一个怀疑染毒文件所做的简单比较

今天由于拆包的需要,用到一个hex->float的工具..之前一同事发过来的工具很好用,但由于重装机器的关系没有做好备份.

所以再次向其索要.

收到后,直接在win7 sp1打开(我没有装杀软,只是裸奔.),却报错....

扔到另一有装杀软的同事机上,报出病毒,

如下图

文件经过杀毒之后, 我就可以在本机运行了.(文件由原来的50K左右变成了现在的25K左右)

我就开始猜想是不是病毒作为一部分加在了可运行文件之前.

于是我用dumpbin /header [filename]进行了分析,

最终得出差异的截图如下

bumpbin输出分别如下

分别如下.

ori.exe

Microsoft (R) COFF Binary File Dumper Version 6.00.8168
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.




Dump of file ori.exe


PE signature found


File Type: EXECUTABLE IMAGE


FILE HEADER VALUES
             14C machine (i386)
               5 number of sections
        4B8E2C76 time date stamp Wed Mar 03 17:31:34 2010
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             10F characteristics
                   Relocations stripped
                   Executable
                   Line numbers stripped
                   Symbols stripped
                   32 bit word machine


OPTIONAL HEADER VALUES
             10B magic #
            6.00 linker version
            8000 size of code
            3000 size of initialized data
               0 size of uninitialized data
            6000 RVA of entry point
            1000 base of code
            3000 base of data
          400000 image base
            1000 section alignment
            1000 file alignment
            4.00 operating system version
            0.00 image version
            4.00 subsystem version
               0 Win32 version
            C000 size of image
            1000 size of headers
               0 checksum
               2 subsystem (Windows GUI)
               0 DLL characteristics
          100000 size of stack reserve
            1000 size of stack commit
          100000 size of heap reserve
            1000 size of heap commit
               0 loader flags
              10 number of directories
               0 [       0] RVA [size] of Export Directory
            3860 [      78] RVA [size] of Import Directory
            5000 [     DF8] RVA [size] of Resource Directory
               0 [       0] RVA [size] of Exception Directory
               0 [       0] RVA [size] of Certificates Directory
               0 [       0] RVA [size] of Base Relocation Directory
               0 [       0] RVA [size] of Debug Directory
               0 [       0] RVA [size] of Architecture Directory
               0 [       0] RVA [size] of Special Directory
               0 [       0] RVA [size] of Thread Storage Directory
               0 [       0] RVA [size] of Load Configuration Directory
               0 [       0] RVA [size] of Bound Import Directory
            3000 [     234] RVA [size] of Import Address Table Directory
               0 [       0] RVA [size] of Delay Import Directory
               0 [       0] RVA [size] of Reserved Directory
               0 [       0] RVA [size] of Reserved Directory




SECTION HEADER #1
   .text name
    1932 virtual size
    1000 virtual address
    2000 size of raw data
    1000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read


SECTION HEADER #2
  .rdata name
     D06 virtual size
    3000 virtual address
    1000 size of raw data
    3000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         Read Only


SECTION HEADER #3
   .data name
     1A8 virtual size
    4000 virtual address
    1000 size of raw data
    4000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
C0000040 flags
         Initialized Data
         Read Write


SECTION HEADER #4
   .rsrc name
     DF8 virtual size
    5000 virtual address
    1000 size of raw data
    5000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         Read Only


SECTION HEADER #5
      .. name
    6000 virtual size
    6000 virtual address
    6000 size of raw data
    6000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
      67 number of line numbers
E0000020 flags
         Code
         Execute Read Write


  Summary


        6000 ..
        1000 .data
        1000 .rdata
        1000 .rsrc
        2000 .text

--------------------------------------------------------------------------------------------------------

fix.exe

Microsoft (R) COFF Binary File Dumper Version 6.00.8168
Copyright (C) Microsoft Corp 1992-1998. All rights reserved.




Dump of file fix.exe


PE signature found


File Type: EXECUTABLE IMAGE


FILE HEADER VALUES
             14C machine (i386)
               4 number of sections
        4A67DFF0 time date stamp Thu Jul 23 11:58:40 2009
               0 file pointer to symbol table
               0 number of symbols
              E0 size of optional header
             10F characteristics
                   Relocations stripped
                   Executable
                   Line numbers stripped
                   Symbols stripped
                   32 bit word machine


OPTIONAL HEADER VALUES
             10B magic #
            6.00 linker version
            8000 size of code
            3000 size of initialized data
               0 size of uninitialized data
            2040 RVA of entry point
            1000 base of code
            3000 base of data
          400000 image base
            1000 section alignment
            1000 file alignment
            4.00 operating system version
            0.00 image version
            4.00 subsystem version
               0 Win32 version
            6000 size of image
            1000 size of headers
               0 checksum
               2 subsystem (Windows GUI)
               0 DLL characteristics
          100000 size of stack reserve
            1000 size of stack commit
          100000 size of heap reserve
            1000 size of heap commit
               0 loader flags
              10 number of directories
               0 [       0] RVA [size] of Export Directory
            36D8 [      64] RVA [size] of Import Directory
            5000 [     D60] RVA [size] of Resource Directory
               0 [       0] RVA [size] of Exception Directory
               0 [       0] RVA [size] of Certificates Directory
               0 [       0] RVA [size] of Base Relocation Directory
               0 [       0] RVA [size] of Debug Directory
               0 [       0] RVA [size] of Architecture Directory
               0 [       0] RVA [size] of Special Directory
               0 [       0] RVA [size] of Thread Storage Directory
               0 [       0] RVA [size] of Load Configuration Directory
               0 [       0] RVA [size] of Bound Import Directory
            3000 [     200] RVA [size] of Import Address Table Directory
               0 [       0] RVA [size] of Delay Import Directory
               0 [       0] RVA [size] of Reserved Directory
               0 [       0] RVA [size] of Reserved Directory




SECTION HEADER #1
   .text name
    12E2 virtual size
    1000 virtual address
    2000 size of raw data
    1000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
60000020 flags
         Code
         Execute Read


SECTION HEADER #2
  .rdata name
     B0A virtual size
    3000 virtual address
    1000 size of raw data
    3000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         Read Only


SECTION HEADER #3
   .data name
     178 virtual size
    4000 virtual address
    1000 size of raw data
    4000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
C0000040 flags
         Initialized Data
         Read Write


SECTION HEADER #4
   .rsrc name
     D60 virtual size
    5000 virtual address
    1000 size of raw data
    5000 file pointer to raw data
       0 file pointer to relocation table
       0 file pointer to line numbers
       0 number of relocations
       0 number of line numbers
40000040 flags
         Initialized Data
         Read Only


  Summary


        1000 .data
        1000 .rdata
        1000 .rsrc
        2000 .text