{"id":"2e8b41fa32a27b1d3d583cd5d01e17fa","title":"SAP-CrystalReports — SAP-CrystalReports · 疑似DLL侧载组件 · PE32","md5":"2e8b41fa32a27b1d3d583cd5d01e17fa","sha256":"9088ef663fe6dc4da3727efabe183c5cb22235190a988517755d04c9cc4b64e9","family":"SAP-CrystalReports","apt":null,"verdict":null,"sample_type":"疑似DLL侧载组件","lang":"C++","file_format":"PE32","compiler":"MSVC","published_at":"2026-08-10T16:00:00.000Z","summary":"该样本为 SAP Crystal Reports 2017 运行时组件（wxWidgets HTML 渲染库），导出大量 wxHtml 类（wxHtmlWindow、wxHtmlListBox 等），含 D:\\crel\\src\\crystalreports.cpp 构建路径与 SAP Business Objects 标识，具 Symantec/DigiCert 代码签名。但其段名异常（.swn/.uoecn/.qvjthya/.enqtsdr 等混淆段名，非标准 .text/.rdata/.data），且 .swn 段熵高达 7.36，暗示该 DLL 可能被修改或打包（用于 DLL 侧载攻击）。同批次 MalwareBazaar 中存在 5 个相同大小（10,646,120 字节）的同类 DLL，进一步支持其为某 DLL 侧载攻击链的组成部分。需结合调用它的宿主程序判定。","url":"https://zseceye.com/report/2e8b41fa32a27b1d3d583cd5d01e17fa","json_url":"https://zseceye.com/report/2e8b41fa32a27b1d3d583cd5d01e17fa.json","html_url":"https://zseceye.com/report/2e8b41fa32a27b1d3d583cd5d01e17fa","hash_urls":{"md5":"https://zseceye.com/hash/2e8b41fa32a27b1d3d583cd5d01e17fa","sha256":"https://zseceye.com/hash/9088ef663fe6dc4da3727efabe183c5cb22235190a988517755d04c9cc4b64e9"},"search_urls":{"md5":"https://zseceye.com/?q=2e8b41fa32a27b1d3d583cd5d01e17fa","sha256":"https://zseceye.com/?q=9088ef663fe6dc4da3727efabe183c5cb22235190a988517755d04c9cc4b64e9"},"sample_download_url":"https://zseceye.com/report/2e8b41fa32a27b1d3d583cd5d01e17fa/sample","sample_filename":"9088ef66.zip","iocs":[],"ips":[]}