HDDLLFsetup 4 50 exe (Hard Disk Low Level Format Tool Setup) HDDGURU 文件恶意软件分析

技术分析

文件名	HDDLLFsetup.4.50.exe
文件类型	Win32 EXE
魔术字节	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP 哈希	49152:sBuZrEUzvWClKyyLyXp5fgFxbUKIy029s4C1eH9X:ykL6C9tp5fHt29s4C1eH9X
扫描器版本	1.0.221.174
数据库版本	2025-07-20 05:00:25 UTC

扫描另一个文件

文件识别

哈希类型	值	操作
MD5	e3fd230296b5dd56d0e50aca535f9432
SHA1	52e5c3b6b025753bc968753a1b5ef4407bc30e35
SHA256	9d1b0d220bce5150069d6878c6889a8288e0bf26f29329d90ba2064b33707066
SHA512	9b9ec90b7be3fbf2c57966ac746adc1670a42e3d9a2c3afbf0c383b2f464af9abd813c30162eb2be7b7f05dbb31a53be2e95a1394e4a3fc00874a88088f56982
ImpHash	e569e6f445d32ba23766ad67d1e3787f

检测到威胁的安全引擎 (4 共 72)

Bkav

W32.AIDetectMalware Malicious

APEX

Malicious Malicious

Microsoft

PUADlManager:Win32/OfferCore Malicious

SentinelOne

Static AI - Suspicious PE Malicious

68 个引擎未报告威胁 - 为清晰起见，仅显示有检测结果的引擎

PE 分析

基本信息

▼

图标	哈希: a0ef7c81eee20e999575764306184ccf 模糊: 8341e53a6f1047f3c936b4d36dc8f542 dHash: 5050d274ccec82ae
映像基址	`0x00400000`
入口点	`0x004b5eec`
编译时间	2023-02-15 14:54:16
校验和	0x00000000 (实际: 0x0021a254)
操作系统版本	6.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	7 库 kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
导出	3 函数
资源	30 资源
节	10 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	HDDGURU
FileDescription	Hard Disk Low Level Format Tool Setup
FileVersion
LegalCopyright
OriginalFileName
ProductName	Hard Disk Low Level Format Tool
ProductVersion
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	735,716 bytes	735,744 bytes	6.36 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`43AF0A9476CA224D8E8461F1E22C94DA`
`.itext`	`0x000b5000`	5,768 bytes	6,144 bytes	5.97 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`185E04B9A1F554E31F7F848515DC890C`
`.data`	`0x000b7000`	14,244 bytes	14,336 bytes	5.05 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`CAB2107C933B696AA5CF0CC6C3FD3980`
`.bss`	`0x000bb000`	28,136 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c2000`	4,060 bytes	4,096 bytes	5.03 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E7D1635E2624B124CFDCE6C360AC21CD`
`.didata`	`0x000c3000`	420 bytes	512 bytes	2.75 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8CED971D8A7705C98B173E255D8C9AA7`
`.edata`	`0x000c4000`	154 bytes	512 bytes	1.88 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8D4E1E508031AFE235BF121C80FD7D5F`
`.tls`	`0x000c5000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c6000`	93 bytes	512 bytes	1.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8F2F090ACD9622C88A6A852E72F94E96`
`.rsrc`	`0x000c7000`	69,632 bytes	69,632 bytes	3.69 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`0CF8CB128B883366DC4FB6E9123A26DA`

资源分析

▼

资源总数: 30 (67,541 字节)

资源类型	数量	总大小	百分比
RT_ICON	13	55,173 字节	81.7%
RT_STRING	11	8,040 字节	11.9%
RT_RCDATA	3	768 字节	1.1%
RT_GROUP_ICON	1	188 字节	0.3%
RT_VERSION	1	1,412 字节	2.1%
RT_MANIFEST	1	1,960 字节	2.9%

证书链分析

▼

证书 Information

产品	Hard Disk Low Level Format Tool
描述	Hard Disk Low Level Format Tool Setup

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

HDDLLFsetup.4.50.exe (Hard Disk Low Level Format Tool Setup) 文件分析