Anno1800.exe threat report

MD5 a921b272a561917cea2f0890daafc003
Latest seen 2021-03-18 21:40:47 (5 years ago)
First seen 2021-03-18 21:40:47 (5 years ago)
Size 346 MB
Publisher Ubisoft
Product Anno 1800

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Heur!. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Heur!
Recommended action
Scan and remove
Last analysis
2021-03-18 21:40:47 (5 years ago)
File hash
a921b272a561917cea2f0890daafc003
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Heur!.

Timeline

First seen 2021-03-18 21:40:47 (5 years ago); latest analysis 2021-03-18 21:40:47 (5 years ago).

Publisher context

Company metadata: Ubisoft. Product metadata: Anno 1800.

Digital signature

Signed by Ubisoft Blue Byte GmbH. The signature is not reported as trusted and valid, which can indicate tampering, repackaging, or copied publisher data.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

Anno1800.exe is a Windows file recorded in the ThreatInfo database. It is associated with Anno 1800. The reported company name is Ubisoft. The current detection status is Trojan.Heur!, based on the latest analysis from 2021-03-18 21:40:47 (5 years ago).

If Anno1800.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Heur!.

Product Name: Anno 1800
Company Name: Ubisoft
MD5: a921b272a561917cea2f0890daafc003
Size: 346 MB
First Published: 2021-03-18 21:40:47 (5 years ago)
Latest Published: 2021-03-18 21:40:47 (5 years ago)
Status: Trojan.Heur! (on last analysis)
Analysis Date: 2021-03-18 21:40:47 (5 years ago)
Anno1800.exe detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Signed By: Ubisoft Blue Byte GmbH
Status: Invalid (digital signature could be stolen or file could be patched)

The signature on Anno1800.exe is not reported as trusted and valid. Invalid or suspicious signature data can indicate tampering, repackaging, or an unrelated file using copied publisher information.

%sysdrive%\games\anno 1800\bin

ThreatInfo has observed Anno1800.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

100.0%

The strongest geographic signal for this file is United Kingdom with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for Anno1800.exe is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Anno1800.exe is identified as pe for 64 systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows GUI
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000140000000
Entry Address: 0x156aa4a7

PE Sections:

Name Size of data MD5
.data1 60037632 c9d511a509f8a4a94f292258afb3b820
.xdata 14117888 63c39fb63d24b02f95ce1e1912f2ad8a
.tls 3358208 ae15374fc205007da5f64f0e746679a6
.pdata 2480128 b54aebc4c347ed1e0a3ea29436a536de
.reloc 149504 3370dfc4b44d69c2751a658928809556
.rdata 8704 ee606e15ed1aa0233fc012ee38119982
.xpdata 512 edda25907019e5cc74c177f6952e5e4b
.data 264462848 32b0776a80a41150cb3614a496f25608
.xtext 3584 5c8cb8334bef7d6af0ed6c4adda912e3
.sbss 512 d63ab43b5954fb3efbc53c302e9bbe7c
.bss 512 66000b461906d0b92838769144e1efad
.code 1024 dfa45317479e6af319a5daa7126fbdbd
.idata 11264 40f7f7461c4efb6da4b4d604f9bf2c3d
.sdata 3584 6b773b302c14dd60314080c30a2d55be
.text 4096 46919a7564f3899e096da0638189dace
.arch 512 876120d770a85a6f7e32843ef4e21a94
.trace 55296 faa9bbc8ce7225a1c24f1995047da5b3
.vmp0 1661440 bc9fdfe2fd20fa2e3a4791f1209ded75
.vmp1 15035904 e54836c5ae04978bceeeee252bb7a39f
.srdata 2271232 8bfc86c044f9b13d5f0a75fcfaa3629e
.rsrc 38400 8e4c5ba146239f2b2dac33c83832b602

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: