USB1 5 27 0 exe (SAMSUNG USB Driver for Mobile Phones) SAMSUNG Electronics Co , Ltd 文件恶意软件分析

USB1.5.27.0.exe (SAMSUNG USB Driver for Mobile Phones) 文件分析

更新于 1 year ago

检查者 Malware Check

USB1.5.27.0.exe

哈希类型	值	操作
MD5	ab24028eba28a444d9bcc9e836c6ff40
SHA1	5fe25797d66533f01e002dfb397c7461652cda2f
SHA256	c761cfe369a0fcbdcf0767e7d5879195921137c5c78eb2b18f2133bf6b59f79e
SHA512	baffa4e02951aabad608ae31fe771f59f7fb807e3a10201b2de5d882fdf373ec846952e863d42d1bfbd3f00b4eb80a5afb755b442c5d380fc285129553beece0
ImpHash	7fa974366048f9c551ef45714595665e

哈希类型

值

操作

MD5

ab24028eba28a444d9bcc9e836c6ff40

SHA1

5fe25797d66533f01e002dfb397c7461652cda2f

SHA256

c761cfe369a0fcbdcf0767e7d5879195921137c5c78eb2b18f2133bf6b59f79e

SHA512

baffa4e02951aabad608ae31fe771f59f7fb807e3a10201b2de5d882fdf373ec846952e863d42d1bfbd3f00b4eb80a5afb755b442c5d380fc285129553beece0

ImpHash

7fa974366048f9c551ef45714595665e

PE 分析

基本信息

▼

图标	哈希: 949ed286f4e554088fb9a8244cc266a2 模糊: 4902308a7bd0d1738102057db8c3749c dHash: 92e0b496a2cada72
映像基址	`0x00400000`
入口点	`0x004030cb`
编译时间	2009-12-05 22:50:41
校验和	0x00eb1cf8 (实际: 0x00eb1cf8)
操作系统版本	4.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive`
数字签名	OK
导入	8 库 KERNEL32, USER32, GDI32, SHELL32, ADVAPI32, COMCTL32, ole32, VERSION
导出	0 函数
资源	27 资源
节	5 节

数字签名

▼

Thawte Timestamping CA	Symantec Corporation (US)
Symantec Time Stamping Services CA - G2	Symantec Corporation (US)
	VeriSign, Inc. (US)
VeriSign Class 3 Code Signing 2010 CA	Samsung Electronics CO., LTD. (KR)

版本信息

▼

Comments	SAMSUNG USB Driver for Mobile Phones
CompanyName	SAMSUNG Electronics Co., Ltd.
FileDescription	SAMSUNG USB Driver for Mobile Phones
FileVersion	1.5.27.0
InternalName	SAMSUNG USB Driver for Mobile Phones
LegalCopyright	SAMSUNG Electronics Co., Ltd. All Rights Reserved
ProductName	SAMSUNG USB Driver for Mobile Phones
Translation	0x0000 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	22,738 bytes	23,040 bytes	6.43 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`C69726ED422D3DCFDEC9731986DAA752`
`.rdata`	`0x00007000`	4,496 bytes	4,608 bytes	5.18 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`A2C7710FA66FCBB43C7EF0AB9EEA5E9A`
`.data`	`0x00009000`	110,456 bytes	1,024 bytes	4.62 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E59CDCB732E4BFBC84CC61DD68354F78`
`.ndata`	`0x00024000`	36,864 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rsrc`	`0x0002d000`	8,048 bytes	8,192 bytes	3.32 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5673B631A1E4ED3CDF87DE10BFAFB4F9`

资源分析

▼

资源总数: 27 (6,592 字节)

资源类型	数量	总大小	百分比
RT_ICON	1	744 字节	11.3%
RT_DIALOG	24	4,896 字节	74.3%
RT_GROUP_ICON	1	20 字节	0.3%
RT_VERSION	1	932 字节	14.1%

证书链分析

▼

证书 #1

主题	Symantec Time Stamping Services CA - G2 Symantec Corporation US
颁发者	Thawte Timestamping CA
序列号	`168250781398245547403531165097821404219`

证书 #2

主题	Symantec Time Stamping Services Signer - G4 Symantec Corporation US
颁发者	Symantec Time Stamping Services CA - G2
序列号	`19688950797630895426199952712430983760`

证书 #3

主题	VeriSign Class 3 Code Signing 2010 CA VeriSign, Inc. US
颁发者	未知
序列号	`102862339621237665902660704368568886948`

证书 #4

主题	Samsung Electronics CO., LTD. Samsung Electronics CO., LTD. KR
颁发者	VeriSign Class 3 Code Signing 2010 CA
序列号	`3814177025403668020213517458316636444`

证书验证状态

发表评论

文件名	USB1.5.27.0.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
扫描器版本	1.0.146.174
数据库版本	2023-11-05 22:00:58 UTC

USB1.5.27.0.exe (SAMSUNG USB Driver for Mobile Phones) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别