PainterCore64 dll (Painter Core Dynamic Link Library) Corel Corporation 文件恶意软件分析

PainterCore64.dll (Painter Core Dynamic Link Library) 文件分析

更新于 3 months ago

检查者 Malware Check

PainterCore64.dll

哈希类型	值	操作
MD5	1300082a4cd3bfe1ce689d510a0ef551
SHA1	48ccabc87243e0293b0ae73c332950d13342dcbf
SHA256	b804a430cb875ef582ecb075afceb0f9e6bf147b8f688ca9c10b4bd3df698329
SHA512	9eb0b5f6a3f47d25330c5e38d2ccf28dfb94e55b24b3ee81e4e97582ea67ad5ce611c39192f6eac487019aea53befbc5c9b214bf0a002d3bebd51ac02f654e04
ImpHash	f41c50900f18850584aac8e7d18c0ec2

哈希类型

值

操作

MD5

1300082a4cd3bfe1ce689d510a0ef551

SHA1

48ccabc87243e0293b0ae73c332950d13342dcbf

SHA256

b804a430cb875ef582ecb075afceb0f9e6bf147b8f688ca9c10b4bd3df698329

SHA512

9eb0b5f6a3f47d25330c5e38d2ccf28dfb94e55b24b3ee81e4e97582ea67ad5ce611c39192f6eac487019aea53befbc5c9b214bf0a002d3bebd51ac02f654e04

ImpHash

f41c50900f18850584aac8e7d18c0ec2

PE 分析

基本信息

▼

映像基址	`0x180000000`
入口点	`0x182e8ed4f`
编译时间	2020-06-17 04:43:15
校验和	0x00c08a47 (实际: 0x00c08a47)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
PDB 路径	`F:\bld\PV21-PAIN-JOB1\src\Install\PainterCore64.pdb`
数字签名	No valid SignedData structure was found.
导入	48 库
导出	697 函数
资源	2 资源
节	11 节

版本信息

▼

CompanyName	Corel Corporation
FileDescription	Painter Core Dynamic Link Library
FileVersion	21.0.0.211
InternalName	Painter Core
LegalCopyright	Copyright (c) 2020 Corel Corporation
OriginalFilename	PainterCore.dll
ProductName	Corel Painter Engine
ProductVersion	21.0.0.211
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	20,057,268 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x01322000`	3,374,192 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x0165a000`	21,592,940 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.pdata`	`0x02af2000`	1,122,852 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data1`	`0x02c05000`	6,224 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`_RDATA`	`0x02c07000`	4,608 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.debug_o`	`0x02c09000`	14,016 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.vmp0`	`0x02c0d000`	1,358,178 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.vmp1`	`0x02d59000`	12,556,092 bytes	12,556,288 bytes	7.92 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`CB0FD9E482005BDEFFF83774EBDA1257`
`.reloc`	`0x03953000`	196 bytes	512 bytes	2.15 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8EC19D849FBEC82CB0D251215FAF7056`
`.rsrc`	`0x03954000`	1,380 bytes	1,536 bytes	3.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4E19C9EC5A6A24228E88CEAA141F12F4`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 2 (1,220 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	832 字节	68.2%
RT_MANIFEST	1	388 字节	31.8%

证书链分析

▼

证书 Information

产品	Corel Painter Engine
描述	Painter Core Dynamic Link Library
文件版本	21.0.0.211
原始名称	PainterCore.dll
内部名称	Painter Core
版权	Copyright (c) 2020 Corel Corporation

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	PainterCore64.dll
文件类型	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
扫描器版本	1.0.226.174
数据库版本	2025-10-07 00:00:30 UTC

PainterCore64.dll (Painter Core Dynamic Link Library) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别