Der gbpsv exe (G Buster Browser Defense Service) GAS Tecnologia Malware Analyse

Der gbpsv.exe (G-Buster Browser Defense - Service) Scan-Bericht

Aktualisiert 1 year ago

Geprüft von Malware Check

gbpsv.exe

Hash-Typ	Wert	Aktion
MD5	1aa4c26b7f5dc9b39cfd196934cb8a79
SHA1	92ad8aa0888f1ad4d71fd6bc7b6434be3cbb2af3
SHA256	71eb0797db8de8ff5a9fe84b5568cd728b4b089537e4e1b5fd55b42de8b3fa07
SHA512	54f48d02d7597c2f535b05580852c8869706227b215acc8a8f291d6b0596fbb3841810cccd0cbeab166957d8b31fa0c09bd945937acc3f587444853bb238c30b
ImpHash	d379682e54286be7f3bcb6b807919bfd

Hash-Typ

Wert

Aktion

MD5

1aa4c26b7f5dc9b39cfd196934cb8a79

SHA1

92ad8aa0888f1ad4d71fd6bc7b6434be3cbb2af3

SHA256

71eb0797db8de8ff5a9fe84b5568cd728b4b089537e4e1b5fd55b42de8b3fa07

SHA512

54f48d02d7597c2f535b05580852c8869706227b215acc8a8f291d6b0596fbb3841810cccd0cbeab166957d8b31fa0c09bd945937acc3f587444853bb238c30b

ImpHash

d379682e54286be7f3bcb6b807919bfd

PE-Analyse

Grundlegende Informationen

▼

Symbol	Hash: 5aa6ec19aab9441ad7fdf7e44fcc7711 Unscharf: 3345b047b0fcc0f16cce008d3fb58dc7 dHash: c8c0f0f0f0c64860
Bildbasis	`0x00400000`
Einstiegspunkt	`0x0053feaa`
Kompilierungszeit	2015-11-16 10:32:32
Prüfsumme	0x0009b1e7 (Tatsächlich: 0x0009b1e7)
OS-Version	5.0
PEiD-Signaturen	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB-Pfad	`F:\buildagent\workspace\root\GbPlugin\RB\GbpSv\src\main\GbpSv\GbpSv.pdb`
Digitale Signatur	OK
Importe	6 Bibliotheken KERNEL32, USER32, ADVAPI32, ole32, OLEAUT32, FLTLIB
Exporte	0 Funktionen
Ressourcen	4 Ressourcen
Abschnitte	9 Abschnitte

Digitale Signaturen

▼

Thawte Timestamping CA	Symantec Corporation (US)
Symantec Time Stamping Services CA - G2	Symantec Corporation (US)
VeriSign Class 3 Code Signing 2010 CA	GAS INFORMATICA LTDA (BR)
VeriSign Class 3 Public Primary Certification Authority - G5	VeriSign, Inc. (US)

Versionsinformationen

▼

Comments
CompanyName	GAS Tecnologia
FileDescription	G-Buster Browser Defense - Service
FileVersion	3.9.3.0
InternalName	GbpSv
LegalCopyright	Copyright © 2003-2015, ® GAS Tecnologia
LegalTrademarks	GbpSv
OriginalFilename	GbpSv.exe
PrivateBuild
ProductName	Gbp Service
ProductVersion	3.9.3.0
SpecialBuild
Translation	0x0416 0x04b0

PE-Abschnitte

▼

Name	Virtuelle Adresse	Virtuelle Größe	Rohgröße	Entropie	Eigenschaften	MD5
`.text`	`0x00001000`	706,422 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`CODE`	`0x000ae000`	134,560 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000cf000`	283,448 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x00115000`	59,644 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`DATA`	`0x00124000`	5,344 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`BSS`	`0x00126000`	1,889 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.gas0`	`0x00127000`	12,070 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.gas1`	`0x0012a000`	578,172 bytes	578,560 bytes	7.93 (Gepackt/Verschlüsselt)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1268DD01FA75575B2B9D4714C586675F`
`.rsrc`	`0x001b8000`	3,810 bytes	4,096 bytes	3.68 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`93F26FE46DC4A0CAD0DA8325B4FABC5D`

Entropie-Analyse-Warnung

1 Abschnitt(e) mit hoher Entropie (≥7.5) erkannt - mögliche Packung/Verschlüsselung

Ressourcenanalyse

▼

Gesamtressourcen: 4 (3,506 Bytes)

Ressourcentyp	Anzahl	Gesamtgröße	Prozentsatz
RT_ICON	1	2,216 Bytes	63.2%
RT_GROUP_ICON	1	20 Bytes	0.6%
RT_VERSION	1	924 Bytes	26.4%
RT_MANIFEST	1	346 Bytes	9.9%

Zertifikatsketten-Analyse

▼

Zertifikat #1

Betreff	Symantec Time Stamping Services CA - G2 Symantec Corporation US
Aussteller	Thawte Timestamping CA
Seriennummer	`168250781398245547403531165097821404219`

Zertifikat #2

Betreff	Symantec Time Stamping Services Signer - G4 Symantec Corporation US
Aussteller	Symantec Time Stamping Services CA - G2
Seriennummer	`19688950797630895426199952712430983760`

Zertifikat #3

Betreff	GAS INFORMATICA LTDA GAS INFORMATICA LTDA BR
Aussteller	VeriSign Class 3 Code Signing 2010 CA
Seriennummer	`64278746113979638716529943560060036794`

Zertifikat #4

Betreff	VeriSign Class 3 Code Signing 2010 CA VeriSign, Inc. US
Aussteller	VeriSign Class 3 Public Primary Certification Authority - G5
Seriennummer	`109001353806506068745144901449045193671`

Zertifikat-Verifizierungsstatus

Denken Sie daran: Dies ist das Ergebnis des Online-Virenscanners

Gridinsoft Anti-Malware verfügt über eine viel leistungsstärkere Virenscanning-Engine. Wir empfehlen, sie für eine genauere Diagnose infizierter Systeme zu verwenden. Diese kurze Anleitung hilft Ihnen bei der Installation unseres Flaggschiffprodukts für eine genauere Diagnose:

Anti-Malware herunterladen

Kommentar hinterlassen

Dateiname	gbpsv.exe
Dateityp	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner-Version	1.0.143.174
Datenbankversion	2023-10-18 00:02:19 UTC