Sistematizador exe Trojan Heuristic 文件恶意软件分析: 7fe7fa608524ded4c311884876a3306d

Sistematizador.exe Trojan Heuristic 分析

更新于 1 month ago

检查者 Malware Check

sistematizador.exe

哈希类型	值	操作
MD5	7fe7fa608524ded4c311884876a3306d
SHA1	7f7e501567ef2289d5932326214094388210477b
SHA256	1ed3d5841f7f1347fc0f8d921a8f8cfc624454a5420a8414d898a911631a4455
SHA512	c77204990f8ba099b42a8afcd014dafe114bd1044a6e73385398e87c50432b2d55cb4d6d51c1ebfcfd4e1a807d41e1414f919f83f5edd8338fc07263ae651bef
ImpHash	c469eea0ab12273adac8ed2780924fa9

哈希类型

值

操作

MD5

7fe7fa608524ded4c311884876a3306d

SHA1

7f7e501567ef2289d5932326214094388210477b

SHA256

1ed3d5841f7f1347fc0f8d921a8f8cfc624454a5420a8414d898a911631a4455

SHA512

c77204990f8ba099b42a8afcd014dafe114bd1044a6e73385398e87c50432b2d55cb4d6d51c1ebfcfd4e1a807d41e1414f919f83f5edd8338fc07263ae651bef

ImpHash

c469eea0ab12273adac8ed2780924fa9

PE 分析

基本信息

▼

图标	哈希: 7fede58046b0853a0bccc97e338cc0cc 模糊: 4003e153fb3b3a47da08950b49c35354 dHash: 9433d48eaa96ccb2
映像基址	`0x140000000`
入口点	`0x1400014b0`
编译时间	2025-11-12 02:34:59
校验和	0x02f433d6 (实际: 0x02f438d7)
操作系统版本	4.0
PEiD 签名	`PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows`
数字签名	No valid SignedData structure was found.
导入	28 库
导出	0 函数
资源	12 资源
节	12 节

版本信息

▼

CompanyName	sistematizador
FileDescription	sistematizador
FileVersion	0.1.0
ProductName	sistematizador
ProductVersion	0.1.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	27,511,256 bytes	27,511,296 bytes	6.31 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`13596E0CE0BA85394689E0D8212861D4`
`.data`	`0x01a3e000`	47,072 bytes	47,104 bytes	3.36 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`733B6F30ACD9813A55E7A5374175E2D0`
`.taubndl`	`0x01a4a000`	16 bytes	512 bytes	0.12 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BDAED56F5825FA58AB2F73CE6FF24C2A`
`.rdata`	`0x01a4b000`	5,960,776 bytes	5,961,216 bytes	5.96 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6E46E94B778393A469CFD7016C36FBB2`
`.pdata`	`0x01ffb000`	609,624 bytes	609,792 bytes	6.96 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4A25D862223449B9410B07EFAC8A71E7`
`.xdata`	`0x02090000`	2,118,632 bytes	2,118,656 bytes	5.78 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C22652378A4B94EBDEE22726EF8A5540`
`.bss`	`0x02296000`	9,568 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x02299000`	21,776 bytes	22,016 bytes	5.01 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`9309C7827FF0B21D8E896D653989C9C1`
`.CRT`	`0x0229f000`	120 bytes	512 bytes	0.59 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`65CFA9394F3E62D9DC329E3DF77CD728`
`.tls`	`0x022a0000`	16 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x022a1000`	219,728 bytes	220,160 bytes	6.83 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`0578B2E3F160DEDFFEDEBFDF011FD723`
`.reloc`	`0x022d7000`	142,500 bytes	142,848 bytes	5.49 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`60395A81877DD85800009CB6CF4E098A`

熵分析警报

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 12 (219,027 字节)

资源类型	数量	总大小	百分比
RT_ICON	9	218,049 字节	99.6%
RT_GROUP_ICON	1	132 字节	0.1%
RT_VERSION	1	512 字节	0.2%
RT_MANIFEST	1	334 字节	0.2%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	sistematizador.exe
文件类型	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
扫描器版本	1.0.229.174
数据库版本	2025-11-12 04:00:17 UTC

Sistematizador.exe Trojan Heuristic 分析

技术分析

Trojan.Heur!.02206023

扫描另一个文件

文件识别