The SASPlanet exe SAS Group File Malware Analysis

The SASPlanet.exe File Analysis

Updated 4 days ago

Checked by Malware Check

SASPlanet.exe

Hash Type	Value	Action
MD5	3c5ad39dd120ca3c40f563b7b8b2cec7
SHA1	b9e7e2c9404646162995ea10a6ab37e50c1df1ac
SHA256	49e9f9d8f83e4bbff66d254dced50740c31155c333207c3ef31043f54f7b9753
SHA512	fbd86785b9541ec107426ce2f4842a70c21952ce46674ed4e7466f408497ae35e023220b30637801a34f7cc78eb5fa5824021f4842b15ffe894884637f2d4352
ImpHash	f5029871e16e0a4265e760cadc3d0d52

Hash Type

Value

Action

MD5

3c5ad39dd120ca3c40f563b7b8b2cec7

SHA1

b9e7e2c9404646162995ea10a6ab37e50c1df1ac

SHA256

49e9f9d8f83e4bbff66d254dced50740c31155c333207c3ef31043f54f7b9753

SHA512

fbd86785b9541ec107426ce2f4842a70c21952ce46674ed4e7466f408497ae35e023220b30637801a34f7cc78eb5fa5824021f4842b15ffe894884637f2d4352

ImpHash

f5029871e16e0a4265e760cadc3d0d52

PE Analysis

Basic Information

▼

Icon	Hash: caf4f9e460fc43e4c2b9520962fdf4d4 Fuzzy: e473257129efceb463717e65c1ae8f68 dHash: b268ccf4dc4d69b2
Image Base	`0x00400000`
Entry Point	`0x016a6d90`
Compilation Time	2025-05-05 05:41:22
Checksum	0x00000000 (Actual: 0x017469ad)
OS Version	5.0
PEiD Signatures	`PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	27 libraries
Exports	3 functions
Resources	281 Resources
Sections	11 Sections

Version Information

▼

CompanyName	SAS Group
FileDescription
FileVersion	25.5.5.10764
InternalName	SAS.Planet
LegalCopyright	SAS Group
LegalTrademarks	SAS.Planet
OriginalFilename	SASPlanet.exe
ProductName	SAS.Planet
ProductVersion	1.0.0.0
Comments
Translation	0x0409 0x04e4

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	19,787,680 bytes	19,787,776 bytes	5.82 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D6317465DD8759E2142DA8019B16E99E`
`.data`	`0x012e0000`	1,676,176 bytes	1,676,288 bytes	5.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A603824ACA52BD6CA082C470EF9CD358`
`.bss`	`0x0147a000`	622,936 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x01513000`	30,408 bytes	30,720 bytes	4.60 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`715DD5004428DF605BBCC578209674A7`
`.didata`	`0x0151b000`	37,592 bytes	37,888 bytes	4.13 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`882173CA9AF533DCF0672E60F6CF3B21`
`.edata`	`0x01525000`	155 bytes	512 bytes	2.01 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`99E737A4967AA3F56B7BB97EEBCC7984`
`.tls`	`0x01526000`	928 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x01527000`	109 bytes	512 bytes	1.43 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1AEECB70C558F0F0D10CD61316A25F07`
`.reloc`	`0x01528000`	834,128 bytes	834,560 bytes	6.45 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`E679959ED64FAF6D7A41E07BD9CB0ED1`
`.pdata`	`0x015f4000`	965,616 bytes	965,632 bytes	6.81 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`044620F8D899810CB5F05480C0B74AF8`
`.rsrc`	`0x016e0000`	1,032,704 bytes	1,032,704 bytes	6.56 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C8475C66E3B6AA705F7ECE196992A77D`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 281 (1,013,891 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	8	2,464 bytes	0.2%
RT_BITMAP	26	16,144 bytes	1.6%
RT_ICON	6	102,032 bytes	10.1%
RT_DIALOG	2	164 bytes	0%
RT_STRING	99	70,266 bytes	6.9%
RT_RCDATA	124	820,391 bytes	80.9%
RT_GROUP_CURSOR	8	160 bytes	0%
RT_GROUP_ICON	6	120 bytes	0%
RT_VERSION	1	756 bytes	0.1%
RT_MANIFEST	1	1,394 bytes	0.1%

Certificate Chain Analysis

▼

Certificate Information

Product	SAS.Planet
File Version	25.5.5.10764
Original Name	SASPlanet.exe
Internal Name	SAS.Planet
Copyright	SAS Group

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	SASPlanet.exe
File Type	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Scanner Version	1.0.224.174
Database Version	2025-09-02 22:00:40 UTC

The SASPlanet.exe File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification