1be9b626c1f8b66353717e18a12f77fcce0953e218a45d447d6ae7f0c4c11aa6 exe (Game Configuration C6lr) Digital Gaming Solutions 文件恶意软件分析

1be9b626c1f8b66353717e18a12f77fcce0953e218a45d447d6ae7f0c4c11aa6.exe (Game Configuration C6lr) 文件分析

更新于 6 months ago

检查者 Malware Check

1be9b626c1f8b66353717e18a12f77fcce0953e218a45d447d6ae7f0c4c11aa6.exe

哈希类型	值	操作
MD5	676a64868ea011a2b3f174e31a875bce
SHA1	10797cf9733cb2941e92f4facd0faec9a969f945
SHA256	1be9b626c1f8b66353717e18a12f77fcce0953e218a45d447d6ae7f0c4c11aa6
SHA512	c6cb9ec3c459505b14820be3843059e85c1173b7cee4b43a496b97ab44fed816a1f1c68990162f47a35c6272df0abf706fa5e81421615ea14100ed4129da61c8
ImpHash	adccc51866f03809bfca28b15bc152ce

哈希类型

值

操作

MD5

676a64868ea011a2b3f174e31a875bce

SHA1

10797cf9733cb2941e92f4facd0faec9a969f945

SHA256

1be9b626c1f8b66353717e18a12f77fcce0953e218a45d447d6ae7f0c4c11aa6

SHA512

c6cb9ec3c459505b14820be3843059e85c1173b7cee4b43a496b97ab44fed816a1f1c68990162f47a35c6272df0abf706fa5e81421615ea14100ed4129da61c8

ImpHash

adccc51866f03809bfca28b15bc152ce

PE 分析

基本信息

▼

图标	哈希: cb4a47107f464facb0da3879b7301c6f 模糊: c4b65cfe133b7f38b4cabb2bd4747c5a dHash: 60e0b2aababec000
映像基址	`0x140000000`
入口点	`0x1400013d0`
编译时间	2025-06-08 19:24:27
校验和	0x02b56355 (实际: 0x02b520e0)
操作系统版本	4.0
PEiD 签名	`PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows`
数字签名	The expected hash does not match the digest in SpcInfo
导入	21 库
导出	0 函数
资源	4 资源
节	10 节

版本信息

▼

LegalCopyright	© Digital Gaming Solutions 2025. All rights reserved.
InternalName	managerx86_241.exe
Charset	0409
FileVersion	1.34.0.96
ProductName	Game Configuration C6lr
CompanyName	Digital Gaming Solutions
CodePage	0409
FileFlagsEx	0x00000000
FileFlagsExMask	0x00000000
FileOS	0x00000004
FileSubtype	0x00000000
Type	Application
FileFlags	0x00000000
OriginalFilename	managerx86_241.exe
Language	0409
ProductVersion	1.34.0.96
FileDescription	Game Configuration C6lr
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	14,307,856 bytes	14,308,352 bytes	5.62 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2318F7C593C2086A7BC1304F4FE5DE41`
`.data`	`0x00da7000`	9,744 bytes	10,240 bytes	1.72 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`119D2EAC3530D170AE285357F4D39656`
`.rdata`	`0x00daa000`	29,359,400 bytes	29,359,616 bytes	7.95 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`64082C128FCD9FEB7A6E948AEB7E184B`
`.pdata`	`0x029aa000`	946,596 bytes	946,688 bytes	6.73 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`FB8C71967C478654DE01E95E8BDC7E16`
`.xdata`	`0x02a92000`	665,828 bytes	666,112 bytes	3.08 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`0AECEA4B230ADECD08FE0B4AC1209705`
`.bss`	`0x02b35000`	1,440 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x02b36000`	16,608 bytes	16,896 bytes	4.71 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`ACA94133FA8FA3B1941E27C786B1FD8B`
`.tls`	`0x02b3b000`	16 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x02b3c000`	7,000 bytes	7,168 bytes	4.56 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`ED57DC89EAD6F01211495EC74988F57B`
`.reloc`	`0x02b3e000`	68,712 bytes	69,120 bytes	5.49 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`056AD15C1F29450973C754EAF9C7CAD0`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 4 (6,687 字节)

资源类型	数量	总大小	百分比
RT_ICON	1	4,264 字节	63.8%
RT_GROUP_ICON	1	20 字节	0.3%
RT_VERSION	1	1,296 字节	19.4%
RT_MANIFEST	1	1,107 字节	16.6%

证书链分析

▼

证书 Information

产品	Game Configuration C6lr
描述	Game Configuration C6lr
文件版本	1.34.0.96
原始名称	managerx86_241.exe
验证状态	The digital signature of the object did not verify.
签名者	RIDEV YAZILIM SİSTEMLERİ LTD ŞTİ; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)
内部名称	managerx86_241.exe
版权	© Digital Gaming Solutions 2025. All rights reserved.

证书链摘要

Sectigo Public Code Signing Root R46 #1 主要

有效期: 2021-05-25 00:00:00 → 2028-12-31 23:59:59

签名算法: sha384RSA

序列号: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16

Sectigo Public Code Signing CA EV R36 #2 链

有效期: 2021-03-22 00:00:00 → 2036-03-21 23:59:59

签名算法: sha384RSA

序列号: 33 D7 08 A8 91 40 53 19 E2 A5 BB D3 39 B9 AD 6E

RIDEV YAZILIM SİSTEMLERİ LTD ŞTİ #3 链

有效期: 2023-02-20 00:00:00 → 2026-02-19 23:59:59

签名算法: sha256RSA

序列号: 29 5A F1 11 A9 E1 80 67 5A 33 5D F9 E6 48 53 6E

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

The expected hash does not match the digest in SpcInfo

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	1be9b626c1f8b66353717e18a12f77fcce0953e218a45d447d6ae7f0c4c11aa6.exe
文件类型	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
扫描器版本	1.0.218.174
数据库版本	2025-06-15 12:00:21 UTC

1be9b626c1f8b66353717e18a12f77fcce0953e218a45d447d6ae7f0c4c11aa6.exe (Game Configuration C6lr) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别