Windows exe Adware ELEX 文件恶意软件分析: 803653fb359948c67dc4dee65a6bd18e

Windows.exe Adware ELEX 分析

更新于 1 year ago

检查者 Malware Check

Windows.exe

哈希类型	值	操作
MD5	803653fb359948c67dc4dee65a6bd18e
SHA1	4a86e380ca04ea58c05bd7cfea8987f779f5aeff
SHA256	52c19261a61c8b696283eababf9211e845287b8365b71ea39c6f0167945d6b1f
SHA512	e7f891fda4de9465e984e5959cb210d1f4ba7e69310cbd9f557ddc848ce62621fa1be433ab776646637c0748cba4756a2ee4b1f5e0c7381ae6895fd9b7bbafca
ImpHash	d8e3718a029681f271f8f11996f731f0

哈希类型

值

操作

MD5

803653fb359948c67dc4dee65a6bd18e

SHA1

4a86e380ca04ea58c05bd7cfea8987f779f5aeff

SHA256

52c19261a61c8b696283eababf9211e845287b8365b71ea39c6f0167945d6b1f

SHA512

e7f891fda4de9465e984e5959cb210d1f4ba7e69310cbd9f557ddc848ce62621fa1be433ab776646637c0748cba4756a2ee4b1f5e0c7381ae6895fd9b7bbafca

ImpHash

d8e3718a029681f271f8f11996f731f0

PE 分析

基本信息

▼

图标	哈希: fe3ea1d1a70457fc2d61e407e51d4025 模糊: 144907d2c49f9d0b377e18ba2cc57918 dHash: 1ec0c4c4c4c4c01e
映像基址	`0x00400000`
入口点	`0x01c25a94`
编译时间	2020-08-28 14:46:00
校验和	0x00682512 (实际: 0x0099842e)
操作系统版本	4.0
PEiD 签名	`PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows`
数字签名	The PE file does not contain a certificate table.
导入	14 库
导出	0 函数
资源	7 资源
节	13 节

版本信息

▼

CompanyName	Windows
FileDescription	Windows
FileVersion	6.3.3
LegalCopyright	Windows
OriginalFilename	Windows.exe
ProductName	Windows
ProductVersion	6.3.3
Comments	Modified by an unpaid evaluation copy of Resource Tuner 2 (www.heaventools.com)
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
	`0x00001000`	5,177,344 bytes	5,174,272 bytes	6.46 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7C1476AB10F456529B6E085BD65AD267`
	`0x004f1000`	65,536 bytes	61,952 bytes	2.89 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`706D3F16297B2782A1EE524B141A46B3`
	`0x00501000`	1,134,592 bytes	1,131,008 bytes	5.97 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`0E4FA81008B2B5A17AD38EE8BD1BAFA4`
	`0x00616000`	180,224 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x00642000`	221,184 bytes	217,600 bytes	5.01 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1FD6240961D2BEB958A98ED0811DA422`
	`0x00678000`	3,297,280 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_64BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x0099d000`	20,480 bytes	17,920 bytes	0.59 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E3CA6283B84010AB99D24518BB21004E`
	`0x009a2000`	4,096 bytes	512 bytes	0.34 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E183E03AE0A39744DDD4E5919724A935`
	`0x009a3000`	4,096 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x009a4000`	24,576 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rsrc`	`0x009aa000`	24,576 bytes	23,040 bytes	5.26 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E26B47AD96BD6A83D9376524F6284435`
	`0x009b0000`	12,038,144 bytes	281,600 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`38B2ACFA01E1160DE6155974765C0C8E`
	`0x0152b000`	3,133,440 bytes	3,130,368 bytes	7.93 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`2831B86024F9F2EDAF701AE5BC424308`

熵分析警报

2 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 7 (22,336 字节)

资源类型	数量	总大小	百分比
RT_ICON	4	20,343 字节	91.1%
RT_GROUP_ICON	1	62 字节	0.3%
RT_VERSION	1	764 字节	3.4%
RT_MANIFEST	1	1,167 字节	5.2%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

The PE file does not contain a certificate table.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Windows.exe
文件类型	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
扫描器版本	1.0.178.174
数据库版本	2024-05-31 22:00:27 UTC

Windows.exe Adware ELEX 分析

技术分析

Adware.Win64.ELEX.vl!n

扫描另一个文件

文件识别