Adguard v7 20 2 4988 RePack by xetrin exe (Adguard v7 20 2 4988 (RePack by xetrin)) Adguard Software Ltd 文件恶意软件分析

Adguard.v7.20.2.4988.RePack.by.xetrin.exe (Adguard v7.20.2.4988 (RePack by xetrin)) 文件分析

更新于 2 months ago

检查者 Malware Check

Adguard.v7.20.2.4988.RePack.by.xetrin.exe

哈希类型	值	操作
MD5	1db5ca7e3e28ff63a612abf280f6c541
SHA1	72a2d6e0cef7b474921d2d11756459b8ab0a8238
SHA256	69a4a118baf21b7f41bfec66fa3a143fc9e4666dde5f58832c53867d51d46c9b
SHA512	f46c36ff7b461fb7fd99e2b1733778434b713cca13e946670e7881506f077ac7259c5899de9e19a7eead14d81b8c4bde404f47552f613d5adf66e58d6008e8ab
ImpHash	ea498fe198e91fc6fa5f09d6bb3dad3a

哈希类型

值

操作

MD5

1db5ca7e3e28ff63a612abf280f6c541

SHA1

72a2d6e0cef7b474921d2d11756459b8ab0a8238

SHA256

69a4a118baf21b7f41bfec66fa3a143fc9e4666dde5f58832c53867d51d46c9b

SHA512

f46c36ff7b461fb7fd99e2b1733778434b713cca13e946670e7881506f077ac7259c5899de9e19a7eead14d81b8c4bde404f47552f613d5adf66e58d6008e8ab

ImpHash

ea498fe198e91fc6fa5f09d6bb3dad3a

PE 分析

基本信息

▼

图标	哈希: 65bc52c9c65ad059f6c0846fc874e362 模糊: 56580da65dba8c5b3e29288b4cfdc502 dHash: 41554d6933456161
映像基址	`0x00400000`
入口点	`0x00419974`
编译时间	2023-03-05 15:20:43
校验和	0x00000000 (实际: 0x0350c5fb)
操作系统版本	5.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	5 库 oleaut32, advapi32, user32, kernel32, comctl32
导出	0 函数
资源	20 资源
节	8 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Adguard Software Ltd.
FileDescription	Adguard v7.20.2.4988 (RePack by xetrin)
FileVersion	7.20.2.4988.0.0
LegalCopyright	(c) Caphyon LTD. All rights reserved.
OriginalFileName
ProductName	Adguard
ProductVersion	7.20.2.4988
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	95,268 bytes	95,744 bytes	6.39 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`7C4E217D33ECF31B50013CE86C37686E`
`.itext`	`0x00019000`	4,364 bytes	4,608 bytes	5.84 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`17BDAE2799284DDB20A8DC6312D14376`
`.data`	`0x0001b000`	3,532 bytes	3,584 bytes	2.76 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`121489EF40758669C0238BCB232022C0`
`.bss`	`0x0001c000`	22,528 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00022000`	4,106 bytes	4,608 bytes	4.67 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B3B7E9CF1FC78BA601A09769949E02BB`
`.tls`	`0x00024000`	12 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00025000`	24 bytes	512 bytes	0.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C4774D302874C5736A093958BC7D322B`
`.rsrc`	`0x00026000`	147,512 bytes	147,968 bytes	4.85 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2033E292905E4C2CB531365364DDD733`

资源分析

▼

资源总数: 20 (146,312 字节)

资源类型	数量	总大小	百分比
RT_ICON	6	105,674 字节	72.2%
RT_STRING	7	3,580 字节	2.4%
RT_RCDATA	4	33,976 字节	23.2%
RT_GROUP_ICON	1	90 字节	0.1%
RT_VERSION	1	1,412 字节	1%
RT_MANIFEST	1	1,580 字节	1.1%

证书链分析

▼

证书 Information

产品	Adguard
描述	Adguard v7.20.2.4988 (RePack by xetrin)
文件版本	7.20.2.4988.0.0
版权	(c) Caphyon LTD. All rights reserved.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Adguard.v7.20.2.4988.RePack.by.xetrin.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.228.174
数据库版本	2025-11-08 01:00:24 UTC

Adguard.v7.20.2.4988.RePack.by.xetrin.exe (Adguard v7.20.2.4988 (RePack by xetrin)) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别