SolaraV3 dll (Dynamic Link Library for the Solara Utility) CMD Softworks 文件恶意软件分析

SolaraV3.dll (Dynamic Link Library for the Solara Utility) 文件分析

更新于 2 months ago

检查者 Malaware Check

SolaraV3.dll

哈希类型	值	操作
MD5	966701f265bddf6d22dcbb3bc35c45e4
SHA1	3a3a6249d778fbc1fda12142e99e65a21bd94335
SHA256	f6ea8578bcdcc2ab8609658e735d8f3e6f9e79dcdf904f2ed54f9109fb444203
SHA512	6e409fcb01d9249d5a60b10eef528267e3796fbcf6e85265f0375f8094a65cd95cfb639bea08ca33d93f19662cb3eace2857a289c47230bdb0d7960b930c5daf
ImpHash	6463e38e8581062b60ff809380300dbe

哈希类型

值

操作

MD5

966701f265bddf6d22dcbb3bc35c45e4

SHA1

3a3a6249d778fbc1fda12142e99e65a21bd94335

SHA256

f6ea8578bcdcc2ab8609658e735d8f3e6f9e79dcdf904f2ed54f9109fb444203

SHA512

6e409fcb01d9249d5a60b10eef528267e3796fbcf6e85265f0375f8094a65cd95cfb639bea08ca33d93f19662cb3eace2857a289c47230bdb0d7960b930c5daf

ImpHash

6463e38e8581062b60ff809380300dbe

PE 分析

基本信息

▼

映像基址	`0x180000000`
入口点	`0x180d7b058`
编译时间	2025-03-23 18:16:36
校验和	0x006be0a9 (实际: 0x006be0a9)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	8 库 kernel32, CRYPT32, WS2_32, USER32, ADVAPI32, SHELL32, MSWSOCK, bcrypt
导出	175 函数
资源	22 资源
节	14 节

版本信息

▼

CompanyName	CMD Softworks
FileDescription	Dynamic Link Library for the Solara Utility
FileVersion	3.1.15.0
InternalName	SOLARA
LegalCopyright	Copyright © 2024 CMD Softworks
OriginalFilename	SolaraV3.dll
ProductName	Solara V3
ProductVersion	3.1.15.0
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
	`0x00001000`	5,684,716 bytes	2,370,048 bytes	7.99 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`1EB24D5A361EA9DA0388CFBBEFF3EA93`
	`0x0056d000`	1,332,262 bytes	484,352 bytes	7.98 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B8FBFE2B7C629FCB8073BE64E58A9851`
	`0x006b3000`	76,220 bytes	13,312 bytes	7.95 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`08699F964F77A103ABE51ED9DC24789A`
	`0x006c6000`	192,336 bytes	111,104 bytes	7.71 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`84E4B06D757EDF017949E064713B8723`
	`0x006f5000`	500 bytes	512 bytes	4.46 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B7D27332BFA0D68422C9308805BFBA42`
	`0x006f6000`	1,096 bytes	1,024 bytes	5.04 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`15A166D6AD2CE8B44815C38F7930A770`
	`0x006f7000`	48,404 bytes	26,624 bytes	7.83 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`3CA34847695411A5E2997BA9C9B11773`
`.edata`	`0x00703000`	6,144 bytes	6,144 bytes	5.34 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1C8CEB1007E6295009689761CA4FD672`
`.idata`	`0x00705000`	4,096 bytes	1,024 bytes	2.20 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`EEBB83A38D7E9CB9ED8000DC4180843E`
`.tls`	`0x00706000`	4,096 bytes	512 bytes	0.28 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`504898649A7E93BCDE1E8909C649869F`
`.rsrc`	`0x00707000`	8,192 bytes	8,192 bytes	4.68 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7763D3D6FEBCF8300DE3F7D8F0ED7DCD`
`.themida`	`0x00709000`	6,758,400 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.boot`	`0x00d7b000`	3,997,184 bytes	3,997,184 bytes	7.96 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`EEB94509F0FDA8B180EB2F8C5E45B1B8`
`.reloc`	`0x0114b000`	4,096 bytes	16 bytes	2.47 (正常)	`IMAGE_SCN_MEM_READ`	`E7C96DD60BCAE5506A7D9D1947B57656`

熵分析警报

6 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 22 (6,776 字节)

资源类型	数量	总大小	百分比
RT_DIALOG	7	1,756 字节	25.9%
RT_STRING	6	91 字节	1.3%
RT_RCDATA	7	4,000 字节	59%
RT_VERSION	1	784 字节	11.6%
RT_MANIFEST	1	145 字节	2.1%

证书链分析

▼

证书 Information

产品	Solara V3
描述	Dynamic Link Library for the Solara Utility
文件版本	3.1.15.0
原始名称	SolaraV3.dll
内部名称	SOLARA
版权	Copyright © 2024 CMD Softworks

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	SolaraV3.dll
文件类型	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
扫描器版本	1.0.211.174
数据库版本	2025-03-23 21:00:57 UTC

SolaraV3.dll (Dynamic Link Library for the Solara Utility) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别