Swift exe Trojan Wacatac 文件恶意软件分析: 0033b392c5624d739c95af6cbb56d778

Swift.exe Trojan Wacatac 分析

更新于 6 days ago

检查者 Malware Check

Swift.exe

哈希类型	值	操作
MD5	0033b392c5624d739c95af6cbb56d778
SHA1	837df1989cbb4887f067d8faf167e13a437162f4
SHA256	90bc42881701c5be22be13b4f962708f09cb7b2e3a4623473da5e17550ee4b1f
SHA512	0930d1cd2d5baffa8ec2a817c5a9e3ce63684906dbdf63b1c073d013071f7f99b807a6c1116538d1444fbb05010085310c23c76cf497dc7c2eb9b09722ef2049
ImpHash	27d1d2d05684f98ecd5681b9b60151b9

哈希类型

值

操作

MD5

0033b392c5624d739c95af6cbb56d778

SHA1

837df1989cbb4887f067d8faf167e13a437162f4

SHA256

90bc42881701c5be22be13b4f962708f09cb7b2e3a4623473da5e17550ee4b1f

SHA512

0930d1cd2d5baffa8ec2a817c5a9e3ce63684906dbdf63b1c073d013071f7f99b807a6c1116538d1444fbb05010085310c23c76cf497dc7c2eb9b09722ef2049

ImpHash

27d1d2d05684f98ecd5681b9b60151b9

PE 分析

基本信息

▼

图标	哈希: 344c130d20b26e802ca02eef66055cca 模糊: cfcfb46cc9bd8210a71eb5734fcaffd2 dHash: 00004484d6d100c0
映像基址	`0x140000000`
入口点	`0x143a45000`
编译时间	2025-07-16 16:08:26
校验和	0x0135b83e (实际: 0x0135b83e)
操作系统版本	6.0
PEiD 签名	`MS-DOS executable PE32+ executable (GUI) x86-64, for MS Windows, MZ for MS-DOS`
数字签名	No valid SignedData structure was found.
导入	35 库
导出	0 函数
资源	26 资源
节	14 节

版本信息

▼

CompanyName	swift
FileVersion	0.1.0
ProductName	swift-new
FileDescription	swift-new
ProductVersion	0.1.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
	`0x00001000`	16,066,460 bytes	3,678,208 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`4702BD07CF56DDFB0D818FBEB050C1F4`
	`0x00f54000`	7,969,100 bytes	2,936,320 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D0FF3B4641AF74CAB8E6C286000D0810`
	`0x016ee000`	114,648 bytes	6,144 bytes	7.96 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`636399953AA264F764FB0EE41CFF7F06`
	`0x0170a000`	1,011,708 bytes	328,704 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`75162C07CD1416C1731B3241F95D1B5C`
	`0x01801000`	11,264 bytes	9,216 bytes	7.86 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F1EFED73CDB1C4C4C4ECCDD689ED17AB`
	`0x01804000`	101,728 bytes	21,504 bytes	7.98 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2904FCA9F990D7361BB955B6AF0A49F3`
`.idata`	`0x0181d000`	4,096 bytes	2,560 bytes	4.31 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E9A0C92AA559C653ABAFA9DC56494C09`
`.tls`	`0x0181e000`	4,096 bytes	1,024 bytes	0.29 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`099F204BD5E6E5720DCE39ADB0B44718`
`.rsrc`	`0x0181f000`	17,408 bytes	17,408 bytes	6.84 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`01F963D0768FE3AC85BC6D23A4B971A1`
`.themida`	`0x01824000`	22,528,000 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.loadcon`	`0x02da0000`	4,096 bytes	512 bytes	0.63 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3934C66C4B618BFFE0C44051EEA97B12`
`.boot`	`0x02da1000`	13,252,096 bytes	13,252,096 bytes	7.96 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`200685E254C7FFBA1EAF1D6EAEAA8708`
`.init`	`0x03a45000`	512 bytes	512 bytes	2.70 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2A549C5EC6656718301411EF3C34B331`
`.reloc`	`0x03a46000`	4,096 bytes	28 bytes	3.16 (正常)	`IMAGE_SCN_MEM_READ`	`111371776B3A1136056D4BEA7B17D32C`

熵分析警报

7 检测到高熵（≥7.5）的节 - 可能存在打包/加密

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 26 (15,672 字节)

资源类型	数量	总大小	百分比
RT_ICON	6	9,574 字节	61.1%
RT_DIALOG	7	1,704 字节	10.9%
RT_STRING	5	66 字节	0.4%
RT_RCDATA	5	3,219 字节	20.5%
RT_GROUP_ICON	1	90 字节	0.6%
RT_VERSION	1	468 字节	3%
RT_MANIFEST	1	551 字节	3.5%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Swift.exe
文件类型	MS-DOS executable PE32+ executable (GUI) x86-64, for MS Windows, MZ for MS-DOS
扫描器版本	1.0.224.174
数据库版本	2025-09-01 22:00:27 UTC

Swift.exe Trojan Wacatac 分析

技术分析

Trojan.Win64.Wacatac.cl

扫描另一个文件

文件识别