Libpvecad vs16 dll (Creo(R) View libpvecad vs16 dll) PTC Inc 文件恶意软件分析

Libpvecad_vs16.dll (Creo(R) View - libpvecad_vs16.dll) 文件分析

更新于 25 days ago

检查者 Malware Check

libpvecad_vs16.dll

哈希类型	值	操作
MD5	934ad8dd82c6adb2d3c75a6e38a10e7a
SHA1	70fca226b3a787f397087eee67c94239e8fca1a4
SHA256	6205d3c65acfdad516f11a1c7fdd6d722235b378e4035b4bd5f3f0fc7ae6f004
SHA512	3167f8fe31c736dc1a96a442e350efe0de541997674adb5cf79bed59886e46e0a28719cb22e7a3c52628a81c12654be9b4ff3f604c7987c7d37145d764870d4f
ImpHash	d60f92eefe1e7ceeb214d59d62b1879b

哈希类型

值

操作

MD5

934ad8dd82c6adb2d3c75a6e38a10e7a

SHA1

70fca226b3a787f397087eee67c94239e8fca1a4

SHA256

6205d3c65acfdad516f11a1c7fdd6d722235b378e4035b4bd5f3f0fc7ae6f004

SHA512

3167f8fe31c736dc1a96a442e350efe0de541997674adb5cf79bed59886e46e0a28719cb22e7a3c52628a81c12654be9b4ff3f604c7987c7d37145d764870d4f

ImpHash

d60f92eefe1e7ceeb214d59d62b1879b

PE 分析

基本信息

▼

映像基址	`0x180000000`
入口点	`0x1802cb954`
编译时间	2022-05-27 17:50:41
校验和	0x008f400a (实际: 0x008fab6a)
操作系统版本	5.2
PEiD 签名	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
PDB 路径	`P:\builds\pview_X90\pview_X90_F000_phase_26\build\ccsrc\viz\x86e_win64.o\x86e_win64\obj\libpvecad_vs16.pdb`
数字签名	The expected hash does not match the digest in SpcInfo
导入	52 库
导出	6 函数
资源	2 资源
节	11 节

版本信息

▼

CompanyName	PTC Inc.
FileDescription	Creo(R) View - libpvecad_vs16.dll
FileVersion	16.0.0.26
InternalName	libpvecad_vs16.dll
LegalCopyright	Copyright (C) 2000-2022 PTC Inc. All Rights Reserved
OriginalFilename	libpvecad_vs16.dll
ProductName	Creo(R) View
ProductVersion	9.0.0.0
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	6,323,964 bytes	6,324,224 bytes	6.25 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`933856ABAD43E39805B9B45FE7F41566`
`.textidx`	`0x00609000`	630,491 bytes	630,784 bytes	6.11 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`B41E838DA3D54A3AFDC5DDB66E92ADB7`
`.rdata`	`0x006a3000`	1,734,150 bytes	1,734,656 bytes	5.60 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`360B0DD65F5B714FD8D97FC885FA1AE7`
`.data`	`0x0084b000`	580,856 bytes	299,520 bytes	3.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`CC95EA45067A135C0D1C70154BB71AF5`
`.pdata`	`0x008d9000`	297,036 bytes	297,472 bytes	6.40 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`37E5624C90BBCC1F2E7C3008BA9CE8CE`
`.datapro`	`0x00922000`	20 bytes	512 bytes	0.24 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`130D6254283C5622F8E442810A8385DD`
`.fnp_dir`	`0x00923000`	120 bytes	512 bytes	0.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`68A5DA9CC6FA46A754DA45C22D7B978C`
`.fnp_mar`	`0x00924000`	1 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.tls`	`0x00925000`	9 bytes	512 bytes	0.02 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1F354D76203061BFDD5A53DAE48D5435`
`.rsrc`	`0x00926000`	1,348 bytes	1,536 bytes	4.48 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4B85B6F3760C28550A05214AA038C0E2`
`.reloc`	`0x00927000`	74,044 bytes	74,240 bytes	5.46 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`DA2A0336E8A34587E3F86E6E2D1825D7`

资源分析

▼

资源总数: 2 (1,186 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	840 字节	70.8%
RT_MANIFEST	1	346 字节	29.2%

证书链分析

▼

证书 Information

产品	Creo(R) View
描述	Creo(R) View - libpvecad_vs16.dll
文件版本	16.0.0.26
原始名称	libpvecad_vs16.dll
签名日期	09:39 AM 05/28/2022 (1324 天前)
验证状态	The digital signature of the object did not verify.
签名者	PTC Inc.; DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1; DigiCert Trusted Root G4
副签名者	DigiCert Timestamp 2022 - 2; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4
内部名称	libpvecad_vs16.dll
版权	Copyright (C) 2000-2022 PTC Inc. All Rights Reserved

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

The expected hash does not match the digest in SpcInfo

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	libpvecad_vs16.dll
文件类型	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-17 01:00:26 UTC

Libpvecad_vs16.dll (Creo(R) View - libpvecad_vs16.dll) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别