GridinSoft Threat Intelligence

r2win.exe threat report

Detected as Trojan.Generic File reputation report
MD5 a020c2c9a4a4b18d013d793b5906b9da
Latest seen 2023-05-12 23:25:40 (3 years ago)
First seen 2023-05-12 23:19:42 (3 years ago)
Size 2 MB
Publisher WRQ, Inc.
Product Reflection for UNIX and Digital

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Trojan.Generic. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Trojan.Generic
Recommended action
Scan and remove
Last analysis
2023-05-12 23:25:40 (3 years ago)
File hash
a020c2c9a4a4b18d013d793b5906b9da
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Trojan.Generic, part of the Trojan threat category.

Category context

Malware disguised as legitimate software or delivered through deceptive packaging. Related Trojan reports help compare this file with nearby detections, publishers, and hashes.

Timeline

First seen 2023-05-12 23:19:42 (3 years ago); latest analysis 2023-05-12 23:25:40 (3 years ago).

Publisher context

Company metadata: WRQ, Inc.. Product metadata: Reflection for UNIX and Digital.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present. Review the Trojan category for related samples and common context.

File context

r2win.exe is a Windows file recorded in the ThreatInfo database. It is associated with Reflection for UNIX and Digital. The reported company name is WRQ, Inc.. The current detection status is Trojan.Generic, based on the latest analysis from 2023-05-12 23:25:40 (3 years ago). ThreatInfo groups this verdict with Trojan reports for broader family-level investigation.

If r2win.exe appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Trojan.Generic.

File Details

Product Name: Reflection for UNIX and Digital
Company Name: WRQ, Inc.
MD5: a020c2c9a4a4b18d013d793b5906b9da
Size: 2 MB
First Published: 2023-05-12 23:19:42 (3 years ago)
Latest Published: 2023-05-12 23:25:40 (3 years ago)
Status: Trojan.Generic (on last analysis)
Analysis Date: 2023-05-12 23:25:40 (3 years ago)

Detection screenshot

r2win.exe detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Common Places:

%sysdrive%\bss\bts_program_old\reflexionx_80\products\programf
%sysdrive%\bss\bts_program\reflexionx_80\products\programf

ThreatInfo has observed r2win.exe in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

Geographic signal

Observed country distribution

ThreatInfo has seen r2win.exe across 1 countries. Use this signal to compare local evidence with where the sample is most often reported.

Top country Iran, Islamic Republic of
Share 100.0%
Low High activity

The strongest geographic signal for this file is Iran, Islamic Republic of with 100.0% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

OS Version:

Windows 7 100.0%

The most common operating system signal for r2win.exe is Windows 7 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

Analysis

r2win.exe is identified as pe for 32-bit systems. The subsystem is Windows GUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Format pe
Architecture 32-bit
Subsystem Windows GUI
Entry point 0x0014b768
Image base 0x00400000

PE Sections:

Sections 36
Raw data 2347008

Section layout highlights raw-size concentration, repeated names, packer markers, and hashes that can be compared across related samples.

_init 69632 bytes · 3.0% of section data
Uncommon name
MD5 5d6c4eed9b3a6f6946f15284e39960a2
_settngs 53248 bytes · 2.3% of section data
Uncommon name
MD5 966aa2069086873519c0898bf0a6aa79
_modes 16384 bytes · 0.7% of section data
Uncommon name
MD5 240be806c350bf5b6124395ba33cc8a2
_run 28672 bytes · 1.2% of section data
Uncommon name
MD5 22f59cba1766842a65adcb1fbdfa851a
_wndproc 20480 bytes · 0.9% of section data
Uncommon name
MD5 7e60827de9daa7888f4c7c48553e2300
_oldrun 16384 bytes · 0.7% of section data
Uncommon name
MD5 b538eec93a3d05fcce676af338c77a55
_paint 16384 bytes · 0.7% of section data
Uncommon name
MD5 2d2fc1d2fd5e871bf6b25d5fa586e7a5
_size 8192 bytes · 0.3% of section data
Uncommon name
MD5 8d889b43ddd2d900a5aafcdd86e01377
_late 4096 bytes · 0.2% of section data
Uncommon name
MD5 bea2d5028078914dcef86513f399f6f5
_setup 24576 bytes · 1.0% of section data
Uncommon name
MD5 507b8267f1317a90a86dadac925005fc
_rcl 61440 bytes · 2.6% of section data
Uncommon name
MD5 982be679ab4847d3ce7b25a36a485a1c
_rb 4096 bytes · 0.2% of section data
Uncommon name
MD5 222ea7df2452e8193062073edeaa31f4
_api 139264 bytes · 5.9% of section data
Uncommon name
MD5 f67ba948aa7a868b2e3faf30fc0c7b5a
_ole 16384 bytes · 0.7% of section data
Uncommon name
MD5 9ea7750bce30af012b10c9bbfe4f8a51
_docobj 24576 bytes · 1.0% of section data
Uncommon name
MD5 d136efdcb94f88883668800919703e0a
_menuodd 4096 bytes · 0.2% of section data
Uncommon name
MD5 7d4ebe44ff1978928d949403cb4ad30d
.text 847872 bytes · 36.1% of section data
MD5 714c6e9a114eab8f898444cc2f876475
initbuil 4096 bytes · 0.2% of section data
Uncommon name
MD5 e52ad3f5acdfd2b9d3e031cb2e9a8653
_run2 4096 bytes · 0.2% of section data
Uncommon name
MD5 b88f894ad1c722dbd2313e9aaf0dfb33
_initdra 4096 bytes · 0.2% of section data
Uncommon name
MD5 b2404c0253a6fa1322effd8b57c8a884
_t27 28672 bytes · 1.2% of section data
Uncommon name
MD5 02c0c4bf4857c20b9033f7b1e45256c6
_t27plus 4096 bytes · 0.2% of section data
Uncommon name
MD5 9ce75592685b5fb427862034cc898351
initeven 4096 bytes · 0.2% of section data
Uncommon name
MD5 0d4becc8c7f24e8a23febfd53e2c24ea
_initmac 4096 bytes · 0.2% of section data
Uncommon name
MD5 1bd34944c5941c91a8656485fbc43441
_rbinit 4096 bytes · 0.2% of section data
Uncommon name
MD5 1686c15c46b3e21adc659810cfce444a
_rwinmai 4096 bytes · 0.2% of section data
Uncommon name
MD5 08a55f49cd3291786d4122d6f501fac0
_rwinini 4096 bytes · 0.2% of section data
Uncommon name
MD5 092d99d9bd793a40724818bdcc731e71
_initset 4096 bytes · 0.2% of section data
Uncommon name
MD5 118f5f313f7300aa99636e2c0fa18d25
_fontsta 4096 bytes · 0.2% of section data
Uncommon name
MD5 710754535cc54672e24b1b1a07a27160
_startup 8192 bytes · 0.3% of section data
Uncommon name
MD5 3da72d0797751db7b00e561ff1e4bc6a
_load 4096 bytes · 0.2% of section data
Uncommon name
MD5 879fa3c17c09b2f9cd1e78e2df6c4940
_morphme 4096 bytes · 0.2% of section data
Uncommon name
MD5 fa223fa8e62f27044836fcfa41d3c504
makeAspl 4096 bytes · 0.2% of section data
Uncommon name
MD5 228bee8ea3aec84e4ef7cf9463686016
.rdata 53248 bytes · 2.3% of section data
MD5 ff34d57a15c4218d745a183c9b5d90d7
.data 167936 bytes · 7.2% of section data
MD5 92529ca230e485c5fe3e9c1e2e28ccef
.rsrc 675840 bytes · 28.8% of section data
MD5 cce1d9cace1f2c98b165cc7e4022ad1f

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

Report conclusion

GridinSoft detects this file as Trojan.Generic

This report identifies r2win.exe by MD5 a020c2c9a4a4b18d013d793b5906b9da. It is part of the Trojan report group. If the same file is present on your device, scan the system and remove the detected object after confirming the hash and location.

Download GridinSoft Anti-Malware Scan the device and confirm whether this exact hash is present. Check this hash on VirusTotal

Recommended next steps

  • Compare the local file MD5 with a020c2c9a4a4b18d013d793b5906b9da.
  • Check the file path, publisher, and signature against the details in this report.
  • Run a GridinSoft scan and remove the object if the same hash is found. Use the Trojan category to compare similar reports.