MarvelousDesigner12 Personal x64 exe Trojan CoinMiner 文件恶意软件分析: b8a9ba10aad52e79d07d95e4912be9cb

MarvelousDesigner12_Personal_x64.exe Trojan CoinMiner 分析

更新于 1 year ago

检查者 Malware Check

MarvelousDesigner12_Personal_x64.exe

哈希类型	值	操作
MD5	b8a9ba10aad52e79d07d95e4912be9cb
SHA1	593ccd25484688bf395d5dadaf19102c770d9367
SHA256	925431d9ad6dde0970110c701b45d78ba2ef5806cd56eb8b2014efc5bb73ee5b
SHA512	72147568d9cdc16430b0aae483af2ce332a647bc62915ce5761e1c110e0996a834c9bb9dbe47e99f4d43557dba6e2bce3a6498e85a1da2ea381d98d2e0b241fc
ImpHash	a589ba7bbee6e12ef05d757f0a9f4ead

哈希类型

值

操作

MD5

b8a9ba10aad52e79d07d95e4912be9cb

SHA1

593ccd25484688bf395d5dadaf19102c770d9367

SHA256

925431d9ad6dde0970110c701b45d78ba2ef5806cd56eb8b2014efc5bb73ee5b

SHA512

72147568d9cdc16430b0aae483af2ce332a647bc62915ce5761e1c110e0996a834c9bb9dbe47e99f4d43557dba6e2bce3a6498e85a1da2ea381d98d2e0b241fc

ImpHash

a589ba7bbee6e12ef05d757f0a9f4ead

PE 分析

基本信息

▼

图标	哈希: cfd8046d4ce61aa494c11f056d257c32 模糊: 6e52000f98ea8404a09e57eb6e4b6e0a dHash: 70fc6d330f2bd0f0
映像基址	`0x140000000`
入口点	`0x14d0be9c7`
编译时间	2022-12-06 07:15:59
校验和	0x028258b2 (实际: 0x028258b2)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB 路径	`C:\Users\admin\Documents\BuildAgent\work\477ea84496986ea8\Marvelous\Distribution\Release_MDX_Personal\x64\MarvelousDesigner12_Personal_x64.pdb`
数字签名	The PE file does not contain a certificate table.
导入	26 库
导出	1 函数
资源	4 资源
节	15 节

版本信息

▼

FileVersion	7, 1, 143, 41692
ProductVersion	7, 1, 143, 41692
ProductName	Marvelous Designer Personal
LegalCopyright	Copyright 2022 CLO Virtual Fashion Inc. All rights reserved.
Translation	0x0412 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.textbss`	`0x00001000`	42,971,319 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.text`	`0x028fd000`	87,750,885 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x07cad000`	67,140,277 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x0bcb5000`	3,248,345 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.pdata`	`0x0bfcf000`	2,457,888 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0c228000`	345,602 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.msvcjmc`	`0x0c27d000`	257 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.tls`	`0x0c27e000`	55,107 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.nv_fatb`	`0x0c28c000`	9,665,804 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.nvFatBi`	`0x0cbc4000`	284 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.00cfg`	`0x0cbc5000`	283 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`_RDATA`	`0x0cbc6000`	50,010 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.vmp0`	`0x0cbd3000`	1,353,990 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.vmp1`	`0x0cd1e000`	41,833,468 bytes	41,833,472 bytes	7.99 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`73691DF470464423968DF60C953E0B68`
`.rsrc`	`0x0f504000`	245,069 bytes	245,248 bytes	4.43 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A0ADF2C78DCE3E7C1BCB107D165CFFD9`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 4 (244,761 字节)

资源类型	数量	总大小	百分比
RT_ICON	1	243,752 字节	99.6%
RT_GROUP_ICON	1	20 字节	0%
RT_VERSION	1	608 字节	0.2%
RT_MANIFEST	1	381 字节	0.2%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

The PE file does not contain a certificate table.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	MarvelousDesigner12_Personal_x64.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.187.174
数据库版本	2024-09-12 23:00:38 UTC

MarvelousDesigner12_Personal_x64.exe Trojan CoinMiner 分析

技术分析

Trojan.Win64.CoinMiner.cl

扫描另一个文件

文件识别