PrecisionHelper exe (Help projects manager and editor) Precision software & consulting 文件恶意软件分析

PrecisionHelper.exe (Help projects manager and editor) 文件分析

更新于 2 months ago

检查者 Malaware Check

PrecisionHelper.exe

哈希类型	值	操作
MD5	fbc718008ea30d673c91a36fcbc850d6
SHA1	39ec5424aebf3c5a1c07fdf2fd167f85dfbc8166
SHA256	319aadaa1cc2cabe60771690a0c626c919cd2c3a9d891bacb38cb07245214aad
SHA512	29dc39c3132a97fb1ce272857ee4292999f4a18d1080878d2a7a43c4d5f6ab13656d85fa1d1503104351d92e9df250827684a63e0e7079fa28b3daf9b354e75c
ImpHash	57148cd7ad9525df06081ef98da82a17

哈希类型

值

操作

MD5

fbc718008ea30d673c91a36fcbc850d6

SHA1

39ec5424aebf3c5a1c07fdf2fd167f85dfbc8166

SHA256

319aadaa1cc2cabe60771690a0c626c919cd2c3a9d891bacb38cb07245214aad

SHA512

29dc39c3132a97fb1ce272857ee4292999f4a18d1080878d2a7a43c4d5f6ab13656d85fa1d1503104351d92e9df250827684a63e0e7079fa28b3daf9b354e75c

ImpHash

57148cd7ad9525df06081ef98da82a17

PE 分析

基本信息

▼

图标	哈希: 23c33bd4f4b73b865bae06a27fe0d00e 模糊: 9b606093f766f7ee56ba1ee9cbaf0436 dHash: 8cb4ecccccccc4b2
映像基址	`0x00400000`
入口点	`0x007e5544`
编译时间	2011-06-20 09:37:30
校验和	0x00000000 (实际: 0x0058a857)
操作系统版本	5.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	18 库
导出	0 函数
资源	216 资源
节	9 节

版本信息

▼

CompanyName	Precision software & consulting
FileDescription	Help projects manager and editor
FileVersion	2.0.1.7
InternalName	PRECISIONHELPER
LegalCopyright	Copyright © 2008 - 2011 Precision software & consulting
LegalTrademarks
OriginalFilename	PrecisionHelper.exe
ProductName	Precision Helper
ProductVersion	2.0.1
Comments	Product for managing and editing help project files
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	4,069,260 bytes	4,069,376 bytes	6.50 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`5CCEC5914B2885F137BCD58FFC039A65`
`.itext`	`0x003e3000`	10,628 bytes	10,752 bytes	6.19 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`706D47FEC255E40EAC2D0F68A51B0D7D`
`.data`	`0x003e6000`	168,636 bytes	168,960 bytes	7.45 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B53988E2B85F56CB311217A40CE86606`
`.bss`	`0x00410000`	24,304 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00416000`	20,222 bytes	20,480 bytes	5.22 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8DCA4D112A21C596A753A50512F6360D`
`.tls`	`0x0041b000`	72 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x0041c000`	24 bytes	512 bytes	0.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2F40C91EDEDF7D1DE46E43B6B30D3451`
`.reloc`	`0x0041d000`	213,060 bytes	213,504 bytes	6.69 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`CC07A61A574FF71D39B8432F160C9369`
`.rsrc`	`0x00452000`	1,305,600 bytes	1,305,600 bytes	6.72 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`DFC3AE1EA578CAD39D2E6145A73B2ECF`

熵分析警报

4 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 216 (1,291,224 字节)

资源类型	数量	总大小	百分比
RT_CURSOR	20	10,560 字节	0.8%
RT_BITMAP	93	90,242 字节	7%
RT_ICON	14	46,256 字节	3.6%
RT_DIALOG	2	164 字节	0%
RT_STRING	39	33,516 字节	2.6%
RT_RCDATA	24	1,107,972 字节	85.8%
RT_GROUP_CURSOR	20	400 字节	0%
RT_GROUP_ICON	2	208 字节	0%
RT_VERSION	1	1,056 字节	0.1%
RT_MANIFEST	1	850 字节	0.1%

证书链分析

▼

证书 Information

产品	Precision Helper
描述	Help projects manager and editor
文件版本	2.0.1.7
原始名称	PrecisionHelper.exe
内部名称	PRECISIONHELPER
版权	Copyright © 2008 - 2011 Precision software & consulting

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	PrecisionHelper.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.212.174
数据库版本	2025-04-08 17:00:54 UTC

PrecisionHelper.exe (Help projects manager and editor) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别