Aida64extreme692 exe (AIDA64 Extreme) FinalWire Ltd 文件恶意软件分析

Aida64extreme692.exe (AIDA64 Extreme) 文件分析

更新于 2 years ago

检查者 Malware Check

aida64extreme692.exe

哈希类型	值	操作
MD5	0d7859e3a7395f0feecd901d3e68d139
SHA1	01c82ec2ab8fa703a20cd0c5766309fbcfb5aed4
SHA256	c18d190c44c6f02a9d4be71bbe33d500a40d4e3afa1135f9126f5b3982f7358f
SHA512	4fc25815bf60ae50df1232a755e211c0026b2ac5fde1f5dcb50d382dcc0ddff0c46a88fafcae73fc668d51c9c621949ba8e28b01b3f64570769610a45860b1c5
ImpHash	884310b1928934402ea6fec1dbd3cf5e

哈希类型

值

操作

MD5

0d7859e3a7395f0feecd901d3e68d139

SHA1

01c82ec2ab8fa703a20cd0c5766309fbcfb5aed4

SHA256

c18d190c44c6f02a9d4be71bbe33d500a40d4e3afa1135f9126f5b3982f7358f

SHA512

4fc25815bf60ae50df1232a755e211c0026b2ac5fde1f5dcb50d382dcc0ddff0c46a88fafcae73fc668d51c9c621949ba8e28b01b3f64570769610a45860b1c5

ImpHash

884310b1928934402ea6fec1dbd3cf5e

PE 分析

基本信息

▼

图标	哈希: 30adcb5c0b2e3c35eaec2c110733c9f8 模糊: c98f96d6ffe5af8d4eb0870c1dc20826 dHash: 92e0b496a6cada72
映像基址	`0x00400000`
入口点	`0x0040a5f8`
编译时间	1992-06-19 22:22:17
校验和	0x03e1de7c (实际: 0x03e1de7c)
操作系统版本	1.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	OK
导入	5 库 kernel32, user32, oleaut32, advapi32, comctl32
导出	0 函数
资源	14 资源
节	8 节

数字签名

▼

DigiCert Assured ID Root CA	DigiCert Inc (US)
DigiCert Trusted Root G4	DigiCert, Inc. (US)
DigiCert Trusted Root G4	DigiCert, Inc. (US)
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA	DigiCert, Inc. (US)
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1	FinalWire Kft. (HU)

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	FinalWire Ltd.
FileDescription	AIDA64 Extreme
FileVersion	6.92.6600.0
LegalCopyright	Copyright (c) 1995-2023 FinalWire Ltd.
ProductName	AIDA64 Extreme
ProductVersion	6.92
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`CODE`	`0x00001000`	40,240 bytes	40,448 bytes	6.63 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`C3BD95C4B1A8E5199981E0D9B45FD18C`
`DATA`	`0x0000b000`	592 bytes	1,024 bytes	2.75 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1EE71D84F1C77AF85F1F5C278F880572`
`BSS`	`0x0000c000`	3,724 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0000d000`	2,384 bytes	2,560 bytes	4.43 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BB5485BF968B970E5EA81292AF2ACDBA`
`.tls`	`0x0000e000`	8 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x0000f000`	24 bytes	512 bytes	0.20 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`9BA824905BF9C7922B6FC87A38B74366`
`.reloc`	`0x00010000`	2,244 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rsrc`	`0x00011000`	11,264 bytes	11,264 bytes	4.57 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`92E0FD6D5D7DF9AD5BF24FCE3BF722D0`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 14 (10,236 字节)

资源类型	数量	总大小	百分比
RT_ICON	4	4,640 字节	45.3%
RT_STRING	6	2,710 字节	26.5%
RT_RCDATA	1	44 字节	0.4%
RT_GROUP_ICON	1	62 字节	0.6%
RT_VERSION	1	1,268 字节	12.4%
RT_MANIFEST	1	1,512 字节	14.8%

证书链分析

▼

证书 #1

主题	DigiCert Trusted Root G4 DigiCert Inc US
颁发者	DigiCert Assured ID Root CA
序列号	`19414496059604725969669510860671817818`

证书 #2

主题	DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA DigiCert, Inc. US
颁发者	DigiCert Trusted Root G4
序列号	`9586110043380832440035821245782711899`

证书 #3

主题	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 DigiCert, Inc. US
颁发者	DigiCert Trusted Root G4
序列号	`11533403529598586876501374841704918745`

证书 #4

主题	DigiCert Timestamp 2023 DigiCert, Inc. US
颁发者	DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA
序列号	`7002784885422699301467740558332354838`

证书 #5

主题	FinalWire Kft. FinalWire Kft. HU
颁发者	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
序列号	`16189104388543047790406463199627617008`

证书验证状态

发表评论

文件名	aida64extreme692.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.148.174
数据库版本	2023-11-25 08:01:28 UTC