MSetup exe (Installer Life is Strange Double Exposure) Square Enix 文件恶意软件分析

MSetup.exe (Installer Life is Strange Double Exposure) 文件分析

更新于 2 days ago

检查者 Malware Check

mSetup.exe

哈希类型	值	操作
MD5	e0d4fe3501cf3d0b7e8dead0a950cc2d
SHA1	f3c30c697209dc8b88924059256c4332f63334ba
SHA256	16ae5f37f37af7c87e304237d02c59465fc1bbacd3e844a6e144f6ab9ddbba39
SHA512	b38d1ae1be600ae2a4a4adb15334509c42e1bb6c210c7c0c3a331a23816aaaee7bd45a7ce7e90d3679e22011b719f78483b9074554fcfff3cd172256ef42ec1e
ImpHash	40ab50289f7ef5fae60801f88d4541fc

哈希类型

值

操作

MD5

e0d4fe3501cf3d0b7e8dead0a950cc2d

SHA1

f3c30c697209dc8b88924059256c4332f63334ba

SHA256

16ae5f37f37af7c87e304237d02c59465fc1bbacd3e844a6e144f6ab9ddbba39

SHA512

b38d1ae1be600ae2a4a4adb15334509c42e1bb6c210c7c0c3a331a23816aaaee7bd45a7ce7e90d3679e22011b719f78483b9074554fcfff3cd172256ef42ec1e

ImpHash

40ab50289f7ef5fae60801f88d4541fc

PE 分析

基本信息

▼

图标	哈希: 2332d625ae685fd1f814a9210125d508 模糊: b527a7de5419ed98af8c7f3f197473f3 dHash: 7cd6bbb939b8d4c0
映像基址	`0x00400000`
入口点	`0x004a83bc`
编译时间	2024-07-12 07:26:53
校验和	0x00000000 (实际: 0x002810bb)
操作系统版本	6.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	5 库 kernel32, comctl32, user32, oleaut32, advapi32
导出	2 函数
资源	23 资源
节	11 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Square Enix
FileDescription	Installer Life is Strange Double Exposure
FileVersion	1.1.102.7899
LegalCopyright
OriginalFileName
ProductName	Life is Strange Double Exposure
ProductVersion	1.1.102.7899
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	677,516 bytes	677,888 bytes	6.38 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`B889D302F6FC48A904DE33D8D947AE80`
`.itext`	`0x000a7000`	7,012 bytes	7,168 bytes	6.11 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`588DD0A8AB499300D3701CBD11B017D9`
`.data`	`0x000a9000`	14,392 bytes	14,848 bytes	4.96 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5C0C76E77AEF52EBC6702430837CCB6E`
`.bss`	`0x000ad000`	29,272 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000b5000`	4,076 bytes	4,096 bytes	5.02 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`627340DFF539EF99048969AA4824FB2D`
`.didata`	`0x000b6000`	420 bytes	512 bytes	2.73 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`FD11C1109737963CC6CB7258063ABFD6`
`.edata`	`0x000b7000`	113 bytes	512 bytes	1.31 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7DE8CA0C7A61668A728FD3A88DC0942D`
`.tls`	`0x000b8000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000b9000`	93 bytes	512 bytes	1.39 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D84006640084DC9F74A07C2FF9C7D656`
`.reloc`	`0x000ba000`	69,544 bytes	69,632 bytes	6.71 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`A85FDA2741BD9417695DAA5FC5A9D7A5`
`.rsrc`	`0x000cb000`	234,560 bytes	235,008 bytes	7.21 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4CC72AA3CA73F25C6BB35F9CC3F5BFC4`

熵分析警报

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 23 (233,235 字节)

资源类型	数量	总大小	百分比
RT_ICON	6	220,593 字节	94.6%
RT_STRING	11	8,336 字节	3.6%
RT_RCDATA	3	844 字节	0.4%
RT_GROUP_ICON	1	90 字节	0%
RT_VERSION	1	1,412 字节	0.6%
RT_MANIFEST	1	1,960 字节	0.8%

证书链分析

▼

证书 Information

产品	Life is Strange Double Exposure
描述	Installer Life is Strange Double Exposure
文件版本	1.1.102.7899

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	mSetup.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.218.174
数据库版本	2025-06-22 06:00:32 UTC

MSetup.exe (Installer Life is Strange Double Exposure) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别