WordPad Setup exe (WordPad for Windows 11) Winaero 文件恶意软件分析

WordPad_Setup.exe (WordPad for Windows 11) 文件分析

更新于 3 days ago

检查者 Malaware Check

WordPad_Setup.exe

哈希类型	值	操作
MD5	bfacbab2ada55a7268d476893b54ba8c
SHA1	ba5dbb5cbd8ee8eaf11125a7f6f6d5137b672774
SHA256	3094d34796e392f0a38152e4efab031b3bbb963fcd791d843cf56fc3d8cd1ccc
SHA512	b40a968b911d93f073fe2a652eaa4267f39824775bd1450583ca912809c50813efd429f22ece8b46d964477ff7039e47708558e6982e07aa6835e3e626b73d02
ImpHash	e569e6f445d32ba23766ad67d1e3787f

哈希类型

值

操作

MD5

bfacbab2ada55a7268d476893b54ba8c

SHA1

ba5dbb5cbd8ee8eaf11125a7f6f6d5137b672774

SHA256

3094d34796e392f0a38152e4efab031b3bbb963fcd791d843cf56fc3d8cd1ccc

SHA512

b40a968b911d93f073fe2a652eaa4267f39824775bd1450583ca912809c50813efd429f22ece8b46d964477ff7039e47708558e6982e07aa6835e3e626b73d02

ImpHash

e569e6f445d32ba23766ad67d1e3787f

PE 分析

基本信息

▼

图标	哈希: 48e6c567a546dd3a7d7f2575f6ac9140 模糊: 6aba3f3b578330342fc664d69053008c dHash: d4d4d4c4ccc4c4d4
映像基址	`0x00400000`
入口点	`0x004b5eec`
编译时间	2022-04-14 16:10:23
校验和	0x00000000 (实际: 0x002d7172)
操作系统版本	6.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	7 库 kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
导出	3 函数
资源	33 资源
节	10 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Winaero
FileDescription	WordPad for Windows 11
FileVersion	1.0
LegalCopyright	Winaero
OriginalFileName
ProductName	WordPad for Windows 11
ProductVersion	1.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	735,716 bytes	735,744 bytes	6.36 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`43AF0A9476CA224D8E8461F1E22C94DA`
`.itext`	`0x000b5000`	5,768 bytes	6,144 bytes	5.97 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`185E04B9A1F554E31F7F848515DC890C`
`.data`	`0x000b7000`	14,244 bytes	14,336 bytes	5.05 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`CAB2107C933B696AA5CF0CC6C3FD3980`
`.bss`	`0x000bb000`	28,136 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c2000`	4,060 bytes	4,096 bytes	5.03 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E7D1635E2624B124CFDCE6C360AC21CD`
`.didata`	`0x000c3000`	420 bytes	512 bytes	2.75 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8CED971D8A7705C98B173E255D8C9AA7`
`.edata`	`0x000c4000`	154 bytes	512 bytes	1.88 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8D4E1E508031AFE235BF121C80FD7D5F`
`.tls`	`0x000c5000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c6000`	93 bytes	512 bytes	1.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8F2F090ACD9622C88A6A852E72F94E96`
`.rsrc`	`0x000c7000`	100,492 bytes	100,864 bytes	6.47 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`777B48840B65FF380D32854B7AB2902B`

资源分析

▼

资源总数: 33 (98,686 字节)

资源类型	数量	总大小	百分比
RT_ICON	16	86,343 字节	87.5%
RT_STRING	11	8,040 字节	8.1%
RT_RCDATA	3	768 字节	0.8%
RT_GROUP_ICON	1	230 字节	0.2%
RT_VERSION	1	1,412 字节	1.4%
RT_MANIFEST	1	1,893 字节	1.9%

证书链分析

▼

证书 Information

产品	WordPad for Windows 11
描述	WordPad for Windows 11
文件版本	1.0
版权	Winaero

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	WordPad_Setup.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.217.174
数据库版本	2025-06-04 04:00:34 UTC

WordPad_Setup.exe (WordPad for Windows 11) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别