Curl exe (The curl executable) curl, https://curl haxx se/ 文件恶意软件分析

哈希类型	值	操作
MD5	971e9cc95aaca3e0537a8633dad89c4a
SHA1	367837151ad10f31084d6833a196edc3e36d4c61
SHA256	52f7627a29863beed3d24855f05245b90acbc13df035cc7419e408e6690564c5
SHA512	d2e390d6ccf160af18e76f236716787d8459f976ba3eaeb7c267ec748810612e036a27660fbc41d8b9e5b7ef4d4ca0d97dccc38c9e2978fbee53219e24737025
ImpHash	4c1eeec43423f934059f8bee4054391d

基本信息

▼

映像基址	`0x00400000`
入口点	`0x004014a0`
编译时间	2019-07-19 09:38:04
校验和	0x0037d05c (实际: 0x0037d05c)
操作系统版本	4.0
PEiD 签名	`PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows`
数字签名	OK
导入	8 库 ADVAPI32, CRYPT32, KERNEL32, msvcrt, Normaliz, USER32, wldap32, WS2_32
导出	0 函数
资源	2 资源
节	10 节

版本信息

▼

CompanyName	curl, https://curl.haxx.se/
FileDescription	The curl executable
FileVersion	7.65.3
InternalName	curl
OriginalFilename	curl.exe
ProductName	The curl executable
ProductVersion	7.65.3
LegalCopyright	© 1996 - 2019 Daniel Stenberg, <[email protected]>.
License	https://curl.haxx.se/docs/copyright.html
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	2,730,340 bytes	2,732,032 bytes	6.36 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4096BYTES`	`0707697E3221E5810DF0AA7278139EA0`
`.data`	`0x0029c000`	15,644 bytes	15,872 bytes	3.32 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`F45E4B354FEC3C351780242A0F659003`
`.rdata`	`0x002a0000`	773,056 bytes	773,120 bytes	6.51 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_32BYTES`	`AEAD6023939109F3E73D8F890C449014`
`.bss`	`0x0035d000`	14,912 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
`.edata`	`0x00361000`	49 bytes	512 bytes	0.46 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`4DFF8FE7B8F3912916172FC0C9BA8EBA`
`.idata`	`0x00362000`	7,884 bytes	8,192 bytes	5.32 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`BF24DEF502FBACE228A71A30EB610CC4`
`.CRT`	`0x00364000`	52 bytes	512 bytes	0.28 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`4A6173E3A1F708287960808FFF1BC8EA`
`.tls`	`0x00365000`	8 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x00366000`	1,880 bytes	2,048 bytes	4.39 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`0D9E38223467A20C7169356CA91145AA`
`.reloc`	`0x00367000`	97,716 bytes	97,792 bytes	6.57 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`6D583240C450C2DED00B24CB826E0A2D`

熵分析警报

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 2 (1,713 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	908 字节	53%
RT_MANIFEST	1	805 字节	47%

证书链分析

▼

证书 Information

产品	The curl executable
描述	The curl executable
文件版本	7.65.3
原始名称	curl.exe
签名日期	08:24 AM 08/26/2019 (2112 天前)
验证状态	Signed
签名者	Greatis Software LLC; Symantec Class 3 SHA256 Code Signing CA; VeriSign
副签名者	Symantec Time Stamping Services Signer - G4; Symantec Time Stamping Services CA - G2; Thawte Timestamping CA
内部名称	curl
版权	© 1996 - 2019 Daniel Stenberg, <[email protected]>.

证书链摘要

Symantec Time Stamping Services CA - G2 #1 主要

有效期: 2012-12-21 00:00:00 → 2020-12-30 23:59:59

签名算法: sha1RSA

序列号: 7E 93 EB FB 7C C6 4E 59 EA 4B 9A 77 D4 06 FC 3B

Symantec Time Stamping Services Signer - G4 #2 链

有效期: 2012-10-18 00:00:00 → 2020-12-29 23:59:59

签名算法: sha1RSA

序列号: 0E CF F4 38 C8 FE BF 35 6E 04 D8 6A 98 1B 1A 50

Greatis Software LLC #3 链

有效期: 2016-11-08 00:00:00 → 2019-12-08 23:59:59

签名算法: sha256RSA

序列号: 68 47 21 E6 FE 26 27 77 5D FC 2A 71 7E 65 F3 F2

Symantec Class 3 SHA256 Code Signing CA #4 链

有效期: 2013-12-10 00:00:00 → 2023-12-09 23:59:59

签名算法: sha256RSA

序列号: 3D 78 D7 F9 76 49 60 B2 61 7D F4 F0 1E CA 86 2A

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

OK

文件名	curl.exe
文件类型	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
扫描器版本	1.0.210.174
数据库版本	2025-03-07 02:00:38 UTC

Curl.exe (The curl executable) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别

PE 分析