Painttool sai 1 2 5 installer qoND T1 exe PUP Softonic 文件恶意软件分析: a400745e13f831620e440d5d35f1f994

Painttool-sai-1.2.5-installer_qoND-T1.exe PUP Softonic 分析

更新于 1 year ago

检查者 Malware Check

painttool-sai-1.2.5-installer_qoND-T1.exe

哈希类型	值	操作
MD5	a400745e13f831620e440d5d35f1f994
SHA1	2ddd991890863155f6a99bfb38f0b0c5200f8fc4
SHA256	f205411e408d98a509af59b78564f70d8b18447695bf5be77e7c00742125cfb7
SHA512	e84867e4be00bd5bad25d0be246e84ba701fdadfa99521755626bcee4cf888cfcfa4d788de893b972f9a24c3ded21dc11a6d9f956455686c9b1da1aed6f1d47f
ImpHash	e569e6f445d32ba23766ad67d1e3787f

哈希类型

值

操作

MD5

a400745e13f831620e440d5d35f1f994

SHA1

2ddd991890863155f6a99bfb38f0b0c5200f8fc4

SHA256

f205411e408d98a509af59b78564f70d8b18447695bf5be77e7c00742125cfb7

SHA512

e84867e4be00bd5bad25d0be246e84ba701fdadfa99521755626bcee4cf888cfcfa4d788de893b972f9a24c3ded21dc11a6d9f956455686c9b1da1aed6f1d47f

ImpHash

e569e6f445d32ba23766ad67d1e3787f

PE 分析

基本信息

▼

图标	哈希: a0ef7c81eee20e999575764306184ccf 模糊: 8341e53a6f1047f3c936b4d36dc8f542 dHash: 5050d274ccec82ae
映像基址	`0x00400000`
入口点	`0x004b5eec`
编译时间	2023-02-15 14:54:16
校验和	0x001b3e4c (实际: 0x001b3e4c)
操作系统版本	6.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	OK
导入	7 库 kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
导出	3 函数
资源	30 资源
节	10 节

数字签名

▼

DigiCert Assured ID Root CA	DigiCert Inc (US)
DigiCert Trusted Root G4	DigiCert, Inc. (US)
DigiCert Trusted Root G4	DigiCert, Inc. (US)
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA	DigiCert, Inc. (US)
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1	Softonic International SA (ES)

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName
FileDescription	Softonic International SA
FileVersion	5.13.0.7339
LegalCopyright	©2023 Softonic International SA
OriginalFileName
ProductName	Softonic International SA
ProductVersion	5.13.0.7339
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	735,716 bytes	735,744 bytes	6.36 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`43AF0A9476CA224D8E8461F1E22C94DA`
`.itext`	`0x000b5000`	5,768 bytes	6,144 bytes	5.97 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`185E04B9A1F554E31F7F848515DC890C`
`.data`	`0x000b7000`	14,244 bytes	14,336 bytes	5.05 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`CAB2107C933B696AA5CF0CC6C3FD3980`
`.bss`	`0x000bb000`	28,136 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c2000`	4,060 bytes	4,096 bytes	5.03 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E7D1635E2624B124CFDCE6C360AC21CD`
`.didata`	`0x000c3000`	420 bytes	512 bytes	2.75 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8CED971D8A7705C98B173E255D8C9AA7`
`.edata`	`0x000c4000`	154 bytes	512 bytes	1.88 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8D4E1E508031AFE235BF121C80FD7D5F`
`.tls`	`0x000c5000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c6000`	93 bytes	512 bytes	1.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8F2F090ACD9622C88A6A852E72F94E96`
`.rsrc`	`0x000c7000`	69,632 bytes	69,632 bytes	3.70 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`88F48290AE8284F848578E02EEE7A49E`

资源分析

▼

资源总数: 30 (67,541 字节)

资源类型	数量	总大小	百分比
RT_ICON	13	55,173 字节	81.7%
RT_STRING	11	8,040 字节	11.9%
RT_RCDATA	3	768 字节	1.1%
RT_GROUP_ICON	1	188 字节	0.3%
RT_VERSION	1	1,412 字节	2.1%
RT_MANIFEST	1	1,960 字节	2.9%

证书链分析

▼

证书 #1

主题	DigiCert Trusted Root G4 DigiCert Inc US
颁发者	DigiCert Assured ID Root CA
序列号	`19414496059604725969669510860671817818`

证书 #2

主题	DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA DigiCert, Inc. US
颁发者	DigiCert Trusted Root G4
序列号	`9586110043380832440035821245782711899`

证书 #3

主题	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 DigiCert, Inc. US
颁发者	DigiCert Trusted Root G4
序列号	`11533403529598586876501374841704918745`

证书 #4

主题	DigiCert Timestamp 2023 DigiCert, Inc. US
颁发者	DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA
序列号	`7002784885422699301467740558332354838`

证书 #5

主题	Softonic International SA Softonic International SA ES
颁发者	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
序列号	`6833089098909367268737575428847078400`

证书验证状态

发表评论

文件名	painttool-sai-1.2.5-installer_qoND-T1.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.156.174
数据库版本	2024-01-29 23:00:50 UTC

Painttool-sai-1.2.5-installer_qoND-T1.exe PUP Softonic 分析

技术分析

PUP.Win32.Softonic.dd!c

扫描另一个文件

文件识别