Co exe Adware InstallCore Malware Analyse: 55405f31f66e14569d3bd34d65e7e388

Co.exe Adware InstallCore Malware-Analyse

Aktualisiert 1 year ago

Geprüft von Malware Check

co.exe

Hash-Typ	Wert	Aktion
MD5	55405f31f66e14569d3bd34d65e7e388
SHA1	265910ac6a7769f3068fc969e40def3c75b78f3c
SHA256	e4786e76380f0cb6f1d1a1ca67774d518114951fa9d59b8ffdb8550991f110a6
SHA512	a213df1a3cf839d162e88b508c6e943cfebecc2dc6205129a4a509b7d4e23f2820e35b0d2a59597acfff81b53b1dc120a78f851ea78313c3a632879e935d91ca
ImpHash	5e78adb8cb4d0d5c058e95fd1db4ce38

Hash-Typ

Wert

Aktion

MD5

55405f31f66e14569d3bd34d65e7e388

SHA1

265910ac6a7769f3068fc969e40def3c75b78f3c

SHA256

e4786e76380f0cb6f1d1a1ca67774d518114951fa9d59b8ffdb8550991f110a6

SHA512

a213df1a3cf839d162e88b508c6e943cfebecc2dc6205129a4a509b7d4e23f2820e35b0d2a59597acfff81b53b1dc120a78f851ea78313c3a632879e935d91ca

ImpHash

5e78adb8cb4d0d5c058e95fd1db4ce38

PE-Analyse

Grundlegende Informationen

▼

Symbol	Hash: 5771b0fae29f38cac49fcbccd914d4c2 Unscharf: b7621093455d12c52d863db1873a2897 dHash: f0f0bed4d4d4f0f0
Bildbasis	`0x00400000`
Einstiegspunkt	`0x00b75e44`
Kompilierungszeit	2023-11-28 14:47:36
Prüfsumme	0x014eb41d (Tatsächlich: 0x014eb41d)
OS-Version	5.1
PEiD-Signaturen	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB-Pfad	`D:\develop\BitComet_2.05\app\Release_unicode\GUI_BitComet_wx.pdb`
Digitale Signatur	An error occurred while validating the countersignature: The root Certum Trusted Network CA 2 lists its extended key usages, but {(1, 3, 6, 1, 5, 5, 7, 3, 8)} are not present
Importe	21 Bibliotheken
Exporte	0 Funktionen
Ressourcen	154 Ressourcen
Abschnitte	7 Abschnitte

Digitale Signaturen

▼

Certum Trusted Network CA	Unizeto Technologies S.A. (PL)
Certum Timestamping 2021 CA	Asseco Data Systems S.A. (PL)
Certum Trusted Network CA 2	Asseco Data Systems S.A. (PL)
Certum Trusted Network CA 2	Asseco Data Systems S.A. (PL)
Certum Code Signing 2021 CA	Xing Wang (CN)

Versionsinformationen

▼

CompanyName	www.BitComet.com
FileDescription	BitComet - a BitTorrent Client
FileVersion	2.05
InternalName	BitComet.exe
LegalCopyright	Copyright(C) 2003-2023 All Rights Reserved.
ProductName	BitComet
ProductVersion	2.05
Translation	0x0409 0x04b0

PE-Abschnitte

▼

Name	Virtuelle Adresse	Virtuelle Größe	Rohgröße	Entropie	Eigenschaften	MD5
`.text`	`0x00001000`	13,449,140 bytes	13,449,216 bytes	6.68 (Komprimiert)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`31CEEE5C9F493BA9FF2663884F512088`
`.rdata`	`0x00cd5000`	4,637,346 bytes	4,637,696 bytes	5.60 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`CCDFCFA57437E09A073621EFC050269B`
`.data`	`0x01142000`	1,730,628 bytes	416,256 bytes	5.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`265C08EAE1B3F6B305B464554CB32F87`
`.detourc`	`0x012e9000`	4,544 bytes	4,608 bytes	3.97 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`13E08E8819E5FDA11776A799C7CAA563`
`.detourd`	`0x012eb000`	12 bytes	512 bytes	0.07 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`15D7BD12D01A5E1CC9BCFDA0DF81F640`
`.rsrc`	`0x012ec000`	2,278,712 bytes	2,278,912 bytes	7.94 (Gepackt/Verschlüsselt)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`07494C1A69326723E7ED9AEECA154FBD`
`.reloc`	`0x01519000`	1,100,768 bytes	1,100,800 bytes	6.53 (Komprimiert)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`449789C29B3E24AA5249139169ED1AF5`

Entropie-Analyse-Warnung

1 Abschnitt(e) mit hoher Entropie (≥7.5) erkannt - mögliche Packung/Verschlüsselung

2 Abschnitt(e) mit erhöhter Entropie (≥6.5) - mögliche Komprimierung

Ressourcenanalyse

▼

Gesamtressourcen: 154 (2,267,179 Bytes)

Ressourcentyp	Anzahl	Gesamtgröße	Prozentsatz
DLL	1	2,560 Bytes	0.1%
MHT	3	74,651 Bytes	3.3%
PNG	87	1,673,127 Bytes	73.8%
ZIP	7	321,401 Bytes	14.2%
RT_ICON	36	171,173 Bytes	7.6%
RT_GROUP_ICON	6	540 Bytes	0%
RT_VERSION	1	720 Bytes	0%
RT_HTML	12	22,213 Bytes	1%
RT_MANIFEST	1	794 Bytes	0%

Zertifikatsketten-Analyse

▼

Zertifikat #1

Betreff	Certum Trusted Network CA 2 Unizeto Technologies S.A. PL
Aussteller	Certum Trusted Network CA
Seriennummer	`36831864946870993744187066625231351079`

Zertifikat #2

Betreff	Certum Timestamp 2023 Asseco Data Systems S.A. PL
Aussteller	Certum Timestamping 2021 CA
Seriennummer	`12990091761336652031772869827997649713`

Zertifikat #3

Betreff	Certum Code Signing 2021 CA Asseco Data Systems S.A. PL
Aussteller	Certum Trusted Network CA 2
Seriennummer	`204220824695607667577196483744657304121`

Zertifikat #4

Betreff	Certum Timestamping 2021 CA Asseco Data Systems S.A. PL
Aussteller	Certum Trusted Network CA 2
Seriennummer	`308377848162979334299411899320923366791`

Zertifikat #5

Betreff	Xing Wang Xing Wang CN
Aussteller	Certum Code Signing 2021 CA
Seriennummer	`142540952136945333859675369454265582376`

Zertifikat-Verifizierungsstatus

An error occurred while validating the countersignature: The root Certum Trusted Network CA 2 lists its extended key usages, but {(1, 3, 6, 1, 5, 5, 7, 3, 8)} are not present

Empfehlung: Überprüfen Sie die Dateiquelle und stellen Sie sicher, dass sie von einem vertrauenswürdigen Herausgeber stammt.

Kommentar hinterlassen

Dateiname	co.exe
Dateityp	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner-Version	1.0.154.174
Datenbankversion	2024-01-08 18:01:56 UTC