KMSTools exe Crack KMS 文件恶意软件分析: 9828f7b373e722da225b8455542b41e8

KMSTools.exe Crack KMS 分析

更新于 2 years ago

检查者 Malware Check

KMSTools.exe

哈希类型	值	操作
MD5	9828f7b373e722da225b8455542b41e8
SHA1	e3512b651c51e187a452a74e3e51651f24d6fdc1
SHA256	b0e5352b737bf904cb50a9e8aaacd88b30b7e35ba344e31dc9298de20146ed9b
SHA512	578ce01609993e402c93bfc03ff554724173b7f08cddd0b8996519d2b2cd3b0acd43bbd2ccdb95440c6e62fc95076d642b216acf0f6299bc0f32bbee8c665f7b
ImpHash	dbab39f0229f5161855ba872bf93162d

哈希类型

值

操作

MD5

9828f7b373e722da225b8455542b41e8

SHA1

e3512b651c51e187a452a74e3e51651f24d6fdc1

SHA256

b0e5352b737bf904cb50a9e8aaacd88b30b7e35ba344e31dc9298de20146ed9b

SHA512

578ce01609993e402c93bfc03ff554724173b7f08cddd0b8996519d2b2cd3b0acd43bbd2ccdb95440c6e62fc95076d642b216acf0f6299bc0f32bbee8c665f7b

ImpHash

dbab39f0229f5161855ba872bf93162d

PE 分析

基本信息

▼

图标	哈希: 94411a7ac6c8b4bf932b5dac2210f721 模糊: 73da8a07a83dd014e1f1a85021f0cd92 dHash: b848c8f8b8d87426
映像基址	`0x00400000`
入口点	`0x00401000`
编译时间	2018-09-01 04:24:04
校验和	0x01f7d52c (实际: 0x01f7d52c)
操作系统版本	4.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	Chain verification from CN=WZTeam (serial:-34590325592400973612903392563650996340, sha1:87b3a6c360b37d6db7f970dd1dc0009fbbd13ba0) failed: The X.509 certificate provided is self-signed - "Common Name: WZTeam"
导入	22 库
导出	0 函数
资源	9 资源
节	5 节

数字签名

▼

WZTeam	()
UTN-USERFirst-Object	COMODO CA Limited (GB)

版本信息

▼

CompanyName	Ratiborus
ProductName	KMS Tools Portable x86
LegalCopyright	Ratiborus
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.code`	`0x00001000`	79,696 bytes	79,872 bytes	5.87 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`5D44321E7BD969DC4ACF8E588FA725A8`
`.text`	`0x00015000`	467,249 bytes	467,456 bytes	6.61 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`71650CECA4011CC3AB51C27FA204BF52`
`.rdata`	`0x00088000`	105,188 bytes	105,472 bytes	5.74 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`35D3F1FEFF30240709F6D9A3CE354D8C`
`.data`	`0x000a2000`	32,221,152 bytes	32,214,528 bytes	7.98 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`0F8EDFC9EFE1774CBF52E4281E10330C`
`.rsrc`	`0x01f5d000`	107,368 bytes	107,520 bytes	7.72 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5B4CDA1E1040417C4775900CF4C39A9C`

熵分析警报

2 检测到高熵（≥7.5）的节 - 可能存在打包/加密

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 9 (106,814 字节)

资源类型	数量	总大小	百分比
RT_ICON	6	105,502 字节	98.8%
RT_GROUP_ICON	1	90 字节	0.1%
RT_VERSION	1	408 字节	0.4%
RT_MANIFEST	1	814 字节	0.8%

证书链分析

▼

证书 #1

主题	WZTeam
颁发者	WZTeam
序列号	`-155843482902537470358085606074993314206`

证书 #2

主题	COMODO SHA-1 Time Stamping Signer COMODO CA Limited GB
颁发者	UTN-USERFirst-Object
序列号	`117007971038687812527568897756771083`

证书验证状态

Chain verification from CN=WZTeam (serial:-34590325592400973612903392563650996340, sha1:87b3a6c360b37d6db7f970dd1dc0009fbbd13ba0) failed: The X.509 certificate provided is self-signed - "Common Name: WZTeam"

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	KMSTools.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.147.174
数据库版本	2023-11-20 14:02:37 UTC

KMSTools.exe Crack KMS 分析

技术分析

Crack.Win32.KMS.vl!c

扫描另一个文件

文件识别