Libwinpthread 1 dll Trojan Agent 文件恶意软件分析: 6c07a6a45cdee678764d5488b8b58c4c

Libwinpthread-1.dll Trojan Agent 分析

更新于 2 months ago

检查者 Malware Check

libwinpthread-1.dll

哈希类型	值	操作
MD5	6c07a6a45cdee678764d5488b8b58c4c
SHA1	9945015ce526d91ebbcdaa988dec5a81484b0a1e
SHA256	28dc5a59b7e54c66dc05328439cd3f89c40924b709b17ce2d7f057f9d7954fa6
SHA512	61ad48c9c6a0dd5095fb10e8a812a84f45e77c1a1e4f614b1e2e20571870bbe44d95904cece4930782bbd942223d3059830c82940a0160992e3d2ca3ed92d68a
ImpHash	a4f0d1347d345de7c16f87077c75bfb6

哈希类型

值

操作

MD5

6c07a6a45cdee678764d5488b8b58c4c

SHA1

9945015ce526d91ebbcdaa988dec5a81484b0a1e

SHA256

28dc5a59b7e54c66dc05328439cd3f89c40924b709b17ce2d7f057f9d7954fa6

SHA512

61ad48c9c6a0dd5095fb10e8a812a84f45e77c1a1e4f614b1e2e20571870bbe44d95904cece4930782bbd942223d3059830c82940a0160992e3d2ca3ed92d68a

ImpHash

a4f0d1347d345de7c16f87077c75bfb6

PE 分析

基本信息

▼

映像基址	`0x2307a0000`
入口点	`0x2307a11f0`
编译时间	2025-10-25 23:48:45
校验和	0x002322f7 (实际: 0x002322f7)
操作系统版本	4.0
PEiD 签名	`PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows`
数字签名	No valid SignedData structure was found.
导入	4 库 bcrypt, KERNEL32, msvcrt, USER32
导出	156 函数
资源	2 资源
节	11 节

版本信息

▼

CompanyName	Innovation Web Max Corp
FileDescription	Fast Viewer Comprehensive
FileVersion	8.6.32.2463
InternalName	excellence_neural_ultimate
LegalCopyright	Copyright (C) 2022 Innovation Web Max Corp
OriginalFilename	excellence_neural_ultimate.exe
ProductName	Excellence Neural Ultimate Inspector
ProductVersion	8.6.32.2463
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	537,056 bytes	537,088 bytes	5.62 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`229F8DC5D044C416AC176C45A8D58E3E`
`.data`	`0x00085000`	82,832 bytes	82,944 bytes	4.04 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1D24031F45FE70649AE7D42E753390B7`
`.rdata`	`0x0009a000`	1,395,128 bytes	1,395,200 bytes	4.15 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`38882D65DF41C30E3792530D72594943`
`.pdata`	`0x001ef000`	125,976 bytes	126,464 bytes	5.85 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`CE6CD51636EF7E5AA6AF947D2A12550E`
`.xdata`	`0x0020e000`	108,416 bytes	108,544 bytes	3.15 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6E5AC0E625F00B87BCF503EEFDEB5F77`
`.bss`	`0x00229000`	2,880 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.edata`	`0x0022a000`	4,971 bytes	5,120 bytes	5.01 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2088489EC256192CFBFF7CDA5C71DBCD`
`.idata`	`0x0022c000`	3,032 bytes	3,072 bytes	4.45 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`55A614C31E73C5CE990ED67C924554AC`
`.tls`	`0x0022d000`	16 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x0022e000`	1,464 bytes	1,536 bytes	3.97 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4F0CD46FEAA495B4C73E0E8271C2970B`
`.reloc`	`0x0022f000`	20,696 bytes	20,992 bytes	5.43 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`FFEA7F70BD67F5DFB02FA44BD9D7F0FA`

资源分析

▼

资源总数: 2 (1,296 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	932 字节	71.9%
RT_MANIFEST	1	364 字节	28.1%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	libwinpthread-1.dll
文件类型	PE32+ executable (DLL) (console) x86-64 (stripped to external PDB), for MS Windows
扫描器版本	1.0.228.174
数据库版本	2025-11-02 10:00:21 UTC

Libwinpthread-1.dll Trojan Agent 分析

技术分析

Trojan.Win64.Agent.sa

扫描另一个文件

文件识别