SAF exe (Sistema de Análise Financeira Setup) Fábio Meireles Vieira 文件恶意软件分析

SAF.exe (Sistema de Análise Financeira Setup) 文件分析

更新于 2 months ago

检查者 Malaware Check

SAF.exe

哈希类型	值	操作
MD5	a3b361ba5dc7ca4eb16822b291ad97c1
SHA1	3885ab006928306c5af98388f40a8b17be3c5122
SHA256	0cfe3dc220ad8e10ebb498e75895bb5eb729bd44d6e78bfcb87c8f4d41036929
SHA512	da253f4b6028754db4eb3f0fa20b5b561f3b05dd8ff48ac858f01f5c0d43a28fc01fb8af8d329104c5e6d23c528895cae32904b74449e189206419182ba1876d
ImpHash	40ab50289f7ef5fae60801f88d4541fc

哈希类型

值

操作

MD5

a3b361ba5dc7ca4eb16822b291ad97c1

SHA1

3885ab006928306c5af98388f40a8b17be3c5122

SHA256

0cfe3dc220ad8e10ebb498e75895bb5eb729bd44d6e78bfcb87c8f4d41036929

SHA512

da253f4b6028754db4eb3f0fa20b5b561f3b05dd8ff48ac858f01f5c0d43a28fc01fb8af8d329104c5e6d23c528895cae32904b74449e189206419182ba1876d

ImpHash

40ab50289f7ef5fae60801f88d4541fc

PE 分析

基本信息

▼

图标	哈希: 801ba641dd7ccbe11c8f48b79854d301 模糊: 77226d8e569240fd6c8b4302c0e67468 dHash: 33337349d909c9b2
映像基址	`0x00400000`
入口点	`0x004a83bc`
编译时间	2024-07-12 07:26:53
校验和	0x00000000 (实际: 0x05226674)
操作系统版本	6.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	5 库 kernel32, comctl32, user32, oleaut32, advapi32
导出	2 函数
资源	18 资源
节	11 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Fábio Meireles Vieira
FileDescription	Sistema de Análise Financeira Setup
FileVersion
LegalCopyright
OriginalFileName
ProductName	Sistema de Análise Financeira
ProductVersion	1.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	677,516 bytes	677,888 bytes	6.38 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`B889D302F6FC48A904DE33D8D947AE80`
`.itext`	`0x000a7000`	7,012 bytes	7,168 bytes	6.11 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`588DD0A8AB499300D3701CBD11B017D9`
`.data`	`0x000a9000`	14,392 bytes	14,848 bytes	4.96 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5C0C76E77AEF52EBC6702430837CCB6E`
`.bss`	`0x000ad000`	29,272 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000b5000`	4,076 bytes	4,096 bytes	5.02 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`627340DFF539EF99048969AA4824FB2D`
`.didata`	`0x000b6000`	420 bytes	512 bytes	2.73 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`FD11C1109737963CC6CB7258063ABFD6`
`.edata`	`0x000b7000`	113 bytes	512 bytes	1.31 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7DE8CA0C7A61668A728FD3A88DC0942D`
`.tls`	`0x000b8000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000b9000`	93 bytes	512 bytes	1.39 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D84006640084DC9F74A07C2FF9C7D656`
`.reloc`	`0x000ba000`	69,544 bytes	69,632 bytes	6.71 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`A85FDA2741BD9417695DAA5FC5A9D7A5`
`.rsrc`	`0x000cb000`	39,192 bytes	39,424 bytes	3.95 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`082DFC273F64422DA500A7AC2F933CAD`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 18 (38,112 字节)

资源类型	数量	总大小	百分比
RT_ICON	1	25,540 字节	67%
RT_STRING	11	8,336 字节	21.9%
RT_RCDATA	3	844 字节	2.2%
RT_GROUP_ICON	1	20 字节	0.1%
RT_VERSION	1	1,412 字节	3.7%
RT_MANIFEST	1	1,960 字节	5.1%

证书链分析

▼

证书 Information

产品	Sistema de Análise Financeira
描述	Sistema de Análise Financeira Setup

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	SAF.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.212.174
数据库版本	2025-04-05 02:00:38 UTC

SAF.exe (Sistema de Análise Financeira Setup) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别