PDFSuite20 exe PUP dd!c 文件恶意软件分析: 0d6c5a7e6278b95959ba1477c5a06768

PDFSuite20.exe PUP dd!c 分析

更新于 2 years ago

检查者 Malware Check

PDFSuite20.exe

哈希类型	值	操作
MD5	0d6c5a7e6278b95959ba1477c5a06768
SHA1	7d113c5f6bf22c15e17530008581211e8d87d70d
SHA256	48b43f9e1308ed0494e2dd787ebdd49e82df42a453db99df8e0a53f03d024f60
SHA512	073451b348308078a208751ddf7a322585b28fe6d1b053a7c674843eacaff30a26b26a000c8d0156110c95703edbe84af84955e485821ed9096c2aec25766657
ImpHash	14e5f654a2f824adb344ab4d99b3b57e

哈希类型

值

操作

MD5

0d6c5a7e6278b95959ba1477c5a06768

SHA1

7d113c5f6bf22c15e17530008581211e8d87d70d

SHA256

48b43f9e1308ed0494e2dd787ebdd49e82df42a453db99df8e0a53f03d024f60

SHA512

073451b348308078a208751ddf7a322585b28fe6d1b053a7c674843eacaff30a26b26a000c8d0156110c95703edbe84af84955e485821ed9096c2aec25766657

ImpHash

14e5f654a2f824adb344ab4d99b3b57e

PE 分析

基本信息

▼

图标	哈希: 4f76226c273711adcad863215fd5146c 模糊: b072b2f279011ad36487bb03c55aee6f dHash: 0024d4e8f49a8480
映像基址	`0x00400000`
入口点	`0x00b67212`
编译时间	2023-07-07 13:29:24
校验和	0x00e5ccb5 (实际: 0x00e54474)
操作系统版本	5.1
PEiD 签名	未检测到签名
PDB 路径	`E:\TemporaryBuilds\azure-installer-pool-de-1\15\s\Installer\_bin\suite\Win32\PDFSuite20.pdb`
数字签名	OK
导入	7 库 msi, KERNEL32, WINSPOOL, USERENV, gdiplus, UxTheme, USP10
导出	163 函数
资源	141 资源
节	5 节

数字签名

▼

Entrust Root Certification Authority - G2	Entrust, Inc. (US)
Entrust Root Certification Authority - G2	Entrust, Inc. (US)
Entrust Code Signing Root Certification Authority - CSBR1	Entrust, Inc. (US)
Entrust Extended Validation Code Signing CA - EVCS2	Avanquest Software (7270356 Canada Inc) (CA)

版本信息

▼

FileVersion	20.0.5.2954
ProductVersion	20.0.5.2954
CompanyName	Avanquest Software
FileDescription	PDF Suite 20 Installer
InternalName	PDFSuite20.exe
LegalCopyright	Â© 2007-2023 Avanquest Software (7270356 Canada Inc.). All rights reserved.
OriginalFilename	PDFSuite20.exe
ProductName	PDF Suite 20 Installer
CommitID	c692fb773bc7489556def422eb965141bc3a49a0
Translation	0x0409 0x04e4
FileVersion	20.0.5.2954
ProductVersion	20.0.5.2954
CompanyName	Avanquest Software
FileDescription	PDF Suite 20 Installer
InternalName	PDFSuite20.exe
LegalCopyright	Â© 2007-2023 Avanquest Software (7270356 Canada Inc.). All rights reserved.
OriginalFilename	PDFSuite20.exe
ProductName	PDF Suite 20 Installer
CommitID	c692fb773bc7489556def422eb965141bc3a49a0
Translation	0x0409 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	9,064,113 bytes	9,064,448 bytes	6.58 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`91C4559B2336CFBCEF8E8771289CECC3`
`.rdata`	`0x008a6000`	1,808,156 bytes	1,808,384 bytes	5.28 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4D0DC4CA85B577CD16947E6E85F4B6D9`
`.data`	`0x00a60000`	450,500 bytes	386,560 bytes	5.35 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`51F48EA207509E503901695286B48953`
`.rsrc`	`0x00ace000`	3,184,764 bytes	3,185,152 bytes	7.06 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`39DCA009BD3C4819CAD3B5FE89E1A068`
`.reloc`	`0x00dd8000`	538,832 bytes	539,136 bytes	6.56 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`6A48A7E59AEB0ADD716C25301700F1D2`

熵分析警报

3 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 141 (3,171,310 字节)

资源类型	数量	总大小	百分比
DLL	1	983,608 字节	31%
DOWNLOAD	1	257 字节	0%
REGISTRY	2	440 字节	0%
SETTINGS	4	9,529 字节	0.3%
TYPELIB	1	2,428 字节	0.1%
UI-DATA	123	2,154,585 字节	67.9%
RT_ICON	4	17,472 字节	0.6%
RT_STRING	1	64 字节	0%
RT_GROUP_ICON	1	62 字节	0%
RT_VERSION	2	2,032 字节	0.1%
RT_MANIFEST	1	833 字节	0%

证书链分析

▼

证书 #1

主题	Entrust Root Certification Authority - G2 Entrust, Inc. US
颁发者	Entrust Root Certification Authority - G2
序列号	`1246989352`

证书 #2

主题	Entrust Code Signing Root Certification Authority - CSBR1 Entrust, Inc. US
颁发者	Entrust Root Certification Authority - G2
序列号	`104016719443392582891195013311543612543`

证书 #3

主题	Entrust Extended Validation Code Signing CA - EVCS2 Entrust, Inc. US
颁发者	Entrust Code Signing Root Certification Authority - CSBR1
序列号	`71361457201517752660581604742734624043`

证书 #4

主题	Avanquest Software (7270356 Canada Inc) Avanquest Software (7270356 Canada Inc) CA
颁发者	Entrust Extended Validation Code Signing CA - EVCS2
序列号	`86567264048968947235244180863179642758`

证书验证状态

发表评论

文件名	PDFSuite20.exe
扫描器版本	1.0.136.174
数据库版本	2023-09-09 03:55:42 UTC

PDFSuite20.exe PUP dd!c 分析

技术分析

PUP.Avanquest.dd!c

扫描另一个文件

文件识别