WsUpgrade dll Malware Packed 文件恶意软件分析: 9fca7e642d64b378b92778debea608bb

WsUpgrade.dll Malware Packed 分析

更新于 2 months ago

检查者 Malaware Check

wsUpgrade.dll

哈希类型	值	操作
MD5	9fca7e642d64b378b92778debea608bb
SHA1	e94ce119e544b122cda38aef713f75311e74f667
SHA256	82b7a2001c2e03fdbaec492a4f48ed21311170d99d13d152bd0ee754bb94fced
SHA512	3716b7e48539c3f90534e7a55e1e8187b2e28a6b32043900ce458e3d1ba1d605fdebd46f704319b5335a0e4f226ff3af8a567d9fbd3d60882464a59f09510d3a
ImpHash	5713ee1e0a96c3085a579a6cb363a861

哈希类型

值

操作

MD5

9fca7e642d64b378b92778debea608bb

SHA1

e94ce119e544b122cda38aef713f75311e74f667

SHA256

82b7a2001c2e03fdbaec492a4f48ed21311170d99d13d152bd0ee754bb94fced

SHA512

3716b7e48539c3f90534e7a55e1e8187b2e28a6b32043900ce458e3d1ba1d605fdebd46f704319b5335a0e4f226ff3af8a567d9fbd3d60882464a59f09510d3a

ImpHash

5713ee1e0a96c3085a579a6cb363a861

PE 分析

基本信息

▼

映像基址	`0x180000000`
入口点	`0x1810398c0`
编译时间	2022-09-21 02:16:46
校验和	0x000c494f (实际: 0x003b7588)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	15 库
导出	17 函数
资源	2 资源
节	9 节

版本信息

▼

CompanyName	Wondershare
FileDescription	wsUpgrade
FileVersion	1.4.3.5
InternalName	wsUpgrade.dll
LegalCopyright	Copyright © 2022 Wondershare. All rights reserved.
OriginalFilename	wsUpgrade.dll
ProductName	wsUpgrade
ProductVersion	1.4.3.5
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
	`0x00001000`	565,248 bytes	260,608 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7DC9B8642D7BBD696F1B42936CEF5A62`
	`0x0008b000`	180,224 bytes	64,000 bytes	7.99 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4312967A15D04773A3A8ABC84F1BEB9C`
	`0x000b7000`	12,288 bytes	1,024 bytes	6.14 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F006292633A56785AACB9007D8BBCEB5`
	`0x000ba000`	28,672 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x000c1000`	4,096 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x000c2000`	4,096 bytes	1,536 bytes	6.20 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F4B2B99E7F5776DCAB8C15FBBF7A431A`
`.rsrc`	`0x000c3000`	4,096 bytes	1,536 bytes	2.85 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1F471506646B8FF74A9F08A933CB0029`
	`0x000c4000`	13,000,704 bytes	278,528 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`DE848FF83CD37131D22017559FB218CA`
	`0x00d2a000`	3,223,552 bytes	3,220,992 bytes	7.97 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`976DE646E29705575322D56EF346A5C5`

熵分析警报

4 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 2 (901 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	756 字节	83.9%
RT_MANIFEST	1	145 字节	16.1%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	wsUpgrade.dll
文件类型	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
扫描器版本	1.0.211.174
数据库版本	2025-03-25 16:01:08 UTC

WsUpgrade.dll Malware Packed 分析

技术分析

Malware.Win64.Packed.cc

扫描另一个文件

文件识别