Wmpshare exe (Windows Media Player Folder Sharing Executable) Microsoft Corporation 文件恶意软件分析

Wmpshare.exe (Windows Media Player Folder Sharing Executable) 文件分析

更新于 28 days ago

检查者 Malware Check

wmpshare.exe

哈希类型	值	操作
MD5	49e35f883b8ac8cf4400b7e06b4e31e4
SHA1	d998cf547d6d809b7ab7e588d6851726bd555cdf
SHA256	10f8f6bd0af6f336c65d42a69cb40ce1df2ad888e2cbda6e9d4abdbef1693720
SHA512	c7f4bd38cf40b071b9e6b4acd2bebc5ade9b0e3565d95aee0cd3f88af46bc01b5dfae56b7ff30bf8053f7e569e02a14f33c544a11061344d8a24e0c6b02b8c5e
ImpHash	e770650ede265297c15295f3b2b4ff96

哈希类型

值

操作

MD5

49e35f883b8ac8cf4400b7e06b4e31e4

SHA1

d998cf547d6d809b7ab7e588d6851726bd555cdf

SHA256

10f8f6bd0af6f336c65d42a69cb40ce1df2ad888e2cbda6e9d4abdbef1693720

SHA512

c7f4bd38cf40b071b9e6b4acd2bebc5ade9b0e3565d95aee0cd3f88af46bc01b5dfae56b7ff30bf8053f7e569e02a14f33c544a11061344d8a24e0c6b02b8c5e

ImpHash

e770650ede265297c15295f3b2b4ff96

PE 分析

基本信息

▼

图标	哈希: 23d74b5f76639ee6446bf7f659c73577 模糊: e1d160e2dd1e7084855a364fed211b9f dHash: 00f0e6c8d8c8e6e0
映像基址	`0x00400000`
入口点	`0x00401db0`
编译时间	2046-09-23 15:12:34
校验和	0x00029398 (实际: 0x00029398)
操作系统版本	10.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB 路径	`wmpshare.pdb`
数字签名	No valid SignedData structure was found.
导入	4 库 KERNEL32, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-private-l1-1-0, api-ms-win-crt-string-l1-1-0
导出	0 函数
资源	19 资源
节	6 节

版本信息

▼

CompanyName	Microsoft Corporation
FileDescription	Windows Media Player Folder Sharing Executable
FileVersion	12.0.26100.1882 (WinBuild.160101.0800)
InternalName	wmpshare.exe
LegalCopyright	© Microsoft Corporation. All rights reserved.
OriginalFilename	wmpshare.exe
ProductName	Microsoft® Windows® Operating System
ProductVersion	12.0.26100.1882
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	6,824 bytes	7,168 bytes	5.64 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`245AC3B032233B3640CBE1877F45E065`
`.data`	`0x00003000`	1,088 bytes	512 bytes	0.20 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`64CCCB08B4F8046AE13B77F83C563DB2`
`.idata`	`0x00004000`	1,778 bytes	2,048 bytes	4.63 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`95E0164A337326A8E6D3F77F26ECC58D`
`.didat`	`0x00005000`	12 bytes	512 bytes	0.11 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`056D15E06DA50D2DE33BB8E1F7F93942`
`.rsrc`	`0x00006000`	94,736 bytes	95,232 bytes	6.45 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1C360008D65564EABE5AFB76979265EC`
`.reloc`	`0x0001e000`	492 bytes	512 bytes	6.08 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`DB6C359685F1A956C0FB21CE52765258`

资源分析

▼

资源总数: 19 (93,666 字节)

资源类型	数量	总大小	百分比
RT_ICON	16	91,799 字节	98%
RT_GROUP_ICON	1	230 字节	0.2%
RT_VERSION	1	980 字节	1%
RT_MANIFEST	1	657 字节	0.7%

证书链分析

▼

证书 Information

产品	Microsoft® Windows® Operating System
描述	Windows Media Player Folder Sharing Executable
文件版本	12.0.26100.1882 (WinBuild.160101.0800)
原始名称	wmpshare.exe
内部名称	wmpshare.exe
版权	© Microsoft Corporation. All rights reserved.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	wmpshare.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-13 16:00:30 UTC

Wmpshare.exe (Windows Media Player Folder Sharing Executable) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别