Gridinsoft Logo
File Icon

SketchUp.exe Trojan Heuristic Analysis

Updated 2 months ago
Checked by Malware Check
SketchUp.exe

Technical Analysis

File Name SketchUp.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.227.174
Database Version 2025-10-16 19:00:17 UTC
⚠

Trojan.Heur!.00046033

Malware family: Heuristic

Heuristic detection uses behavioral analysis and pattern recognition to identify potential threats without specific signatures. This proactive approach detects suspicious code behavior that may indicate malware presence. Detection may occasionally produce false positives when legitimate software exhibits similar behavioral patterns.
N/A
Detection Rate
44,027,600
File Size (bytes)
2025-10-16
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
3f1b40973d88f7a2e5d5a56ddde155a9
SHA1
cc41c7e8cc95e09c5246a8b1aa3ce8258354e019
SHA256
ec7b6333d9759cbaadbb04a0e68a2338168c0b3361a6251c6f6c8884361934f6
SHA512
ddda6de71b0dbd109f14d491d972c51745103e03957e154d817149ef2ac7c3387467a994429a4d09857de6b78cf5bb1e3ad43f2b619a4ad4677a8d0c8616e41c
ImpHash
2c448c4afa54e81816fdae3c70769f4e

PE Analysis

Basic Information

▼
Icon
Hash: d6dd3f577a9a44741166faad5ce534fd
Fuzzy: 331e5aadfe7e102734662ad03844dd6b
dHash: e88e272f16178ee8
Image Base 0x140000000
Entry Point 0x140e0ee2c
Compilation Time 2025-09-29 21:53:59
Checksum 0x02a0ce3a (Actual: 0x02a038be)
OS Version 6.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
PDB Path C:\bamboo\xml-data\build-dir\SU-SCR26-WCB\sketchup\products\Release_x64\bin\sketchup\sketchup.pdb
Digital Signature The expected hash does not match the digest in SpcInfo
Imports 24 libraries
Exports 1206 functions
Resources 106 Resources
Sections 9 Sections

Version Information

▼
Comments Release-Unicode version
CompanyName Trimble, Inc.
FileDescription SketchUp Application
FileVersion 26.0.429
InternalName SketchUp
LegalCopyright (c) 2025 Trimble, Inc.
OriginalFilename SketchUp.EXE
ProductName SketchUp Application
ProductVersion 26.0.429
Translation 0x0409 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 25,203,360 bytes 25,203,712 bytes 6.40 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ DF1D3DA4DCDD9561F26901F6DCC216D2
.rdata 0x0180b000 14,303,166 bytes 14,303,232 bytes 6.35 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ FB103F7B1EDE6BC5EF69DD5061ED8B94
.data 0x025af000 2,634,656 bytes 2,155,008 bytes 6.71 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C6E3DF61B19FA1EE416648C5CD2D6079
.pdata 0x02833000 1,266,336 bytes 1,266,688 bytes 6.96 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ F140F3F0699F2CD7DB3AA1CC6BF5D283
.qtversi 0x02969000 16 bytes 512 bytes 0.32 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ 7017A7B3FF2172C67CE52247673C55FE
_RDATA 0x0296a000 48 bytes 512 bytes 0.41 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 83C991EB2F9CC11EA1EEE9E805059F7B
.rsrc 0x0296b000 873,616 bytes 873,984 bytes 4.52 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ EB49D7C835D6ED7D10E226A414A6582C
.reloc 0x02a41000 213,500 bytes 213,504 bytes 5.48 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ D8C59A57E1375EFC7434EA2E78438ECA
.crdata 0x02a76000 19 bytes 512 bytes 1.50 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 72D643C7949A049FCF52E4862A9FAC99
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 106 (862,468 bytes)
Resource Type Count Total Size Percentage
FILE_DATA 94 431,965 bytes
50.1%
RT_ICON 9 428,229 bytes
49.7%
RT_GROUP_ICON 1 132 bytes
0%
RT_VERSION 1 824 bytes
0.1%
RT_MANIFEST 1 1,318 bytes
0.2%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Heur!.00046033 Removal

Gridinsoft has the capability to identify and eliminate Trojan.Heur!.00046033 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware