Testdisk win exe CGSecurity 文件恶意软件分析

Testdisk_win.exe 文件分析

更新于 25 days ago

检查者 Malware Check

testdisk_win.exe

哈希类型	值	操作
MD5	d458aada96e6bcca437d748ed1913c39
SHA1	ac19fad0f67bf1f0fe23fed383e99916ce025dc4
SHA256	ce53c53953d48f8c3fb39e50c3b5e27fc89c188735a350fb53b32673124a986d
SHA512	302af6eebd1fdd69312e9fc0840a27aa0f97cb9b5fde3002b6b03a630a9e5aeca8281d28efe1c066cd34d496b6384cb3b4a7c8e9a29f7186bafd63c7dec563e5
ImpHash	14bb56eef602d517a4f92465a0632380

哈希类型

值

操作

MD5

d458aada96e6bcca437d748ed1913c39

SHA1

ac19fad0f67bf1f0fe23fed383e99916ce025dc4

SHA256

ce53c53953d48f8c3fb39e50c3b5e27fc89c188735a350fb53b32673124a986d

SHA512

302af6eebd1fdd69312e9fc0840a27aa0f97cb9b5fde3002b6b03a630a9e5aeca8281d28efe1c066cd34d496b6384cb3b4a7c8e9a29f7186bafd63c7dec563e5

ImpHash

14bb56eef602d517a4f92465a0632380

PE 分析

基本信息

▼

图标	哈希: cbe9f568a9839b48fab7fa168a0d883f 模糊: 42d0e6e8cbfa4ef080811a93b1d9ce86 dHash: e991a8b0a66d3098
映像基址	`0x100400000`
入口点	`0x100401000`
编译时间	2025-11-29 15:10:29
校验和	0x000bd551 (实际: 0x000bd551)
操作系统版本	4.0
PEiD 签名	`PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows`
数字签名	Chain verification from [email protected], CN=Open Source Developer\, Christophe GRENIER, O=Open Source Developer, L=LE PERREUX-SUR-MARNE, ST=ILE DE FRANCE, C=FR (serial:34064927953462066999046785409715031933, sha1:6d2d393fe19a31948adc12ca06908886b3c65b60) failed: The path could not be validated because the end-entity certificate expired 2024-06-15 10:00:27Z
导入	6 库 cyggcc_s-seh-1, cygwin1, cygewf-2, cygiconv-2, cygncursesw-10, KERNEL32
导出	0 函数
资源	6 资源
节	10 节

版本信息

▼

CompanyName	CGSecurity
ProductName	TestDisk
FileDescription	TestDisk
InternalName	TestDisk
OriginalFilename	testdisk_win.exe
Comments	Partition and file recovery utility
FileVersion	7.3
ProductVersion	7.3
LegalCopyright	Copyright (C) 1998-2025 Christophe GRENIER, et al.
Translation	0x0409 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	511,024 bytes	511,488 bytes	6.23 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`60439575EF561B6F5A64DCD3C4949B94`
`.data`	`0x0007e000`	3,552 bytes	3,584 bytes	2.68 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`2C8387B0756667510103EF52D9CC9ECD`
`.rdata`	`0x0007f000`	188,112 bytes	188,416 bytes	6.44 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`373CF5825752BD5AD4DC1C63B349046C`
`.buildid`	`0x000ad000`	53 bytes	512 bytes	0.57 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`46320BF92D7E738D3D3A64320D036815`
`.pdata`	`0x000ae000`	16,860 bytes	16,896 bytes	5.75 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3F4BD0A66CC48B1A4F7893F6B717726E`
`.xdata`	`0x000b3000`	16,604 bytes	16,896 bytes	4.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E61FDF24E1C9AD489C251F57DD210ACD`
`.bss`	`0x000b8000`	66,240 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c9000`	7,084 bytes	7,168 bytes	4.29 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BF8EA0D995F976D4B594596E44B5744F`
`.rsrc`	`0x000cb000`	10,432 bytes	10,752 bytes	5.01 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7C61A120BEA1147D33A6A40B1B3C2559`
`.reloc`	`0x000ce000`	1,308 bytes	1,536 bytes	4.93 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`EF4FBF2EED66FE18BF1A384D43DD0493`

资源分析

▼

资源总数: 6 (8,758 字节)

资源类型	数量	总大小	百分比
RT_ICON	3	7,352 字节	83.9%
RT_GROUP_ICON	1	48 字节	0.5%
RT_VERSION	1	836 字节	9.5%
RT_MANIFEST	1	522 字节	6%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

Chain verification from [email protected], CN=Open Source Developer\, Christophe GRENIER, O=Open Source Developer, L=LE PERREUX-SUR-MARNE, ST=ILE DE FRANCE, C=FR (serial:34064927953462066999046785409715031933, sha1:6d2d393fe19a31948adc12ca06908886b3c65b60) failed: The path could not be validated because the end-entity certificate expired 2024-06-15 10:00:27Z

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	testdisk_win.exe
文件类型	PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-16 23:00:31 UTC

Testdisk_win.exe 文件分析

技术分析

干净文件

扫描另一个文件

文件识别