FastEx11 dll (Shell Extension for FastCopy) FastCopy Lab, LLC 文件恶意软件分析

FastEx11.dll (Shell Extension for FastCopy) 文件分析

更新于 1 month ago

检查者 Malware Check

FastEx11.dll

哈希类型	值	操作
MD5	627033483cfc93a3786332bbf547c758
SHA1	056a3a2f040949699499fa8f2d95130ddad08520
SHA256	3087e2d93dc1f458f38c9b74c10e006109497c169ba6c628038590b12b153009
SHA512	c6e8d88267be849f3be53f7594a866a59187145d0c7ff73ec23e4bd64047b97ae8e32247f158ce33faa86f2c892d88f42a7c3b871e66c610ef0975a7e15ae94c
ImpHash	48947328592d50da3c61b15285f1c931

哈希类型

值

操作

MD5

627033483cfc93a3786332bbf547c758

SHA1

056a3a2f040949699499fa8f2d95130ddad08520

SHA256

3087e2d93dc1f458f38c9b74c10e006109497c169ba6c628038590b12b153009

SHA512

c6e8d88267be849f3be53f7594a866a59187145d0c7ff73ec23e4bd64047b97ae8e32247f158ce33faa86f2c892d88f42a7c3b871e66c610ef0975a7e15ae94c

ImpHash

48947328592d50da3c61b15285f1c931

PE 分析

基本信息

▼

图标	哈希: a6e68bb924bae484ea96c226695d245a 模糊: be36e9241c67fd47fbdb27959bfe5ef6 dHash: e8e8b632da1ab8e4
映像基址	`0x180000000`
入口点	`0x18001fa40`
编译时间	2025-01-27 13:23:34
校验和	0x000654c3 (实际: 0x000654c3)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
PDB 路径	`C:\FastCopy\x64\Obj\ReleaseShl2\FastEx11.pdb`
数字签名	OK
导入	16 库
导出	14 函数
资源	7 资源
节	7 节

版本信息

▼

Comments	https://fastcopy.jp
CompanyName	FastCopy Lab, LLC.
FileDescription	Shell Extension for FastCopy
FileVersion	5.8.1.0
InternalName	Shell Extension for FastCopy
LegalCopyright	Copyright (C) 2004-2025 SHIROUZU Hiroaki and FastCopy Lab, LLC. All rights reserved.
OriginalFilename	fastext1.dll
ProductName	Shell Extension for FastCopy
ProductVersion	5.8.1.0
Translation	0x0411 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	219,519 bytes	219,648 bytes	6.74 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2A88AF410964565885B923B9C0D15438`
`.rdata`	`0x00037000`	95,592 bytes	95,744 bytes	5.55 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D7032CC1E35F8AE44BB23E88AEE7CB52`
`.data`	`0x0004f000`	91,680 bytes	7,680 bytes	4.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`20D0A0A83C30A542B1A1B276B118F196`
`.pdata`	`0x00066000`	9,912 bytes	10,240 bytes	5.51 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B690AF0DE24A680DE5D0919F4F02230A`
`.fptable`	`0x00069000`	256 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x0006a000`	3,568 bytes	3,584 bytes	4.31 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7922DA3A1146CAF8EE19FAF8E8DF7F71`
`.reloc`	`0x0006b000`	2,232 bytes	2,560 bytes	5.13 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`36E92A836A6F61742F696B182262C9CD`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 7 (3,117 字节)

资源类型	数量	总大小	百分比
RT_ICON	1	872 字节	28%
RT_STRING	3	828 字节	26.6%
RT_GROUP_ICON	1	20 字节	0.6%
RT_VERSION	1	1,016 字节	32.6%
RT_MANIFEST	1	381 字节	12.2%

证书链分析

▼

证书 Information

产品	Shell Extension for FastCopy
描述	Shell Extension for FastCopy
文件版本	5.8.1.0
原始名称	fastext1.dll
签名日期	01:24 PM 01/27/2025 (348 天前)
验证状态	Signed
签名者	FastCopy Lab, LLC.; Microsoft ID Verified CS AOC CA 02; Microsoft ID Verified Code Signing PCA 2021; Microsoft Identity Verification Root Certificate Authority 2020
副签名者	Microsoft Public RSA Time Stamping Authority; Microsoft Public RSA Timestamping CA 2020; Microsoft Identity Verification Root Certificate Authority 2020
内部名称	Shell Extension for FastCopy
版权	Copyright (C) 2004-2025 SHIROUZU Hiroaki and FastCopy Lab, LLC. All rights reserved.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

发表评论

文件名	FastEx11.dll
文件类型	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
扫描器版本	1.0.229.174
数据库版本	2025-11-13 16:00:17 UTC

FastEx11.dll (Shell Extension for FastCopy) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别