USBACEditor exe (SamLogic USB AutoRun Creator) SamLogic Software 文件恶意软件分析

USBACEditor.exe (SamLogic USB AutoRun Creator) 文件分析

更新于 1 year ago

检查者 Malware Check

USBACEditor.exe

哈希类型	值	操作
MD5	51cbe2c7ef6ea4e819b7832e07e74f5f
SHA1	b6c281f00a54789b9b259da163fc2ab5a024137a
SHA256	977b9486de96554cd086c203ff9b19071cbd974117d61b5ef4e45c8608c951bf
SHA512	983032bdb4e0404240a7b9617cf6a8823be801e0a902dc74a700b61acd8d989ac8bbf9a1a839ce391abc091d0404480258f3a0b36a287bc7aee44a7aefc2b54c
ImpHash	29cb0aae2087cecc147b14d9fa8c6bc9

哈希类型

值

操作

MD5

51cbe2c7ef6ea4e819b7832e07e74f5f

SHA1

b6c281f00a54789b9b259da163fc2ab5a024137a

SHA256

977b9486de96554cd086c203ff9b19071cbd974117d61b5ef4e45c8608c951bf

SHA512

983032bdb4e0404240a7b9617cf6a8823be801e0a902dc74a700b61acd8d989ac8bbf9a1a839ce391abc091d0404480258f3a0b36a287bc7aee44a7aefc2b54c

ImpHash

29cb0aae2087cecc147b14d9fa8c6bc9

PE 分析

基本信息

▼

图标	哈希: 524d71f2292208706163a9584637d34a 模糊: 0a81c0f5665a55a506aaf2efa4ae309c dHash: 4e3ae7e6d4d861e2
映像基址	`0x00400000`
入口点	`0x00402508`
编译时间	2022-08-17 14:27:54
校验和	0x000aac2d (实际: 0x000aac2d)
操作系统版本	4.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	OK
导入	1 库 MSVBVM60
导出	0 函数
资源	3 资源
节	3 节

数字签名

▼

AAA Certificate Services	Sectigo Limited (GB)
Sectigo Public Code Signing Root R46	Sectigo Limited (GB)
USERTrust RSA Certification Authority	Sectigo Limited (GB)
Sectigo Public Code Signing CA EV R36	SamLogic Software (SE)
Sectigo RSA Time Stamping CA	Sectigo Limited (GB)

版本信息

▼

Translation	0x0409 0x04b0
CompanyName	SamLogic Software
FileDescription	SamLogic USB AutoRun Creator
LegalCopyright	Copyright (c) by SamLogic Software
ProductName	SamLogic USB AutoRun Creator
FileVersion	2.00.0006
ProductVersion	2.00.0006
InternalName	USBACEditor
OriginalFilename	USBACEditor.exe

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	613,172 bytes	614,400 bytes	7.12 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`B091F0CE363CBB97581154DBDB01BC06`
`.data`	`0x00097000`	29,780 bytes	4,096 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`620F0B67A91F7F74151BC5BE745B7110`
`.rsrc`	`0x0009f000`	3,300 bytes	4,096 bytes	4.16 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`503CA18961F6AEDD3387816D76D7886E`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 3 (3,060 字节)

资源类型	数量	总大小	百分比
RT_ICON	1	2,216 字节	72.4%
RT_GROUP_ICON	1	20 字节	0.7%
RT_VERSION	1	824 字节	26.9%

证书链分析

▼

证书 #1

主题	Sectigo Public Code Signing Root R46 Sectigo Limited GB
颁发者	AAA Certificate Services
序列号	`97015870309959729927281967672979788822`

证书 #2

主题	Sectigo Public Code Signing CA EV R36 Sectigo Limited GB
颁发者	Sectigo Public Code Signing Root R46
序列号	`68907147224176919178469041473649749358`

证书 #3

主题	Sectigo RSA Time Stamping CA Sectigo Limited GB
颁发者	USERTrust RSA Certification Authority
序列号	`63883093293784159655322269805543173561`

证书 #4

主题	SamLogic Software SamLogic Software SE
颁发者	Sectigo Public Code Signing CA EV R36
序列号	`146773722637021914863183149244905373794`

证书 #5

主题	Sectigo RSA Time Stamping Signer #3 Sectigo Limited GB
颁发者	Sectigo RSA Time Stamping CA
序列号	`191707380446202648670195672873975720259`

证书验证状态

发表评论

文件名	USBACEditor.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.146.174
数据库版本	2023-11-03 21:01:11 UTC