EllipticHPDDaemon exe (Elliptic Human Presence Detection Daemon) 文件恶意软件分析

EllipticHPDDaemon.exe (Elliptic Human Presence Detection Daemon) 文件分析

更新于 1 year ago

检查者 Malware Check

EllipticHPDDaemon.exe

哈希类型	值	操作
MD5	7ca55cdf48560640ab271f791dc8d10e
SHA1	07edaff81b731568ddc4a48f2c083bfe48aa4c49
SHA256	76dc5c67ebd2d6a2a634a3e64a3d91875ab30b8e5db0c3f01a6ad65ef8b14b86
SHA512	3f76a1194047c3a96864b8a5a0a3dfc8da09e85c9f8ac988dabf60e064813a1714537179986bbea6eba27351c8ddc55c8a12907a465d7b1298c01c6622fa6009
ImpHash	f195a6dcb0c47e8b9681a76dab00e6c6

哈希类型

值

操作

MD5

7ca55cdf48560640ab271f791dc8d10e

SHA1

07edaff81b731568ddc4a48f2c083bfe48aa4c49

SHA256

76dc5c67ebd2d6a2a634a3e64a3d91875ab30b8e5db0c3f01a6ad65ef8b14b86

SHA512

3f76a1194047c3a96864b8a5a0a3dfc8da09e85c9f8ac988dabf60e064813a1714537179986bbea6eba27351c8ddc55c8a12907a465d7b1298c01c6622fa6009

ImpHash

f195a6dcb0c47e8b9681a76dab00e6c6

PE 分析

基本信息

▼

映像基址	`0x140000000`
入口点	`0x1400843b0`
编译时间	2023-06-16 14:11:50
校验和	0x000db924 (实际: 0x000db924)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (console) x86-64, for MS Windows`
PDB 路径	`F:\agent1\_work\38\s\Elliptic.HPD.UMDFv2\Elliptic.Service.HPD\target\release\deps\EllipticHPDDaemon.pdb`
数字签名	OK
导入	5 库 KERNEL32, USER32, api-ms-win-core-apiquery-l2-1-0, oleaut32, bcrypt
导出	0 函数
资源	1 资源
节	7 节

数字签名

▼

SSL.com EV Code Signing Intermediate CA RSA R3	Elliptic Laboratories ASA (NO)
SSL.com EV Root Certification Authority RSA R2	SSL Corp (US)

版本信息

▼

ProductVersion	1.0.50616
FileVersion	1.0.50616
LegalCopyright	Copyright © 2023 Elliptic Laboratories ASA
FileDescription	Elliptic Human Presence Detection Daemon
ProductName	Elliptic Laboratories SDK
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	617,504 bytes	617,984 bytes	6.32 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`F421F6A3876EFAD30A54590672CB6A14`
`.rdata`	`0x00098000`	179,882 bytes	180,224 bytes	5.54 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`ADF5FEA501722998ABABFCBFC4D429E5`
`.data`	`0x000c4000`	7,864 bytes	3,072 bytes	2.14 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3CAEFBEAFA4E637F63B2D016E29A6EE7`
`.pdata`	`0x000c6000`	28,308 bytes	28,672 bytes	5.92 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`998DD12FD9A68BD21DFB5FC44FE31850`
`_RDATA`	`0x000cd000`	244 bytes	512 bytes	2.48 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E5C60E73B48186DA4B8A2FA53B53DE9D`
`.rsrc`	`0x000ce000`	760 bytes	1,024 bytes	2.59 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1F6D256C22B4CE451910B58ECD99B02C`
`.reloc`	`0x000cf000`	3,836 bytes	4,096 bytes	5.33 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`4AD95541D726D53EF425CEE565CF6A8F`

资源分析

▼

资源总数: 1 (660 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	660 字节	100%

证书链分析

▼

证书 #1

主题	Elliptic Laboratories ASA Elliptic Laboratories ASA NO
颁发者	SSL.com EV Code Signing Intermediate CA RSA R3
序列号	`21331744794556071788615045803349277350`

证书 #2

主题	SSL.com EV Code Signing Intermediate CA RSA R3 SSL Corp US
颁发者	SSL.com EV Root Certification Authority RSA R2
序列号	`88120626561545005758442085613766983940`

证书验证状态

发表评论

文件名	EllipticHPDDaemon.exe
文件类型	PE32+ executable (console) x86-64, for MS Windows
扫描器版本	1.0.142.174
数据库版本	2023-10-07 07:01:52 UTC

EllipticHPDDaemon.exe (Elliptic Human Presence Detection Daemon) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别