Minecraft exe (Free launcher for Minecraft Alpha) AnjoCaido 文件恶意软件分析

Minecraft.exe (Free launcher for Minecraft Alpha) 文件分析

更新于 3 months ago

检查者 Malware Check

Minecraft.exe

哈希类型	值	操作
MD5	605a171c61a0607bdcf6be80ed07cf95
SHA1	477d4391b0d84406127e43ead289a3596ac1e5e5
SHA256	09b78dc85713ca0f27f17d94c939cc606a59847c1f2b5cdd281b52a48cdaeab9
SHA512	3b32197d76951d0e1cd7043758af9b33be12b30c03df00a3ef36078205fa95b1582f65bdf4437a1b879a922d2950868e905bcd2227ce3816d5437556b103d338
ImpHash	3046475cdc75a158c3fb4da20d2d5415

哈希类型

值

操作

MD5

605a171c61a0607bdcf6be80ed07cf95

SHA1

477d4391b0d84406127e43ead289a3596ac1e5e5

SHA256

09b78dc85713ca0f27f17d94c939cc606a59847c1f2b5cdd281b52a48cdaeab9

SHA512

3b32197d76951d0e1cd7043758af9b33be12b30c03df00a3ef36078205fa95b1582f65bdf4437a1b879a922d2950868e905bcd2227ce3816d5437556b103d338

ImpHash

3046475cdc75a158c3fb4da20d2d5415

PE 分析

基本信息

▼

图标	哈希: 79cfd9bd6eb0e481fca2e81547907a57 模糊: 3942391b378286c0358c6aa17ab74371 dHash: 70e0f0b09a9af870
映像基址	`0x00400000`
入口点	`0x004011d8`
编译时间	2010-06-14 14:51:18
校验和	0x00000000 (实际: 0x000b0a93)
操作系统版本	4.0
PEiD 签名	`PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows`
数字签名	No valid SignedData structure was found.
导入	6 库 ADVAPI32, COMCTL32, KERNEL32, msvcrt, SHELL32, USER32
导出	0 函数
资源	9 资源
节	5 节

版本信息

▼

CompanyName	AnjoCaido
FileDescription	Free launcher for Minecraft Alpha
FileVersion	12.1.2.0
LegalCopyright	2010 AnjoCaido (but Mojang have the rights over the game, you pirate!)
ProductName	MinecraftSP
ProductVersion	12.1.2.0
OriginalFilename	MinecraftSP.exe
InternalName	MinecraftSP
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	127,672 bytes	128,000 bytes	6.50 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`604D9073543C409C97A9E8F97D9B425E`
`.data`	`0x00021000`	4,280 bytes	4,608 bytes	5.33 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5F4C9B7452D12D362214381FAA95FB45`
`.bss`	`0x00023000`	50,672 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00030000`	5,324 bytes	5,632 bytes	4.86 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B76E6CBB91A84F68BD9AB516562231FC`
`.rsrc`	`0x00032000`	356,352 bytes	356,352 bytes	4.89 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`6F5819AA68AD5E68ADA2C2A95D8A9381`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 9 (355,046 字节)

资源类型	数量	总大小	百分比
RT_ICON	5	353,032 字节	99.4%
RT_DIALOG	1	302 字节	0.1%
RT_GROUP_ICON	1	76 字节	0%
RT_VERSION	1	852 字节	0.2%
RT_MANIFEST	1	784 字节	0.2%

证书链分析

▼

证书 Information

产品	MinecraftSP
描述	Free launcher for Minecraft Alpha
文件版本	12.1.2.0
原始名称	MinecraftSP.exe
内部名称	MinecraftSP
版权	2010 AnjoCaido (but Mojang have the rights over the game, you pirate!)

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Minecraft.exe
文件类型	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
扫描器版本	1.0.226.174
数据库版本	2025-10-07 14:00:27 UTC

Minecraft.exe (Free launcher for Minecraft Alpha) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别