Xtool exe 文件恶意软件分析

Xtool.exe 文件分析

更新于 2 months ago

检查者 Malware Check

xtool.exe

哈希类型	值	操作
MD5	c129ff2da013368b7bf4a635bda49f93
SHA1	ae6881e32588771b69f34565cd40411f670f7276
SHA256	a1c80a60363e23d475e8ef6eeaec373c6529d6974f4f463d5a4cb4eae484a07c
SHA512	8c50212135b9cedcf3dd6983b4002d4b8fde8c50e8ca46b074b07fe2e4417faf9666ab5ae85e87763d6fcb6c84ccdd605831291c78b09b8902b9fa396ea582d1
ImpHash	8b2d1d75c225e0f848a6ab752d90c82b

哈希类型

值

操作

MD5

c129ff2da013368b7bf4a635bda49f93

SHA1

ae6881e32588771b69f34565cd40411f670f7276

SHA256

a1c80a60363e23d475e8ef6eeaec373c6529d6974f4f463d5a4cb4eae484a07c

SHA512

8c50212135b9cedcf3dd6983b4002d4b8fde8c50e8ca46b074b07fe2e4417faf9666ab5ae85e87763d6fcb6c84ccdd605831291c78b09b8902b9fa396ea582d1

ImpHash

8b2d1d75c225e0f848a6ab752d90c82b

PE 分析

基本信息

▼

映像基址	`0x00400000`
入口点	`0x0063ee10`
编译时间	2022-05-22 19:54:53
校验和	0x00000000 (实际: 0x002d8cf0)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (console) x86-64, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	8 库 kernel32, dbghelp, version, user32, oleaut32, msvcrt, advapi32, winhttp
导出	3 函数
资源	23 资源
节	10 节

版本信息

▼

FileVersion	0.0.0.0
LegalCopyright	Razor12911
OriginalFilename	xtool.exe
ProgramID	com.embarcadero.xtool
ProductName	xtool
ProductVersion	0.0.0.0
Comments	Created by Razor12911
Translation	0x1c09 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	2,408,836 bytes	2,408,960 bytes	5.72 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`DEEFB1EE7239BE9D3D6C827957DCD526`
`.data`	`0x0024e000`	198,992 bytes	199,168 bytes	5.11 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`FB79EA312507BEB8611CE1AB7C121CAF`
`.bss`	`0x0027f000`	88,576 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00295000`	7,196 bytes	7,680 bytes	4.07 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`FC2021AB4A8CD3EBFFFF76B795457C3B`
`.didata`	`0x00297000`	1,614 bytes	2,048 bytes	2.66 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8E0A1546CB2604267634971E44E7F1C4`
`.edata`	`0x00298000`	151 bytes	512 bytes	1.84 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`801CF6BA95A28C9085A3C0B6518E31FC`
`.tls`	`0x00299000`	600 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x0029a000`	109 bytes	512 bytes	1.36 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F671455601F0AD056143B7F530A32B7D`
`.pdata`	`0x0029b000`	106,824 bytes	107,008 bytes	6.22 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4561F5669F50CE6824984B6F951CA368`
`.rsrc`	`0x002b6000`	254,976 bytes	254,976 bytes	6.16 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8DADC6855303891C65E178DD56824D81`

资源分析

▼

资源总数: 23 (253,526 字节)

资源类型	数量	总大小	百分比
RT_STRING	17	13,636 字节	5.4%
RT_RCDATA	5	239,266 字节	94.4%
RT_VERSION	1	624 字节	0.2%

证书链分析

▼

证书 Information

产品	xtool
文件版本	0.0.0.0
原始名称	xtool.exe
版权	Razor12911

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	xtool.exe
文件类型	PE32+ executable (console) x86-64, for MS Windows
扫描器版本	1.0.217.174
数据库版本	2025-05-28 20:00:17 UTC

Xtool.exe 文件分析

技术分析

干净文件

扫描另一个文件

文件识别