App exe Malware XWorm Malware Analyse: a916b72f95566268aeca2298759b2018

Hash-Typ	Wert	Aktion
MD5	a916b72f95566268aeca2298759b2018
SHA1	dc449a1a8200a1ced9ea6d681c4738700d6a015f
SHA256	1f833964e95405776234ba73738ca25360c43a54ed71030c978fdf56d1cf11ba
SHA512	36210c0be16498d7c41095b0841d0472ab5bd1afda5051fbbcf119117c3763686602b4a9d49d9954839d8c33047870bbdd470c9e29dfd628ff0eac8671a1618c
ImpHash	3e4ea5a76e68c74643536824830b0523

PE-Analyse

Grundlegende Informationen

▼

Bildbasis	`0x140000000`
Einstiegspunkt	`0x1400010f6`
Kompilierungszeit	2024-02-05 17:08:29
Prüfsumme	0x0004c384 (Tatsächlich: 0x0004c384)
OS-Version	4.0
PEiD-Signaturen	`PE32+ executable (GUI) x86-64, for MS Windows`
Digitale Signatur	The PE file does not contain a certificate table.
Importe	3 Bibliotheken KERNEL32, msvcrt, USER32
Exporte	0 Funktionen
Ressourcen	1 Ressourcen
Abschnitte	20 Abschnitte

PE-Abschnitte

▼

Name	Virtuelle Adresse	Virtuelle Größe	Rohgröße	Entropie	Eigenschaften	MD5
`.text`	`0x00001000`	117,496 bytes	117,760 bytes	5.99 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`2CD28190633C61882FA57F64938C31EA`
`.data`	`0x0001e000`	53,136 bytes	53,248 bytes	7.44 (Komprimiert)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`A11F8630C0358F45BC706E364F929D9C`
`.rdata`	`0x0002b000`	8,576 bytes	8,704 bytes	5.24 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_32BYTES`	`8C0086192FF221A1362B3762C68A07FD`
`/4`	`0x0002e000`	4 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.pdata`	`0x0002f000`	5,952 bytes	6,144 bytes	5.29 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`6A96851ED50B31A6600DB8C820C2963A`
`.xdata`	`0x00031000`	5,864 bytes	6,144 bytes	3.98 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`FE56ED9C1D64D839FFDD4ED898BB8057`
`.bss`	`0x00033000`	3,440 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00034000`	4,104 bytes	4,608 bytes	4.10 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`D773DF2B0D4FFE980D8352EA31C0434A`
`.CRT`	`0x00036000`	112 bytes	512 bytes	0.43 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_8BYTES`	`A3453752D96B07DF53CED805F3DF1BC0`
`.tls`	`0x00037000`	16 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_8BYTES`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x00038000`	552 bytes	1,024 bytes	3.41 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`BFA1C04600A1C8B2E8C1FC6B14F6DD19`
`.reloc`	`0x00039000`	216 bytes	512 bytes	2.51 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`3011FB66F84AF6CB9307D0D7CAC632D6`
`/14`	`0x0003a000`	144 bytes	512 bytes	0.54 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`DE13DBF0BB46F986C063D4848CD1F2B5`
`/29`	`0x0003b000`	9,944 bytes	10,240 bytes	5.61 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`BB0C1B9FC5CE9C2912FF24F2523CC181`
`/41`	`0x0003e000`	1,090 bytes	1,536 bytes	3.97 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`445310D78317DFE90942A16CF6CD9A00`
`/55`	`0x0003f000`	1,314 bytes	1,536 bytes	4.83 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`5FB3B4400A9ED9DBD8C73BAF4BADE3A6`
`/67`	`0x00040000`	448 bytes	512 bytes	2.95 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_8BYTES`	`FF49B236E696D0F3F554F8D2714E9603`
`/80`	`0x00041000`	132 bytes	512 bytes	2.02 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`E647DC8783FC2F6F90F3541C4DB762C0`
`/91`	`0x00042000`	945 bytes	1,024 bytes	4.18 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`60F8D74B656D5D047E4471243008977B`
`/107`	`0x00043000`	170 bytes	512 bytes	1.64 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`B8FCD785A65F6FEE8172BACF46FEFF32`

Entropie-Analyse-Warnung

1 Abschnitt(e) mit erhöhter Entropie (≥6.5) - mögliche Komprimierung

Ressourcenanalyse

▼

Gesamtressourcen: 1 (458 Bytes)

Ressourcentyp	Anzahl	Gesamtgröße	Prozentsatz
RT_MANIFEST	1	458 Bytes	100%

Zertifikatsketten-Analyse

▼

Keine digitalen Signaturen

Diese Datei ist nicht digital signiert.

Sicherheitsauswirkungen:

Kann die Identität des Herausgebers nicht verifizieren
Erhöhtes Sicherheitsrisiko beim Ausführen dieser Datei
Kann Sicherheitswarnungen auf einigen Systemen auslösen

⚠ Diese Datei hat entweder keine digitale Signatur oder die Zertifikatskette konnte nicht verifiziert werden.
Seien Sie vorsichtig beim Ausführen unsignierter Dateien aus unbekannten Quellen.

Zertifikat-Verifizierungsstatus

The PE file does not contain a certificate table.

Empfehlung: Überprüfen Sie die Dateiquelle und stellen Sie sicher, dass sie von einem vertrauenswürdigen Herausgeber stammt.

Dateiname	app.exe
Dateityp	PE32+ executable (GUI) x86-64, for MS Windows
Scanner-Version	1.0.165.174
Datenbankversion	2024-02-17 03:00:21 UTC

App.exe Malware XWorm Malware-Analyse

Technische Analyse

Malware.Win64.XWorm.tr

Weitere Datei scannen

Dateiidentifikation