GWCtlSrv exe (GlassWire Control Service) GlassWire 文件恶意软件分析

GWCtlSrv.exe (GlassWire Control Service) 文件分析

更新于 1 month ago

检查者 Malware Check

GWCtlSrv.exe

哈希类型	值	操作
MD5	243e682ceefe5d484b303a4a945bc40b
SHA1	2d18237ce7f37cf21bf46b005cafbaddcb17b5d8
SHA256	5a4d99e153f7cc41d4abdcbd95aada1a60bfc47038944f2822615efbd23b7b4d
SHA512	0593d652686de1e3d86306ed62a74d860875769b59b5b25875f7af714a48d96705fb9be7a1c6551d0bd049875ac4b3d0459745cf88b780c772aaf42de5945111
ImpHash	66ced451857c8b05bb10992b3d981002

哈希类型

值

操作

MD5

243e682ceefe5d484b303a4a945bc40b

SHA1

2d18237ce7f37cf21bf46b005cafbaddcb17b5d8

SHA256

5a4d99e153f7cc41d4abdcbd95aada1a60bfc47038944f2822615efbd23b7b4d

SHA512

0593d652686de1e3d86306ed62a74d860875769b59b5b25875f7af714a48d96705fb9be7a1c6551d0bd049875ac4b3d0459745cf88b780c772aaf42de5945111

ImpHash

66ced451857c8b05bb10992b3d981002

PE 分析

基本信息

▼

映像基址	`0x008e0000`
入口点	`0x008e4490`
编译时间	2024-12-20 16:09:38
校验和	0x01ae7d84 (实际: 0x01ae9cf7)
操作系统版本	6.0
PEiD 签名	`PE32 executable (console) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	19 库
导出	3 函数
资源	2 资源
节	21 节

版本信息

▼

CompanyName	GlassWire
FileDescription	GlassWire Control Service
InternalName	GlassWire
LegalCopyright	© 2024 GlassWire
OriginalFilename	GWCtlSrv.exe
ProductName	GlassWire
ProductVersion	3.4.768.0
FileVersion	3.4.768.0
Translation	0x0409 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	14,245,888 bytes	14,243,840 bytes	5.66 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`B6978FBF8147A6A6E7ABCBCCD0055DBD`
	`0x00d97000`	3,596,288 bytes	3,595,264 bytes	4.84 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`FC2729180AF7AADD869E4B89EAADFA40`
	`0x01105000`	1,085,440 bytes	1,041,408 bytes	4.86 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`24EBC85B6C5FC6C4CE37FE2D21A16F81`
	`0x0120e000`	40,960 bytes	12,288 bytes	4.79 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B88A6783F528A2F6FCF2BFFA7FCE0343`
	`0x01218000`	8,192 bytes	3,584 bytes	4.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`EE381784450E7777F34B1ED833BEF886`
	`0x0121a000`	221,184 bytes	183,808 bytes	5.07 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`799573B6BEF80668CB003215B1876FDF`
	`0x01250000`	4,096 bytes	512 bytes	0.08 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`54842ECF8DB91FC023FAC11D59239594`
	`0x01251000`	4,096 bytes	512 bytes	0.02 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`2949E72BEEC155244AABE31DC75EB9D1`
	`0x01252000`	4,096 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x01253000`	4,096 bytes	512 bytes	0.11 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D45FBA2CC6094289ED16CE88B2544BF4`
	`0x01254000`	4,096 bytes	2,048 bytes	3.58 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`675FB9256E17F0CB33221E64850AF6FB`
	`0x01255000`	589,824 bytes	520,704 bytes	6.58 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`827A9261D5B8931D515E13FF8BA22CFC`
`.debug`	`0x012e5000`	4,096 bytes	512 bytes	2.64 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`99B86F2FA788C096CD98F6624565B210`
`.edata`	`0x012e6000`	4,096 bytes	512 bytes	2.97 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F8BA48693BC374EEF39D70AFA45620C9`
`.idata`	`0x012e7000`	4,096 bytes	2,048 bytes	4.69 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F127B8E237AF40832ACE3C36C65033F5`
`.tls`	`0x012e8000`	4,096 bytes	1,024 bytes	0.23 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`01869887AE6037B380DCF88F5198642C`
`.rsrc`	`0x012e9000`	4,096 bytes	1,536 bytes	4.40 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7EBB6F068E7AF044DC69BB294A7573F5`
`.themida`	`0x012ea000`	5,324,800 bytes	5,324,800 bytes	6.40 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7C23ED517BFB897160E28874FE26225A`
`.boot`	`0x017fe000`	3,219,456 bytes	3,218,432 bytes	7.91 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`E8ABA8C9186EB67718B729462ADF11FA`
`.reloc`	`0x01b10000`	4,096 bytes	1,024 bytes	4.01 (正常)	`IMAGE_SCN_MEM_READ`	`113A18063EB24B108616C45C54AAB512`
`.SCY`	`0x01b11000`	32,768 bytes	30,208 bytes	5.78 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5A63C61A470665DA4E6F067A35386408`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 2 (1,312 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	716 字节	54.6%
RT_MANIFEST	1	596 字节	45.4%

证书链分析

▼

证书 Information

产品	GlassWire
描述	GlassWire Control Service
文件版本	3.4.768.0
原始名称	GWCtlSrv.exe
内部名称	GlassWire
版权	© 2024 GlassWire

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	GWCtlSrv.exe
文件类型	PE32 executable (console) Intel 80386, for MS Windows
扫描器版本	1.0.229.174
数据库版本	2025-11-14 05:00:22 UTC

GWCtlSrv.exe (GlassWire Control Service) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别