Bootaa64 efi 文件恶意软件分析

技术分析

文件名	bootaa64.efi
文件类型	MS-DOS executable PE32+ executable (EFI application) Aarch64, for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-26 18:00:35 UTC

扫描另一个文件

文件识别

哈希类型	值	操作
MD5	e099b8f8463ef839720fda267e70eeb1
SHA1	267aa2e669faa8e7a63a7100b5891de011482a32
SHA256	211ebdcd7678738ed4000de1e8793a82fb53682e7c22901f8f04d4e046971216
SHA512	cf7e09a911df7cda0343888fd2cfe75693610e8d38762f7b47112b516103786af5b346d37d8d94bd55bafd0c89d761691f5889dc2605a3b291cc717c5497db29

PE 分析

基本信息

▼

映像基址	`0x00000000`
入口点	`0x0000484c`
编译时间	1970-01-01 00:00:00
校验和	0x00012296 (实际: 0x00012296)
操作系统版本	0.0
PEiD 签名	`MS-DOS executable PE32+ executable (EFI application) Aarch64, for MS Windows`
PDB 路径	`/home/runner/work/uefi-ntfs/uefi-ntfs/Build/RELEASE_GCC5/AARCH64/uefi-ntfs/DEBUG/uefi-ntfs.dll`
数字签名	Chain verification from CN=Microsoft Windows UEFI Driver Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US (serial:1137338005562705475813915578314585795855384660, sha1:cde9682204482806bb395bfc6a67670d71f67483) failed: Unable to build a validation path for the certificate "Common Name: Microsoft Windows UEFI Driver Publisher, Organization: Microsoft Corporation, Locality: Redmond, State/Province: Washington, Country: US" - no issuer matching "Common Name: Microsoft Corporation Third Party Marketplace Root, Organization: Microsoft Corporation, Locality: Redmond, State/Province: Washington, Country: US" was found
导入	0
导出	0 函数
资源	0 资源
节	2 节

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	20,480 bytes	20,480 bytes	5.79 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`0DE8E90630FB6E88A21FAF943515823D`
`.data`	`0x00006000`	4,096 bytes	4,096 bytes	0.83 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`836AD3C1F25ABFC5492A5E80AF5B7CC4`

证书链分析

▼

证书 Information

签名日期	10:38 PM 09/07/2023 (855 天前)
验证状态	A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider.
签名者	Microsoft Windows UEFI Driver Publisher; Microsoft Corporation UEFI CA 2011; Microsoft Corporation Third Party Marketplace Root
副签名者	Microsoft Time-Stamp Service; Microsoft Time-Stamp PCA 2010; Microsoft Root Certificate Authority 2010

证书链摘要

Microsoft Windows UEFI Driver Publisher #1 主要

有效期: 2023-02-16 20:19:57 → 2024-01-31 20:19:57

签名算法: sha256RSA

序列号: 33 00 00 00 54 49 80 07 AA BB F3 40 B2 00 01 00 00 00 54

Microsoft Corporation UEFI CA 2011 #2 链

有效期: 2011-06-27 21:22:45 → 2026-06-27 21:32:45

签名算法: sha256RSA

序列号: 61 08 D3 C4 00 00 00 00 00 04

Microsoft Time-Stamp Service #3 链

有效期: 2022-09-20 20:22:03 → 2023-12-14 20:22:03

签名算法: sha256RSA

序列号: 33 00 00 01 B3 FE 25 CE 29 1B 1B 8A 1C 00 01 00 00 01 B3

Microsoft Time-Stamp PCA 2010 #4 链

有效期: 2021-09-30 18:22:25 → 2030-09-30 18:32:25

签名算法: sha256RSA

序列号: 33 00 00 00 15 C5 E7 6B 9E 02 9B 49 99 00 00 00 00 00 15

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

Chain verification from CN=Microsoft Windows UEFI Driver Publisher, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US (serial:1137338005562705475813915578314585795855384660, sha1:cde9682204482806bb395bfc6a67670d71f67483) failed: Unable to build a validation path for the certificate "Common Name: Microsoft Windows UEFI Driver Publisher, Organization: Microsoft Corporation, Locality: Redmond, State/Province: Washington, Country: US" - no issuer matching "Common Name: Microsoft Corporation Third Party Marketplace Root, Organization: Microsoft Corporation, Locality: Redmond, State/Province: Washington, Country: US" was found

建议: 验证文件来源并确保它来自可信的发布者.

Bootaa64.efi 文件分析

技术分析

干净文件

扫描另一个文件

文件识别

PE 分析

基本信息

PE 节

证书链分析

证书 Information

证书链摘要

证书验证状态

记住：这是在线病毒扫描器的结果

保护您的系统

发表评论

Gridinsoft Anti-Malware