StataMP 64 exe Trojan Heuristic 文件恶意软件分析: 5a8a170a641626ee1181aeebecacd7ec

哈希类型	值	操作
MD5	5a8a170a641626ee1181aeebecacd7ec
SHA1	4f131d2af2b681ba5e28f220629d5b8184009261
SHA256	4b88173493e1f20ca5713057f428292e3fa0c3aa7c8f789fdc2aee6890676938
SHA512	6a602d8063211b415dc1e09d2c1a3c5a273afddf765caf31330aa7031c5b2c37d52b4f81ebfafecc8afc58301b90ca1603de07800ade8f027d72022d9c304b6d
ImpHash	e10a977d126718d1e0fc9d8f19a678b9

基本信息

▼

图标	哈希: d3d53dd6bde54d338927541a2a2108d6 模糊: c8bba836f435a4f5ddd6ee9daa18b1ad dHash: d2d2d3d4d4b4b494
映像基址	`0x140000000`
入口点	`0x1472c1058`
编译时间	2023-06-02 14:11:23
校验和	0x05613b38 (实际: 0x05613b38)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
数字签名	The PE file does not contain a certificate table.
导入	24 库
导出	0 函数
资源	2061 资源
节	13 节

版本信息

▼

CompanyName	StataCorp LLC
FileDescription	Stata
FileVersion	521,18,0,120
InternalName	StataMP-64
LegalCopyright	Copyright (C) 2023 StataCorp LLC. All rights reserved.
OriginalFilename	StataMP-64
PrivateBuild	120
ProductName	Stata
ProductVersion	521.18.0.120
Translation	0x0409 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	57,703,432 bytes	57,703,936 bytes	6.69 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`921ECFCF4EDBF4205A4F30EC9CB60F0E`
`.rdata`	`0x03709000`	7,817,666 bytes	7,817,728 bytes	5.66 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`965B71ADE022E833296303001B318303`
`.data`	`0x03e7e000`	26,599,168 bytes	1,074,688 bytes	3.72 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D3A4A14BC288BACD48791B166E478887`
`.pdata`	`0x057dc000`	1,618,692 bytes	1,618,944 bytes	7.06 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9939CDFE52765CAF9CF52786FAE9700B`
`.itt_not`	`0x05968000`	42,571 bytes	43,008 bytes	3.92 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`49D7BE8D0B0CF4B9DA198FA750B1140A`
`_RDATA`	`0x05973000`	560 bytes	1,024 bytes	2.43 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7B0D1655BB58BD1D6DB9DB9E82BBCC2C`
`.rsrc`	`0x05974000`	14,871,152 bytes	14,871,552 bytes	3.28 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`959064A5E9BA96F51B96D254363D1654`
`.reloc`	`0x067a3000`	379,692 bytes	379,904 bytes	5.49 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`F008CCDBE066C5AD840413501BEF9BCE`
`.idata`	`0x06800000`	4,096 bytes	2,048 bytes	3.24 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`DE2B8C9C0A78E3A166A5B1179587E9E3`
`.tls`	`0x06801000`	8,192 bytes	5,632 bytes	0.04 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`72C0ECEC424C307B2690371E90405642`
`.winlice`	`0x06803000`	11,264,000 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.boot`	`0x072c1000`	6,722,560 bytes	6,722,560 bytes	7.89 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`845E17A008B87B183D49A24665FC4DF5`
`.reloc`	`0x0792b000`	4,096 bytes	16 bytes	2.73 (正常)	`IMAGE_SCN_MEM_READ`	`681D816BB920CFB644EDD414E3A73C4D`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 2061 (14,765,827 字节)

资源类型	数量	总大小	百分比
AFX_DIALOG_LAYOUT	13	26 字节	0%
AVI	1	5,632 字节	0%
PNG	38	123,553 字节	0.8%
REGISTRY	2	735 字节	0%
RT_XAML	71	46,125 字节	0.3%
STYLE	1	41,377 字节	0.3%
TYPELIB	1	12,404 字节	0.1%
RT_CURSOR	48	18,088 字节	0.1%
RT_BITMAP	154	4,951,348 字节	33.5%
RT_ICON	1176	9,385,442 字节	63.6%
RT_MENU	19	4,198 字节	0%
RT_DIALOG	99	72,908 字节	0.5%
RT_STRING	96	35,896 字节	0.2%
RT_FONTDIR	1	154 字节	0%
RT_FONT	1	4,424 字节	0%
RT_ACCELERATOR	8	1,608 字节	0%
RT_GROUP_CURSOR	44	936 字节	0%
RT_GROUP_ICON	163	17,442 字节	0.1%
RT_VERSION	1	808 字节	0%
RT_HTML	70	40,025 字节	0.3%
RT_MANIFEST	1	1,672 字节	0%
None	53	1,026 字节	0%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

The PE file does not contain a certificate table.

建议: 验证文件来源并确保它来自可信的发布者.

文件名	StataMP-64.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.170.174
数据库版本	2024-04-01 14:00:31 UTC

StataMP-64.exe Trojan Heuristic 分析

技术分析

Trojan.Heur!.03210023

扫描另一个文件

文件识别

PE 分析