Gridinsoft Logo
File Icon

The ST_Internal_Loader.exe File Analysis

Updated 6 months ago
Checked by Malaware Check
ST_Internal_Loader.exe

Technical Analysis

File Name ST_Internal_Loader.exe
File Type
Win32 EXE
Magic Bytes PE32+ executable (console) x86-64, for MS Windows
SSDEEP Hash
393216:sQgHDlanaGBXvDKtz+bhPWES4tiNQPNrIKc4gaPbUAgrO4mgT96l+ZArYsFRljZo:s3on1HvSzxAMNTFZArYsbzNPvV7OZN
Scanner Version 1.0.197.174
Database Version 2024-11-25 00:00:33 UTC
⚠

Suspicious File Detected

Detected by 29 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
41%
Detection Rate
39,077,012
File Size (bytes)
29/71
Engines Detected
2024-11-25
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
74417c94d51962a216e1d59f47eb85cb
SHA1
64a1e23053f1953c491bd2f2f7c69bc6a8835d07
SHA256
fe6ee17afc0a040bae15126c5191bf19b0dd6117cb74b3943465bc2d90a97974
SHA512
5637e083126e35444cb4ed3bde1205e9644209be55d5f9a3004d8c50e03e59cf177cafc9871b5a77f14971ff1aabec9a8d957ece64458a575e21489089dcd27a
ImpHash
f0486e7e054aa57188c99b0f71783b75

Security Engines with Detections (29 of 71)

Bkav
W64.AIDetectMalware Malicious
Lionic
Trojan.Win32.Hydra.4!c Malicious
Elastic
malicious (moderate confidence) Malicious
CTX
exe.trojan.generic Malicious
Skyhigh
Artemis Malicious
ALYac
GT:JS.Hydra.1.AC90CD81 Malicious
Alibaba
Trojan:JS/FormBook.f388922f Malicious
Symantec
ML.Attribute.HighConfidence Malicious
ESET-NOD32
JS/Spy.Agent.JE Malicious
Paloalto
generic.ml Malicious
GData
GT:JS.Hydra.1.AC90CD81 Malicious
BitDefender
GT:JS.Hydra.1.AC90CD81 Malicious
Avast
Win64:Evo-gen [Trj] Malicious
F-Secure
Malware.JS/Spy.Agent.fvtyq Malicious
VIPRE
GT:JS.Hydra.1.AC90CD81 Malicious
McAfeeD
ti!FE6EE17AFC0A Malicious
Emsisoft
GT:JS.Hydra.1.AC90CD81 (B) Malicious
Ikarus
Trojan-Spy.Win32.FormBook Malicious
FireEye
GT:JS.Hydra.1.AC90CD81 Malicious
Google
Detected Malicious
Avira
JS/Spy.Agent.fvtyq Malicious
Varist
W64/ABRisk.PAUS-6006 Malicious
Arcabit
GT:JS.Hydra.1.AC90CD81 Malicious
Microsoft
Trojan:Win32/Wacatac.B!ml Malicious
Cynet
Malicious (score: 99) Malicious
Rising
Spyware.Agent/JS!8.12721 (CLOUD) Malicious
Fortinet
W64/Agent.JE!tr.spy Malicious
AVG
Win64:Evo-gen [Trj] Malicious
DeepInstinct
MALICIOUS Malicious
42 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: ee0dd0f2e0cf22fec4cf28a86669b2e4
Fuzzy: 827c1485f47b7a72e6aafb605c382f83
dHash: 60866971d4cc136c
Image Base 0x140000000
Entry Point 0x141005168
Compilation Time 2022-07-08 23:37:58
Checksum 0x00000000 (Actual: 0x02546751)
OS Version 6.0
PEiD Signatures PE32+ executable (console) x86-64, for MS Windows
PDB Path C:\Users\runneradmin\AppData\Local\Temp\pkg.3fcc969acc52617e676dcbbb\node\out\Release\node.pdb
Digital Signature No valid SignedData structure was found.
Imports 11 libraries
Exports 17431 functions
Resources 4 Resources
Sections 7 Sections

Version Information

▼
CompanyName skin changer
FileVersion 0.0.0.0
ProductName staff besting
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 17,106,176 bytes 17,106,432 bytes 6.46 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 863B3E65B5E99A806D37652DC619DF4C
.rdata 0x01052000 13,121,940 bytes 13,122,048 bytes 6.21 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 842DD30DB1058EA184AD42F5FD41775F
.data 0x01cd6000 2,951,404 bytes 154,624 bytes 3.73 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE EB8C812A71371D42E1B1371655BE37EB
.pdata 0x01fa7000 816,108 bytes 816,128 bytes 6.73 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 51178E1D278705576EAA498B00B1FD14
_RDATA 0x0206f000 244 bytes 512 bytes 2.45 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ B7311F08D480434D5674E272BBEDB947
.rsrc 0x02070000 39,596 bytes 142,336 bytes 4.33 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ EF67528CC8089994F3758462F55893FD
.reloc 0x0207a000 106,352 bytes 106,496 bytes 5.49 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 4CA6B516BBD00CFFA85C956EB4FDA9A2
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 4 (39,286 bytes)
Resource Type Count Total Size Percentage
RT_ICON 1 38,056 bytes
96.9%
RT_GROUP_ICON 1 20 bytes
0.1%
RT_VERSION 1 388 bytes
1%
RT_MANIFEST 1 822 bytes
2.1%

Certificate Chain Analysis

▼
Certificate Information
Product staff besting
File Version 0.0.0.0

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
29 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware