Gridinsoft Logo
File Icon

SketchUp.exe Trojan Heuristic Analysis

Updated 2 months ago
Checked by Malaware Check
SketchUp.exe

Technical Analysis

File Name SketchUp.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.212.174
Database Version 2025-04-02 01:00:25 UTC
⚠

Trojan.Heur!.00046033

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
40,375,432
File Size (bytes)
2025-04-02
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
57b805d38a9194908d69cc825f8c4aaa
SHA1
8edc91313e16dd0d6f296c9b587d9c011d2261c2
SHA256
2333644166c1a067f87ba2e91e1555a881022489b4d78dd78773d25bd41a590f
SHA512
6211bf320b6e5b16277de975f959277812be55f722142e87666469f73600cef2ecef8c4ff809fb5282f0b5ef1d25cc70e62dc60dc4fb429ea02e32257303ca40
ImpHash
e5e32df682ce6f4419788ec7678998f6

PE Analysis

Basic Information

▼
Icon
Hash: d6dd3f577a9a44741166faad5ce534fd
Fuzzy: 331e5aadfe7e102734662ad03844dd6b
dHash: e88e272f16178ee8
Image Base 0x140000000
Entry Point 0x140cdbd20
Compilation Time 2025-03-10 17:48:14
Checksum 0x026819c9 (Actual: 0x0268887d)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path C:\bamboo\xml-data\build-dir\SU-SCR25-WCB\sketchup\products\Release_x64\bin\sketchup\sketchup.pdb
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 28 libraries
Exports 1198 functions
Resources 100 Resources
Sections 9 Sections

Version Information

▼
Comments Release-Unicode version
CompanyName Trimble, Inc.
FileDescription SketchUp Application
FileVersion 25.0.575
InternalName SketchUp
LegalCopyright (c) 2025 Trimble, Inc.
OriginalFilename SketchUp.EXE
ProductName SketchUp Application
ProductVersion 25.0.575
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 23,615,244 bytes 23,615,488 bytes 6.39 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 9A3FF545C84C3B4FD7159C5CB8F22636
.rdata 0x01687000 12,598,680 bytes 12,598,784 bytes 6.31 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ E5B6411EDA71BBBBE5A49ABC97F55F46
.data 0x0228b000 2,392,832 bytes 1,930,752 bytes 6.77 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 40F16E4984803ACB8D33B9E1D729B6EB
.pdata 0x024d4000 1,171,704 bytes 1,171,968 bytes 6.93 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 153A973EEBC2205CF896AF3B1E7A6BA9
.qtversi 0x025f3000 16 bytes 512 bytes 0.30 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 5FC4962F2BA670643115D4EFF0074332
_RDATA 0x025f4000 48 bytes 512 bytes 0.41 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 83C991EB2F9CC11EA1EEE9E805059F7B
.rsrc 0x025f5000 843,128 bytes 843,264 bytes 4.51 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 546D01D6FD35AA6219EF97BD8C4C9CD9
.reloc 0x026c3000 203,144 bytes 203,264 bytes 5.47 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 89F42367888E08F6650507D24D30F2B0
.crdata 0x026f5000 19 bytes 512 bytes 5.00 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ FB64B5A7A512CBB87072C2AB6EF31428
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 100 (832,749 bytes)
Resource Type Count Total Size Percentage
FILE_DATA 88 402,246 bytes
48.3%
RT_ICON 9 428,229 bytes
51.4%
RT_GROUP_ICON 1 132 bytes
0%
RT_VERSION 1 824 bytes
0.1%
RT_MANIFEST 1 1,318 bytes
0.2%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.00046033 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.00046033 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware