Testdisk win exe CGSecurity 文件恶意软件分析

Testdisk_win.exe 文件分析

更新于 1 month ago

检查者 Malware Check

testdisk_win.exe

哈希类型	值	操作
MD5	469159934c92df3babd2ad36f2021605
SHA1	1eb8db04920382028c8e2f66b3e707e6582bfddf
SHA256	783ef835666fd2b1efa036b6a555b4bfabde245ac42df7b1a53186d46e47c6de
SHA512	af75c2d33ee19f93b6f7e5614856b6557676bc806834cc1e9fecee6017cf284633e81f195b7180d18495e3b62ad58365ff8bcfc4b3e52db6739d88095f55d55c
ImpHash	25b87318d2b834505822549b0167577b

哈希类型

值

操作

MD5

469159934c92df3babd2ad36f2021605

SHA1

1eb8db04920382028c8e2f66b3e707e6582bfddf

SHA256

783ef835666fd2b1efa036b6a555b4bfabde245ac42df7b1a53186d46e47c6de

SHA512

af75c2d33ee19f93b6f7e5614856b6557676bc806834cc1e9fecee6017cf284633e81f195b7180d18495e3b62ad58365ff8bcfc4b3e52db6739d88095f55d55c

ImpHash

25b87318d2b834505822549b0167577b

PE 分析

基本信息

▼

图标	哈希: cbe9f568a9839b48fab7fa168a0d883f 模糊: 42d0e6e8cbfa4ef080811a93b1d9ce86 dHash: e991a8b0a66d3098
映像基址	`0x00400000`
入口点	`0x00401000`
编译时间	2025-09-21 16:23:09
校验和	0x000e485b (实际: 0x000e485b)
操作系统版本	4.0
PEiD 签名	`PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows`
数字签名	Chain verification from [email protected], CN=Open Source Developer\, Christophe GRENIER, O=Open Source Developer, L=LE PERREUX-SUR-MARNE, ST=ILE DE FRANCE, C=FR (serial:34064927953462066999046785409715031933, sha1:6d2d393fe19a31948adc12ca06908886b3c65b60) failed: The path could not be validated because the end-entity certificate expired 2024-06-15 10:00:27Z
导入	6 库 cygwin1, cygewf-2, cygiconv-2, cygncursesw-10, KERNEL32, cyggcc_s-1
导出	0 函数
资源	6 资源
节	9 节

版本信息

▼

CompanyName	CGSecurity
ProductName	TestDisk
FileDescription	TestDisk
InternalName	TestDisk
OriginalFilename	testdisk_win.exe
Comments	Partition and file recovery utility
FileVersion	7.3
ProductVersion	7.3
LegalCopyright	Copyright (C) 1998-2024 Christophe GRENIER, et al.
Translation	0x0409 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	596,196 bytes	596,480 bytes	5.99 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`E1BB9B01F8158B1131B3857249B32864`
`.data`	`0x00093000`	3,072 bytes	3,072 bytes	3.58 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BCD9535414C8F64B4C507C9AE0D98152`
`.rdata`	`0x00094000`	185,008 bytes	185,344 bytes	6.55 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`03AE12DDC62042EC9526C4D602EEB10E`
`.buildid`	`0x000c2000`	53 bytes	512 bytes	0.58 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`573FF559F4E1CC32F4AE21F62C741DDE`
`/4`	`0x000c3000`	80,024 bytes	80,384 bytes	4.94 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F026381277FCE5F66A7E1E887A7BA841`
`.bss`	`0x000d7000`	61,808 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000e7000`	5,940 bytes	6,144 bytes	4.97 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`0215E765E3CD1D5C8FAF1A2F57E95F68`
`.rsrc`	`0x000e9000`	10,432 bytes	10,752 bytes	5.01 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`162E5C496F253954D226EB0819B851DB`
`.reloc`	`0x000ec000`	16,352 bytes	16,384 bytes	6.63 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`7F35F5369EB5E4293172AFF89251D340`

熵分析警报

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 6 (8,758 字节)

资源类型	数量	总大小	百分比
RT_ICON	3	7,352 字节	83.9%
RT_GROUP_ICON	1	48 字节	0.5%
RT_VERSION	1	836 字节	9.5%
RT_MANIFEST	1	522 字节	6%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

Chain verification from [email protected], CN=Open Source Developer\, Christophe GRENIER, O=Open Source Developer, L=LE PERREUX-SUR-MARNE, ST=ILE DE FRANCE, C=FR (serial:34064927953462066999046785409715031933, sha1:6d2d393fe19a31948adc12ca06908886b3c65b60) failed: The path could not be validated because the end-entity certificate expired 2024-06-15 10:00:27Z

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	testdisk_win.exe
文件类型	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
扫描器版本	1.0.229.174
数据库版本	2025-11-19 19:00:22 UTC

Testdisk_win.exe 文件分析

技术分析

干净文件

扫描另一个文件

文件识别