 4 547,509 bytes
92.2%
RT_GROUP_CURSOR 8 160 bytes
0%
RT_GROUP_ICON 1 62 bytes
0%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win32.Agent.cld Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win32.Agent.cld without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware