Rapport d'analyse de fichier Nextobot exe Trojan Convagent : 01584ef1d92e6de5952a03776cafaadb

Analyse technique

Nom du fichier	Nextobot.exe
Type de fichier	PE32+ executable (GUI) x86-64, for MS Windows
Version du scanner	1.0.153.174
Version de la base de données	2024-01-04 14:02:12 UTC

Scanner un autre fichier

Identification du fichier

Type de hachage	Valeur	Action
MD5	01584ef1d92e6de5952a03776cafaadb
SHA1	5288f8b5a5a2dfb78a55f999f5a32042a2205094
SHA256	33aa3a82ff9eac03b4d8b63dbc749146804cb5e9dacd7f3176db446b2250b965
SHA512	abbe2ce35af84d78ca40efd71f81fc5130d2618356093c18600f05fd9282f09ca2bdcebfe3ad68ca494e6a09a3d60859114387f90e4dfc637fe833438d186810
ImpHash	136c2b04aed0d667b0a58b05e7fc512a

Analyse PE

Informations de base

▼

Base d'image	`0x140000000`
Point d'entrée	`0x1400010f6`
Heure de compilation	2022-10-25 07:16:40
Somme de contrôle	0x00053d93 (Réel: 0x022483e8)
Version OS	4.0
Signatures PEiD	`PE32+ executable (GUI) x86-64, for MS Windows`
Signature numérique	The PE file does not contain a certificate table.
Importations	4 bibliothèques ADVAPI32, KERNEL32, ucrtbase, USER32
Exportations	0 fonctions
Ressources	0 Ressources
Sections	17 Sections

Sections PE

▼

Nom	Adresse virtuelle	Taille virtuelle	Taille brute	Entropie	Caractéristiques	MD5
`.text`	`0x00001000`	145,384 bytes	145,408 bytes	6.33 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`920F93A96921D77272AB9C533EF025E9`
`.data`	`0x00025000`	6,400 bytes	6,656 bytes	7.10 (Compressé)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A279123418414B68E43F917624C4469A`
`.rdata`	`0x00027000`	25,952 bytes	26,112 bytes	6.74 (Compressé)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5E705D333C95949AF40FF5D80E71B8D5`
`/4`	`0x0002e000`	4 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.pdata`	`0x0002f000`	2,592 bytes	3,072 bytes	4.48 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B3F2FB6C1E6E356B2B3F1EC889BD8F5C`
`.xdata`	`0x00030000`	3,060 bytes	3,072 bytes	4.65 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`87C4CC82C1DEFA671DD2DAD24A8C5322`
`.bss`	`0x00031000`	195,040 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00061000`	6,800 bytes	7,168 bytes	4.49 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`AFD027B4452EE1A7A66E983FC0BE495D`
`.CRT`	`0x00063000`	96 bytes	512 bytes	0.33 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7AEA5414B21264248AE8899E4D416635`
`.tls`	`0x00064000`	16 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.reloc`	`0x00065000`	328 bytes	512 bytes	3.65 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`38C06800E6E9DB7E2BECA32577867094`
`/14`	`0x00066000`	80 bytes	512 bytes	0.23 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`06F06D366BC8463600819DEF41A49F50`
`/29`	`0x00067000`	3,909 bytes	4,096 bytes	5.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`0A5A46E38AEF1E55056F5CD98D340DC8`
`/41`	`0x00068000`	175 bytes	512 bytes	2.13 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`3926A4E9348A2D2F293D468143DA249A`
`/55`	`0x00069000`	164 bytes	512 bytes	1.47 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`53E7A28F6D02416E530D565D1A1041DE`
`/67`	`0x0006a000`	131 bytes	512 bytes	2.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`9A0DAC6B3E8BBDD841746214E7562CA0`
`/78`	`0x0006b000`	399 bytes	512 bytes	4.18 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`9193E466DDD62869597A5F8438910DBC`

Alerte d'analyse d'entropie

2 section(s) avec entropie élevée (≥6.5) - compression possible

Analyse de la chaîne de certificats

▼

Aucune signature numérique

Ce fichier n'est pas signé numériquement.

Implications de sécurité:

Impossible de vérifier l'identité de l'éditeur
Risque de sécurité accru lors de l'exécution de ce fichier
Peut déclencher des avertissements de sécurité sur certains systèmes

⚠ Ce fichier n'a pas de signature numérique ou la chaîne de certificats n'a pas pu être vérifiée.
Soyez prudent lors de l'exécution de fichiers non signés provenant de sources inconnues.

Statut de vérification du certificat

The PE file does not contain a certificate table.

Recommandation: Vérifiez la source du fichier et assurez-vous qu'il provient d'un éditeur de confiance.

Nextobot.exe Trojan Convagent - Rapport d'analyse