Clv3 5 exe (My Application) 文件恶意软件分析

技术分析

文件名	clv3-5.exe
文件类型	Win32 EXE
魔术字节	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP 哈希	196608:j0qE40RLnHdyteDebsmzYdVtXvk3lTobtSWVSmMWai+yUfojxlOkt3grxk9ed:hEtdVDebs7dVtXs3tVumWaed7O8m
扫描器版本	1.0.209.174
数据库版本	2025-03-02 19:00:38 UTC

扫描另一个文件

文件识别

哈希类型	值	操作
MD5	4ab0d6a360b22d8f81fbbbfe17b1a51b
SHA1	9451a1e1cc3bcbea7a548ce50f6b6bd2d25f3c34
SHA256	db6726c9b261424c98828b2d6763e8eefc8785fc671837292d832b8e5d24a146
SHA512	2fbd7364779670fb55cdc1cd7c1af97958480779a4c7a322adeeb3198e2d4c4f918e9c523e64df37a205634a74f4a22a024e441ba0dbd3c3bb06300960f83bbf
ImpHash	4bf36642e452924a3590ed46758fa452

检测到威胁的安全引擎 (2 共 72)

Bkav

W32.AIDetectMalware Malicious

Microsoft

Program:Win32/Wacapew.C!ml Malicious

70 个引擎未报告威胁 - 为清晰起见，仅显示有检测结果的引擎

PE 分析

基本信息

▼

图标	哈希: 4b9c40f4286b5473ff851a09c143b996 模糊: 2bb306cfbabdcb1c0999d5cc296ebe8a dHash: 2188d1622c8525a8
映像基址	`0x00400000`
入口点	`0x004245ac`
编译时间	2020-06-03 15:46:44
校验和	0x00bf9bc2 (实际: 0x00bf9bc2)
操作系统版本	5.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	7 库 kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
导出	2 函数
资源	15 资源
节	10 节

版本信息

▼

FileDescription	My Application
FileVersion	1.0.0.0
LegalCopyright	Copyright Your Company
ProductName	XLS Padlock Protected Workbook
ProductVersion	1.0.0.0
Key
LegalTrademarks	Built with XLS Padlock: http://www.xlspadlock.com
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	140,196 bytes	140,288 bytes	6.44 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`F7C0EFF9574707320BFA472282CF4411`
`.itext`	`0x00024000`	1,516 bytes	1,536 bytes	6.01 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`253DA2CE69294D197BB40789CA9E64D3`
`.data`	`0x00025000`	357,324 bytes	357,376 bytes	7.99 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F0220C0217F89D0704865B1911908F1A`
`.bss`	`0x0007d000`	22,796 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00083000`	2,776 bytes	3,072 bytes	4.68 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E0BBF0A14067D989432F356274A3723F`
`.didata`	`0x00084000`	456 bytes	512 bytes	3.01 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`AC6A269926ECDB4FA128959C7E246C33`
`.edata`	`0x00085000`	121 bytes	512 bytes	1.43 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6242C8BA0DB39B3793A58F923DF6B05F`
`.tls`	`0x00086000`	20 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00087000`	93 bytes	512 bytes	1.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4AF5DACADE3A314410F8A7878926D7A6`
`.rsrc`	`0x00088000`	8,308 bytes	8,704 bytes	4.18 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`61AF7152501D11F95B2CCE86FE93EEBE`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 15 (7,359 字节)

资源类型	数量	总大小	百分比
RT_ICON	1	744 字节	10.1%
RT_STRING	9	4,426 字节	60.1%
RT_RCDATA	2	18 字节	0.2%
RT_GROUP_ICON	1	20 字节	0.3%
RT_VERSION	1	732 字节	9.9%
RT_MANIFEST	1	1,419 字节	19.3%

证书链分析

▼

证书 Information

产品	XLS Padlock Protected Workbook
描述	My Application
文件版本	1.0.0.0
版权	Copyright Your Company

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

Clv3-5.exe (My Application) 文件分析