Gridinsoft Logo
File Icon

SketchUp.exe Trojan Heuristic Analysis

Updated 1 year ago
Checked by Malware Check
SketchUp.exe

Technical Analysis

File Name SketchUp.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.155.174
Database Version 2024-01-19 02:02:18 UTC
⚠

Trojan.Heur!.00244033

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
29,634,080
File Size (bytes)
2024-01-19
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
28500484e24bcf37dd50ed55914ab5dc
SHA1
4a154ce67af7bce912a39e158ad12a5bb45e3b01
SHA256
44491bbc1ab53d8132eaa2330dfc903e2369881eae72cb34298366d4386c3807
SHA512
09a761a2bc2b57631287f740b09fb0a59ca71b769ccad712b15901e33ecf5c7ddccc56e5bc8c413c6c1ea2f1f0c924f8d1e7e03ede410e24459092f842e2b22e
ImpHash
b58795325f32d366b54ae1d84fcb83fb

PE Analysis

Basic Information

▼
Icon
Hash: d6dd3f577a9a44741166faad5ce534fd
Fuzzy: 331e5aadfe7e102734662ad03844dd6b
dHash: e88e272f16178ee8
Image Base 0x140000000
Entry Point 0x140b4bca4
Compilation Time 2023-02-01 23:23:18
Checksum 0x01c4e0b0 (Actual: 0x01c4e0b0)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path C:\bamboo\xml-data\build-dir\SU-SCR2023-WCB\sketchup\products\Release_x64\bin\sketchup\sketchup.pdb
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 18 libraries
Exports 1381 functions
Resources 1122 Resources
Sections 13 Sections

Digital Signatures

▼
DigiCert Trusted Root G4 DigiCert, Inc. (US)
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 Trimble Inc. (US)

Version Information

▼
Comments Release-Unicode version
CompanyName Trimble, Inc.
FileDescription SketchUp Application
FileVersion 23.0.367
InternalName SketchUp
LegalCopyright (c) 2023 Trimble, Inc.
OriginalFilename SketchUp.EXE
ProductName SketchUp Application
ProductVersion 23.0.367
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 17,405,294 bytes 17,405,440 bytes 6.42 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ A90A9BABFE9FEE4586A807212F6F33FD
jkl.text 0x0109b000 264,880 bytes 265,216 bytes 6.38 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ F91DF9B254418D5D7E60991225914F79
jkl.bss 0x010dc000 4,608 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
.rdata 0x010de000 7,746,450 bytes 7,746,560 bytes 6.43 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ EFEBD367FF848B38FB3832EB6F5D64D2
.data 0x01842000 881,280 bytes 724,992 bytes 3.50 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A1A6142D19C29F8D498A2063A5BF1107
.pdata 0x0191a000 940,392 bytes 940,544 bytes 6.85 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 139D59A0F5BE4DCF1774E1DA0759063C
jkl.data 0x01a00000 864 bytes 1,024 bytes 2.40 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D999051C37245ABC5D206FA81E91F21C
jkl.rdat 0x01a01000 19,984 bytes 20,480 bytes 6.92 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ BD4BEE9D482FB1BC7B2D1D3CEE40ABFA
jkl.xdat 0x01a06000 27,172 bytes 27,648 bytes 5.02 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 2D7E2D2DBF6110B277A8997560EBD672
jkl.pdat 0x01a0d000 18,252 bytes 18,432 bytes 4.78 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9614FB1DF0D91AE43D68CBA9541B5F56
.rsrc 0x01a12000 2,280,720 bytes 2,280,960 bytes 6.85 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C09EECEFEC93DE6DF2BBC5ABF1BA307B
.reloc 0x01c3f000 192,252 bytes 192,512 bytes 5.47 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 86AD3FCCB0FB0784AA7A3BAE40B922CC
.crdata 0x01c6e000 19 bytes 512 bytes 3.67 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 5491D239F35A6F4A6835F20DF3B45649
Entropy Analysis Alert

3 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 1122 (2,172,537 bytes)
Resource Type Count Total Size Percentage
AFX_DIALOG_LAYOUT 63 134 bytes
0%
FILE_DATA 56 183,126 bytes
8.4%
PNG 581 1,117,581 bytes
51.4%
REGISTRY 3 1,542 bytes
0.1%
STYLE_XML 5 83,741 bytes
3.9%
RT_CURSOR 12 3,696 bytes
0.2%
RT_BITMAP 47 159,048 bytes
7.3%
RT_ICON 21 440,485 bytes
20.3%
RT_MENU 15 12,786 bytes
0.6%
RT_DIALOG 187 112,698 bytes
5.2%
RT_STRING 106 53,154 bytes
2.4%
RT_ACCELERATOR 1 432 bytes
0%
RT_GROUP_CURSOR 12 240 bytes
0%
RT_GROUP_ICON 5 324 bytes
0%
RT_VERSION 1 824 bytes
0%
RT_MANIFEST 1 1,976 bytes
0.1%
None 6 750 bytes
0%

Certificate Chain Analysis

▼
Certificate #1
Subject DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
DigiCert, Inc.
US
Issuer DigiCert Trusted Root G4
Serial Number 11533403529598586876501374841704918745
Certificate #2
Subject Trimble Inc.
Trimble Inc.
US
Issuer DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Serial Number 6507074583347865154840523051864629071
Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.00244033 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.00244033 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware