Setup exe (Setup Launcher Unicode) SoftTruck 文件恶意软件分析

哈希类型	值	操作
MD5	92f812ed307ce0145daa7d0f48bb6b1e
SHA1	43d62f45b94706d643a59f9be02b11f0747eac49
SHA256	d01f9981dd87faed197504d6fd39fb53b0962c09df462169a98cf17b5221d32b
SHA512	72fa51f68145fb58a27147b8c94d91004e07816073ef4f811eb93bf7113905f1f5706ffb7bb4edbb0f4da00eb840a63cbec06011f60b57c29272d78257ce1cdb
ImpHash	62c62c4f0cbff3f5300c1f4f9c4854ea

基本信息

▼

图标	哈希: 0994d4ac1fb53dafefe9f7e2d809d2c5 模糊: 08fe358a3171e11e38736224bc9dd862 dHash: 554d79355d61634d
映像基址	`0x00400000`
入口点	`0x004580fc`
编译时间	2017-07-27 13:47:44
校验和	0x022188b5 (实际: 0x022188b5)
操作系统版本	5.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB 路径	`C:\CodeBases\isdev\redist\Language Independent\i386\setup.pdb`
数字签名	Chain verification from CN=Softtruck, O=Softtruck, STREET=1238 Acappella Lane, L=Apollo Beach, ST=Florida, 2.5.4.17=33572, C=US (serial:170858385262896091547284924626689384010, sha1:47c6caf4ea33c8dc575dbd715e2e0869718d6562) failed: The path could not be validated because the end-entity certificate expired 2021-11-13 23:59:59Z
导入	9 库 COMCTL32, KERNEL32, USER32, GDI32, ADVAPI32, SHELL32, ole32, OLEAUT32, RPCRT4
导出	0 函数
资源	75 资源
节	4 节

版本信息

▼

CompanyName	SoftTruck
FileDescription	Setup Launcher Unicode
FileVersion	10.01.02
InternalName	Setup
LegalCopyright	Copyright (c) 2015 Flexera Software LLC. All Rights Reserved.
OriginalFilename	InstallShield Setup.exe
ProductName	CargoWiz
ProductVersion	10.01.02
Internal Build Number	176888
ISInternalVersion	22.0.401
ISInternalDescription	Setup Launcher Unicode
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	738,421 bytes	738,816 bytes	6.59 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`5B2F045D5298322BA6727DE76D54B0D9`
`.rdata`	`0x000b6000`	222,826 bytes	223,232 bytes	5.10 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C10B8E7E278C76B696DDBEBA1E500F3C`
`.data`	`0x000ed000`	35,896 bytes	10,240 bytes	4.45 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`DBD6C9B063D673C81C5BD4D8A1B9D07E`
`.rsrc`	`0x000f6000`	343,408 bytes	343,552 bytes	6.73 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7AC7F760B05580A8366A51C3621F4B19`

熵分析警报

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 75 (339,523 字节)

资源类型	数量	总大小	百分比
GIF	2	44,681 字节	13.2%
PNG	2	27,062 字节	8%
RT_BITMAP	6	208,296 字节	61.3%
RT_ICON	11	26,552 字节	7.8%
RT_DIALOG	23	9,914 字节	2.9%
RT_STRING	25	19,588 字节	5.8%
RT_GROUP_ICON	3	172 字节	0.1%
RT_VERSION	1	1,044 字节	0.3%
RT_MANIFEST	2	2,214 字节	0.7%

证书链分析

▼

证书 Information

产品	CargoWiz
描述	Setup Launcher Unicode
文件版本	10.01.02
原始名称	InstallShield Setup.exe
验证状态	A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.
签名者	Softtruck; COMODO RSA Code Signing CA; Sectigo (formerly Comodo CA)
内部名称	Setup
版权	Copyright (c) 2015 Flexera Software LLC. All Rights Reserved.

证书链摘要

Softtruck #1 主要

有效期: 2018-11-14 00:00:00 → 2021-11-13 23:59:59

签名算法: sha256RSA

序列号: 80 8A 20 C7 68 CF 95 DE EB 18 74 1C 37 20 DE 4A

COMODO RSA Certification Authority #2 链

有效期: 2010-01-19 00:00:00 → 2038-01-18 23:59:59

签名算法: sha384RSA

序列号: 4C AA F9 CA DB 63 6F E0 1F F7 4E D8 5B 03 86 9D

COMODO RSA Code Signing CA #3 链

有效期: 2013-05-09 00:00:00 → 2028-05-08 23:59:59

签名算法: sha384RSA

序列号: 2E 7C 87 CC 0E 93 4A 52 FE 94 FD 1C B7 CD 34 AF

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

Chain verification from CN=Softtruck, O=Softtruck, STREET=1238 Acappella Lane, L=Apollo Beach, ST=Florida, 2.5.4.17=33572, C=US (serial:170858385262896091547284924626689384010, sha1:47c6caf4ea33c8dc575dbd715e2e0869718d6562) failed: The path could not be validated because the end-entity certificate expired 2021-11-13 23:59:59Z

建议: 验证文件来源并确保它来自可信的发布者.

文件名	setup.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.218.174
数据库版本	2025-06-16 13:00:21 UTC

Setup.exe (Setup Launcher Unicode) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别

PE 分析