Game exe (nwjs) The NW js Community 文件恶意软件分析

Game.exe (nwjs) 文件分析

更新于 14 days ago

检查者 Malware Check

Game.exe

哈希类型	值	操作
MD5	3659d39ef2bd1ce840391ec5e24c99f9
SHA1	72020a52f241b8f4373018ab6fd8f8dee1d1c568
SHA256	006563f6d4848889df34dba808d1ded64a7bb13fe7a65f787e5ccec772f00252
SHA512	9bdc6158fcd884be4e47a6847c091b3a9a2c826d5089655769ba918412b501c143b3c475adb4293916a9c878d2b22a8ea452578c918be07dddf35576dff91d69
ImpHash	f18952a1b4265d767ec0bab410377559

哈希类型

值

操作

MD5

3659d39ef2bd1ce840391ec5e24c99f9

SHA1

72020a52f241b8f4373018ab6fd8f8dee1d1c568

SHA256

006563f6d4848889df34dba808d1ded64a7bb13fe7a65f787e5ccec772f00252

SHA512

9bdc6158fcd884be4e47a6847c091b3a9a2c826d5089655769ba918412b501c143b3c475adb4293916a9c878d2b22a8ea452578c918be07dddf35576dff91d69

ImpHash

f18952a1b4265d767ec0bab410377559

PE 分析

基本信息

▼

图标	哈希: c78ea2e284ddc9feb131b0bb9b0335f2 模糊: 359bb7409f6d66c2043431322b378e73 dHash: 70f0b23319aecc70
映像基址	`0x140000000`
入口点	`0x140161d40`
编译时间	2024-06-02 05:00:00
校验和	0x00000000 (实际: 0x00256a8c)
操作系统版本	10.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB 路径	`E:\nw89_sdk_win64\node-webkit\src\outst\nw\initialexe\nw.exe.pdb`
数字签名	No valid SignedData structure was found.
导入	4 库 nw_elf, KERNEL32, VERSION, ntdll
导出	3 函数
资源	62 资源
节	14 节

版本信息

▼

CompanyName	The NW.js Community
FileDescription	nwjs
FileVersion	0.89.0
InternalName	nw_exe
LegalCopyright	Copyright 2023, The NW.js community and The Chromium Authors. All rights reserved.
OriginalFilename	nw.exe
ProductName	nwjs
ProductVersion	0.89.0
CompanyShortName	nwjs.io
ProductShortName	nwjs
LastChange	0000000000000000000000000000000000000000-0000000000000000000000000000000000000000
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	1,685,124 bytes	1,685,504 bytes	6.51 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`102057C5358C1C2D4D3C6C83D235D4F0`
`.rdata`	`0x0019d000`	278,972 bytes	279,040 bytes	5.66 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`AE68C9C075A5F1851DBD94927554B798`
`.data`	`0x001e2000`	37,504 bytes	13,824 bytes	3.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`DDE58362101B0610D57C7A6CB08E8C05`
`.pdata`	`0x001ec000`	55,944 bytes	56,320 bytes	6.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`35314512E0AC03D3D8CB2FF0E0171D53`
`.gxfg`	`0x001fa000`	11,856 bytes	12,288 bytes	5.11 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4EC578B1EC89E882AFA14560783DD61B`
`.retplne`	`0x001fd000`	168 bytes	512 bytes	1.32 (正常)	`0x00000000`	`5ECCA2C6EA1D296F112E2A3940D7AF4A`
`.tls`	`0x001fe000`	538 bytes	1,024 bytes	0.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E9AD5582537B327998FF97667BD7D385`
`.voltbl`	`0x001ff000`	68 bytes	512 bytes	1.14 (正常)	`0x00000000`	`3E0C0EC85F664161CF947E236F80C926`
`CPADinfo`	`0x00200000`	56 bytes	512 bytes	0.12 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`60D3EA61D541C9BE2E845D2787FB9574`
`_RDATA`	`0x00201000`	244 bytes	512 bytes	2.44 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D0670515549DEB3A3530DCC27BD08463`
`malloc_h`	`0x00202000`	304 bytes	512 bytes	4.46 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`A9C86B7B9C75F846C8F8AE782BE1C4F4`
`prot`	`0x00203000`	116 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x00204000`	379,416 bytes	379,904 bytes	4.71 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F0EA1CA03E8D2E10770255520B73BAF5`
`.reloc`	`0x00261000`	8,072 bytes	8,192 bytes	5.44 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`90F8AC7190A9E74FA29072216689A384`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 62 (375,883 字节)

资源类型	数量	总大小	百分比
GOOGLEUPDATEAPPLICATIONCOMMANDS	1	4 字节	0%
RT_CURSOR	23	56,516 字节	15%
RT_ICON	12	316,655 字节	84.2%
RT_GROUP_CURSOR	21	448 字节	0.1%
RT_GROUP_ICON	3	186 字节	0%
RT_VERSION	1	1,096 字节	0.3%
RT_MANIFEST	1	978 字节	0.3%

证书链分析

▼

证书 Information

产品	nwjs
描述	nwjs
文件版本	0.89.0
原始名称	nw.exe
内部名称	nw_exe
版权	Copyright 2023, The NW.js community and The Chromium Authors. All rights reserved.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Game.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-27 02:00:48 UTC

Game.exe (nwjs) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别