Malwarebytes Premium v4 6 2 RePack by xetrin exe (Malwarebytes Premium v4 6 2 (RePack by xetrin)) Malwarebytes, Inc 文件恶意软件分析

Malwarebytes.Premium.v4.6.2.RePack.by.xetrin.exe (Malwarebytes Premium v4.6.2 (RePack by xetrin)) 文件分析

更新于 1 year ago

检查者 Malware Check

Malwarebytes.Premium.v4.6.2.RePack.by.xetrin.exe

哈希类型	值	操作
MD5	3d95f9605222a2556aeab0b4d6bfa4fc
SHA1	aa9e9b4b276a1e4c6a4a460a649ab26e649ed6f6
SHA256	a1defacd58dd88f9c83a97e43d0749b1f728e73a6c02988201cd12affe07a87e
SHA512	e70d9dc1bfeaa7f8c8c61deb7dc0366aab1f5d8b383b1b9b9fa8b74f31c629803a0f472d2680b559ee3321425e5e5f944d89efd6eb4058c51ba36df828b8b189
ImpHash	ea498fe198e91fc6fa5f09d6bb3dad3a

哈希类型

值

操作

MD5

3d95f9605222a2556aeab0b4d6bfa4fc

SHA1

aa9e9b4b276a1e4c6a4a460a649ab26e649ed6f6

SHA256

a1defacd58dd88f9c83a97e43d0749b1f728e73a6c02988201cd12affe07a87e

SHA512

e70d9dc1bfeaa7f8c8c61deb7dc0366aab1f5d8b383b1b9b9fa8b74f31c629803a0f472d2680b559ee3321425e5e5f944d89efd6eb4058c51ba36df828b8b189

ImpHash

ea498fe198e91fc6fa5f09d6bb3dad3a

PE 分析

基本信息

▼

图标	哈希: 0558009bed1b6f71a87810a02ad4b28f 模糊: 4a7268652f2fe24ee9c7315ebd3d34c2 dHash: 968e8cb2b6869c98
映像基址	`0x00400000`
入口点	`0x00419974`
编译时间	2020-11-21 18:01:58
校验和	0x00000000 (实际: 0x03f2f125)
操作系统版本	5.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	The PE file does not contain a certificate table.
导入	5 库 oleaut32, advapi32, user32, kernel32, comctl32
导出	0 函数
资源	20 资源
节	8 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Malwarebytes, Inc.
FileDescription	Malwarebytes Premium v4.6.2 (RePack by xetrin)
FileVersion	4.6.2.0.0
LegalCopyright	(c) Caphyon LTD. All rights reserved.
OriginalFileName
ProductName	Malwarebytes Premium
ProductVersion	4.6.2.0.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	95,268 bytes	95,744 bytes	6.39 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`32A7BBDC950101EAA1A05FAE78BB7728`
`.itext`	`0x00019000`	4,364 bytes	4,608 bytes	5.84 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`56F42461DCD171BADEC486174EC1563C`
`.data`	`0x0001b000`	3,532 bytes	3,584 bytes	2.76 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`121489EF40758669C0238BCB232022C0`
`.bss`	`0x0001c000`	22,528 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00022000`	4,106 bytes	4,608 bytes	4.67 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B3B7E9CF1FC78BA601A09769949E02BB`
`.tls`	`0x00024000`	12 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00025000`	24 bytes	512 bytes	0.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C4774D302874C5736A093958BC7D322B`
`.rsrc`	`0x00026000`	152,940 bytes	153,088 bytes	5.30 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`CD158DBC7E1870FE34B8DC8E264DA4D0`

资源分析

▼

资源总数: 20 (151,739 字节)

资源类型	数量	总大小	百分比
RT_ICON	6	111,101 字节	73.2%
RT_STRING	7	3,580 字节	2.4%
RT_RCDATA	4	33,976 字节	22.4%
RT_GROUP_ICON	1	90 字节	0.1%
RT_VERSION	1	1,412 字节	0.9%
RT_MANIFEST	1	1,580 字节	1%

证书链分析

▼

证书 Information

产品	Malwarebytes Premium
描述	Malwarebytes Premium v4.6.2 (RePack by xetrin)
文件版本	4.6.2.0.0
版权	(c) Caphyon LTD. All rights reserved.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

The PE file does not contain a certificate table.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Malwarebytes.Premium.v4.6.2.RePack.by.xetrin.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.146.174
数据库版本	2023-11-03 20:01:06 UTC

Malwarebytes.Premium.v4.6.2.RePack.by.xetrin.exe (Malwarebytes Premium v4.6.2 (RePack by xetrin)) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别