AOMEI Partition Assistant Keygen exe Trojan Wacapew 文件恶意软件分析: 4ebfe56701297b5ef6d88afc325dc1dc

AOMEI Partition Assistant Keygen.exe Trojan Wacapew 分析

更新于 3 months ago

检查者 Malware Check

AOMEI Partition Assistant Keygen.exe

哈希类型	值	操作
MD5	4ebfe56701297b5ef6d88afc325dc1dc
SHA1	78bf8325542e95f04b8cee7bae23ee158817a722
SHA256	310a27fc1bc663014b2663589254c1cb0b51dc391fa4b018de90c46f441d51aa
SHA512	ca114f816067f58234af1c98c16608751646bf6e983a73f7b27c6dcd851a45548d9abe81cdf764d686376d19ef24bb0de68bfc7528cacfde206980b1ccc149ea
ImpHash	52c223bdecac713696ea2f080076f722

哈希类型

值

操作

MD5

4ebfe56701297b5ef6d88afc325dc1dc

SHA1

78bf8325542e95f04b8cee7bae23ee158817a722

SHA256

310a27fc1bc663014b2663589254c1cb0b51dc391fa4b018de90c46f441d51aa

SHA512

ca114f816067f58234af1c98c16608751646bf6e983a73f7b27c6dcd851a45548d9abe81cdf764d686376d19ef24bb0de68bfc7528cacfde206980b1ccc149ea

ImpHash

52c223bdecac713696ea2f080076f722

PE 分析

基本信息

▼

图标	哈希: 9b0c13667ad8934280f510d33986251c 模糊: 69b5b6ef46e2a1b4f917cd9728a35459 dHash: 000000d8d2010000
映像基址	`0x00400000`
入口点	`0x00401000`
编译时间	2025-06-09 11:34:30
校验和	0x00000000 (实际: 0x001f6c15)
操作系统版本	6.0
PEiD 签名	`PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows`
数字签名	No valid SignedData structure was found.
导入	13 库
导出	12 函数
资源	60 资源
节	11 节

版本信息

▼

CompanyName	Jasi2169
FileDescription	AOMEI Partition Assistant Keygen
FileVersion	1.0.0.0
LegalCopyright	Copyrights 2012
LegalTrademarks	All rights reserved
ProgramID	com.embarcadero.AOMEI Partition Assistant Keygen
ProductName	AOMEI Partition Assistant Keygen
ProductVersion	1.0.0.0
Comments	AOMEI Partition Assistant Keygen By Jasi2169
Translation	0x0409 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
	`0x00001000`	3,330,048 bytes	1,008,640 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5558B2AC5C05E0C0B8B4542F5FCFE357`
	`0x0032e000`	348,160 bytes	33,280 bytes	7.99 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E2610BE423B56020B20C5DDC894EA985`
	`0x00383000`	4,096 bytes	1,024 bytes	0.03 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`91CCB28EB66F40FB9808FD088DA27BA6`
	`0x00384000`	4,096 bytes	512 bytes	0.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`CCD31736D0EF025D06C5FF4506C8E40F`
	`0x00385000`	16,384 bytes	14,336 bytes	7.99 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`0BB895D89BB2859000FBE5E1203A8B14`
	`0x00389000`	4,096 bytes	1,536 bytes	7.86 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`AE6D27D17FF22E03768A8AFE2C4CC435`
	`0x0038a000`	4,096 bytes	512 bytes	4.39 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B7BBDFCAB7615CB021D923B4F832B624`
`.rsrc`	`0x0038b000`	733,184 bytes	611,840 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B15799F88D39C4A1A378DCD38F932B9B`
	`0x0043e000`	266,240 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x0047f000`	372,736 bytes	369,152 bytes	7.66 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`09DD69D1B7A1992766380D809A2E0EA7`
`.adata`	`0x004da000`	4,096 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`

熵分析警报

6 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 60 (726,102 字节)

资源类型	数量	总大小	百分比
VCLSTYLE	1	167,296 字节	23%
RT_CURSOR	8	2,464 字节	0.3%
RT_ICON	4	31,968 字节	4.4%
RT_STRING	27	24,520 字节	3.4%
RT_RCDATA	9	496,846 字节	68.4%
RT_GROUP_CURSOR	8	160 字节	0%
RT_GROUP_ICON	1	62 字节	0%
RT_VERSION	1	972 字节	0.1%
RT_MANIFEST	1	1,814 字节	0.2%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	AOMEI Partition Assistant Keygen.exe
文件类型	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
扫描器版本	1.0.227.174
数据库版本	2025-10-11 13:00:17 UTC

AOMEI Partition Assistant Keygen.exe Trojan Wacapew 分析

技术分析

Trojan.Win32.Wacapew.cl

扫描另一个文件

文件识别