SketchUp exe Trojan Heuristic Análise de Malware do Arquivo: 28500484e24bcf37dd50ed55914ab5dc

SketchUp.exe Trojan Heuristic Análise

Atualizado 1 year ago

Verificado por Malware Check

SketchUp.exe

Tipo de Hash	Valor	Ação
MD5	28500484e24bcf37dd50ed55914ab5dc
SHA1	4a154ce67af7bce912a39e158ad12a5bb45e3b01
SHA256	44491bbc1ab53d8132eaa2330dfc903e2369881eae72cb34298366d4386c3807
SHA512	09a761a2bc2b57631287f740b09fb0a59ca71b769ccad712b15901e33ecf5c7ddccc56e5bc8c413c6c1ea2f1f0c924f8d1e7e03ede410e24459092f842e2b22e
ImpHash	b58795325f32d366b54ae1d84fcb83fb

Tipo de Hash

Valor

Ação

MD5

28500484e24bcf37dd50ed55914ab5dc

SHA1

4a154ce67af7bce912a39e158ad12a5bb45e3b01

SHA256

44491bbc1ab53d8132eaa2330dfc903e2369881eae72cb34298366d4386c3807

SHA512

09a761a2bc2b57631287f740b09fb0a59ca71b769ccad712b15901e33ecf5c7ddccc56e5bc8c413c6c1ea2f1f0c924f8d1e7e03ede410e24459092f842e2b22e

ImpHash

b58795325f32d366b54ae1d84fcb83fb

Análise PE

Informações Básicas

▼

Ícone	Hash: d6dd3f577a9a44741166faad5ce534fd Fuzzy: 331e5aadfe7e102734662ad03844dd6b dHash: e88e272f16178ee8
Base da Imagem	`0x140000000`
Ponto de Entrada	`0x140b4bca4`
Tempo de Compilação	2023-02-01 23:23:18
Soma de Verificação	0x01c4e0b0 (Real: 0x01c4e0b0)
Versão do SO	6.0
Assinaturas PEiD	`PE32+ executable (GUI) x86-64, for MS Windows`
Caminho PDB	`C:\bamboo\xml-data\build-dir\SU-SCR2023-WCB\sketchup\products\Release_x64\bin\sketchup\sketchup.pdb`
Assinatura Digital	The expected hash does not match the digest in SpcInfo
Importações	18 bibliotecas
Exportações	1381 funções
Recursos	1122 Recursos
Seções	13 Seções

Assinaturas Digitais

▼

DigiCert Trusted Root G4	DigiCert, Inc. (US)
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1	Trimble Inc. (US)

Informações de Versão

▼

Comments	Release-Unicode version
CompanyName	Trimble, Inc.
FileDescription	SketchUp Application
FileVersion	23.0.367
InternalName	SketchUp
LegalCopyright	(c) 2023 Trimble, Inc.
OriginalFilename	SketchUp.EXE
ProductName	SketchUp Application
ProductVersion	23.0.367
Translation	0x0409 0x04b0

Seções PE

▼

Nome	Endereço Virtual	Tamanho Virtual	Tamanho Bruto	Entropia	Características	MD5
`.text`	`0x00001000`	17,405,294 bytes	17,405,440 bytes	6.42 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`A90A9BABFE9FEE4586A807212F6F33FD`
`jkl.text`	`0x0109b000`	264,880 bytes	265,216 bytes	6.38 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`F91DF9B254418D5D7E60991225914F79`
`jkl.bss`	`0x010dc000`	4,608 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x010de000`	7,746,450 bytes	7,746,560 bytes	6.43 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`EFEBD367FF848B38FB3832EB6F5D64D2`
`.data`	`0x01842000`	881,280 bytes	724,992 bytes	3.50 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A1A6142D19C29F8D498A2063A5BF1107`
`.pdata`	`0x0191a000`	940,392 bytes	940,544 bytes	6.85 (Comprimido)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`139D59A0F5BE4DCF1774E1DA0759063C`
`jkl.data`	`0x01a00000`	864 bytes	1,024 bytes	2.40 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D999051C37245ABC5D206FA81E91F21C`
`jkl.rdat`	`0x01a01000`	19,984 bytes	20,480 bytes	6.92 (Comprimido)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BD4BEE9D482FB1BC7B2D1D3CEE40ABFA`
`jkl.xdat`	`0x01a06000`	27,172 bytes	27,648 bytes	5.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2D7E2D2DBF6110B277A8997560EBD672`
`jkl.pdat`	`0x01a0d000`	18,252 bytes	18,432 bytes	4.78 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9614FB1DF0D91AE43D68CBA9541B5F56`
`.rsrc`	`0x01a12000`	2,280,720 bytes	2,280,960 bytes	6.85 (Comprimido)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C09EECEFEC93DE6DF2BBC5ABF1BA307B`
`.reloc`	`0x01c3f000`	192,252 bytes	192,512 bytes	5.47 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`86AD3FCCB0FB0784AA7A3BAE40B922CC`
`.crdata`	`0x01c6e000`	19 bytes	512 bytes	3.67 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`5491D239F35A6F4A6835F20DF3B45649`

Alerta de Análise de Entropia

3 seção(ões) com entropia elevada (≥6.5) - possível compressão

Análise de Recursos

▼

Total de Recursos: 1122 (2,172,537 bytes)

Tipo de Recurso	Quantidade	Tamanho Total	Porcentagem
AFX_DIALOG_LAYOUT	63	134 bytes	0%
FILE_DATA	56	183,126 bytes	8.4%
PNG	581	1,117,581 bytes	51.4%
REGISTRY	3	1,542 bytes	0.1%
STYLE_XML	5	83,741 bytes	3.9%
RT_CURSOR	12	3,696 bytes	0.2%
RT_BITMAP	47	159,048 bytes	7.3%
RT_ICON	21	440,485 bytes	20.3%
RT_MENU	15	12,786 bytes	0.6%
RT_DIALOG	187	112,698 bytes	5.2%
RT_STRING	106	53,154 bytes	2.4%
RT_ACCELERATOR	1	432 bytes	0%
RT_GROUP_CURSOR	12	240 bytes	0%
RT_GROUP_ICON	5	324 bytes	0%
RT_VERSION	1	824 bytes	0%
RT_MANIFEST	1	1,976 bytes	0.1%
None	6	750 bytes	0%

Análise da Cadeia de Certificados

▼

Certificado #1

Assunto	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 DigiCert, Inc. US
Emissor	DigiCert Trusted Root G4
Número de Série	`11533403529598586876501374841704918745`

Certificado #2

Assunto	Trimble Inc. Trimble Inc. US
Emissor	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Número de Série	`6507074583347865154840523051864629071`

Status de Verificação do Certificado

The expected hash does not match the digest in SpcInfo

Recomendação: Verifique a fonte do arquivo e certifique-se de que venha de um editor confiável.

Deixar um Comentário

Nome do Arquivo	SketchUp.exe
Tipo de Arquivo	PE32+ executable (GUI) x86-64, for MS Windows
Versão do Scanner	1.0.155.174
Versão do Banco de Dados	2024-01-19 02:02:18 UTC

SketchUp.exe Trojan Heuristic Análise

Análise Técnica

Trojan.Heur!.00244033

Verificar Outro Arquivo

Identificação do Arquivo