Der speedfan exe Malware Analyse

Der speedfan.exe Scan-Bericht

Aktualisiert 2 months ago

Geprüft von Malaware Check

speedfan.exe

Hash-Typ	Wert	Aktion
MD5	2ec7b1b5e9fddba22b4f426170e4c834
SHA1	283a9c5ab4640adc35393fe750c9f41cf5f23230
SHA256	4e9f8f2c3528bec9ba78985d8473bcb3be50e28c4c27363333fda80de9649f94
SHA512	4454b37a32438a3db99605f78827aea1b883c9bcb210ef209f794f7eb56bc89dbd3300c511b3f362799bd18aaf25424b85cdd275ef1e01514ea24fc9191d6455
ImpHash	d8bee5e1c486960556bd660df0ab5a1b

Hash-Typ

Wert

Aktion

MD5

2ec7b1b5e9fddba22b4f426170e4c834

SHA1

283a9c5ab4640adc35393fe750c9f41cf5f23230

SHA256

4e9f8f2c3528bec9ba78985d8473bcb3be50e28c4c27363333fda80de9649f94

SHA512

4454b37a32438a3db99605f78827aea1b883c9bcb210ef209f794f7eb56bc89dbd3300c511b3f362799bd18aaf25424b85cdd275ef1e01514ea24fc9191d6455

ImpHash

d8bee5e1c486960556bd660df0ab5a1b

PE-Analyse

Grundlegende Informationen

▼

Symbol	Hash: 10e0c4fe1a00395fe7464692022343c6 Unscharf: b90ced7bc273e2a2bfa1bd175831e05b dHash: 0a5b726861725b13
Bildbasis	`0x00400000`
Einstiegspunkt	`0x009c8bb8`
Kompilierungszeit	2016-06-29 18:01:20
Prüfsumme	0x007d6233 (Tatsächlich: 0x007d6233)
OS-Version	5.0
PEiD-Signaturen	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digitale Signatur	OK
Importe	17 Bibliotheken
Exporte	0 Funktionen
Ressourcen	221 Ressourcen
Abschnitte	10 Abschnitte

Versionsinformationen

▼

FileVersion	4.52.0.462
ProductVersion	4.52.0.0
Comments	Final
Translation	0x0409 0x04e4

PE-Abschnitte

▼

Name	Virtuelle Adresse	Virtuelle Größe	Rohgröße	Entropie	Eigenschaften	MD5
`.text`	`0x00001000`	6,043,188 bytes	6,043,648 bytes	6.35 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`8C595DC8F2E7B28923AA3D0E73EDD13E`
`.itext`	`0x005c5000`	15,408 bytes	15,872 bytes	6.23 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`F010FC2916676D10310B837DDF0C073A`
`.data`	`0x005c9000`	442,784 bytes	442,880 bytes	4.33 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F7D2B8A69A4AA95A70AD1EAC83765949`
`.bss`	`0x00636000`	571,968 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x006c2000`	19,972 bytes	20,480 bytes	4.97 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`89C11177471864C1BC89A8673FCF0EBE`
`.didata`	`0x006c7000`	2,266 bytes	2,560 bytes	3.76 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3EE54B22AD885AF283FA824FB30959ED`
`.tls`	`0x006c8000`	84 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x006c9000`	72 bytes	512 bytes	1.03 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`CE9BD6E289FAD55FA4CA964F8DFF89F2`
`.reloc`	`0x006ca000`	407,524 bytes	407,552 bytes	6.72 (Komprimiert)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`7B7D770CE3D274A0BD40C7C5D1376EF0`
`.rsrc`	`0x0072e000`	1,224,704 bytes	1,224,704 bytes	5.69 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4F6C764E81F158F40EAE27D9E1F82B8D`

Entropie-Analyse-Warnung

1 Abschnitt(e) mit erhöhter Entropie (≥6.5) - mögliche Komprimierung

Ressourcenanalyse

▼

Gesamtressourcen: 221 (1,210,490 Bytes)

Ressourcentyp	Anzahl	Gesamtgröße	Prozentsatz
UNICODEDATA	6	167,861 Bytes	13.9%
RT_CURSOR	24	11,792 Bytes	1%
RT_BITMAP	61	57,402 Bytes	4.7%
RT_ICON	3	81,528 Bytes	6.7%
RT_DIALOG	2	164 Bytes	0%
RT_STRING	63	53,840 Bytes	4.4%
RT_RCDATA	35	835,772 Bytes	69%
RT_GROUP_CURSOR	24	480 Bytes	0%
RT_GROUP_ICON	1	48 Bytes	0%
RT_VERSION	1	368 Bytes	0%
RT_MANIFEST	1	1,235 Bytes	0.1%

Zertifikatsketten-Analyse

▼

Zertifikat Information

Dateiversion	4.52.0.462
Signaturdatum	05:57 PM 06/29/2016 (3265 Tage her)
Verifizierungsstatus	Signed
Unterzeichner	SOKNO S.R.L.; GlobalSign CodeSigning CA - G2; GlobalSign Root CA - R1
Gegenzeichner	GlobalSign TSA for MS Authenticode - G2; GlobalSign Timestamping CA - G2; GlobalSign Root CA - R1