Binkw32 dll (RAD Video Tools) RAD Game Tools, Inc 文件恶意软件分析

Binkw32.dll (RAD Video Tools) 文件分析

更新于 3 months ago

检查者 Malware Check

binkw32.dll

哈希类型	值	操作
MD5	a22b3288322a5a154aaa63cdc67326bf
SHA1	3f4449ac266444e8ec69023ee11f02d82a7468a2
SHA256	1ea5e8075bd12651e51d482fda4f16e9f0382a9cb3a46cd9b2286af98c2e5376
SHA512	a7423a112589c6bb3b33dc06afea68de97ebf4ee9814060a54129053420d658ee7e6a739fc52edd2574befe2f57ece54cb299f2691bd1e236536ca0de01ddaf0
ImpHash	a9dbeed0559439e5d94d85ea22ea38f2

哈希类型

值

操作

MD5

a22b3288322a5a154aaa63cdc67326bf

SHA1

3f4449ac266444e8ec69023ee11f02d82a7468a2

SHA256

1ea5e8075bd12651e51d482fda4f16e9f0382a9cb3a46cd9b2286af98c2e5376

SHA512

a7423a112589c6bb3b33dc06afea68de97ebf4ee9814060a54129053420d658ee7e6a739fc52edd2574befe2f57ece54cb299f2691bd1e236536ca0de01ddaf0

ImpHash

a9dbeed0559439e5d94d85ea22ea38f2

PE 分析

基本信息

▼

图标	哈希: 0a90235094a71d415860145540e74628 模糊: e98a80edc16daf72a41c04b1dd054906 dHash: a442f0f0f071724e
映像基址	`0x10000000`
入口点	`0x100024d0`
编译时间	2011-07-07 22:03:00
校验和	0x00044541 (实际: 0x00044541)
操作系统版本	5.0
PEiD 签名	`PE32 executable (DLL) (GUI) Intel 80386, for MS Windows`
PDB 路径	`C:\devel\projects\bink\build\binkw32.pdb`
数字签名	No valid SignedData structure was found.
导入	5 库 USER32, GDI32, KERNEL32, WINMM, ole32
导出	77 函数
资源	7 资源
节	17 节

版本信息

▼

CompanyName	RAD Game Tools, Inc.
FileDescription	RAD Video Tools
FileVersion	1.99g
LegalCopyright	Copyright (C) 1994-2011, RAD Game Tools, Inc.
LegalTrademarks	Bink and Smacker are trademarks of RAD Game Tools, Inc.
ProductName	Bink and Smacker
ProductVersion	1.99g
Comments	Thank you for using Bink and Smacker!
Translation	0x0409 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	6,298 bytes	6,656 bytes	6.30 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`10EF4C2EC7BD441648BA2F12D2508205`
`BINKY12`	`0x00003000`	432 bytes	512 bytes	5.42 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`F164724ACAAA9F10A5FF9C35C6644704`
`BINKY16`	`0x00004000`	2,268 bytes	2,560 bytes	5.90 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`FA65495FAA5CC9687E1226C8F4BE59AD`
`BINKP8`	`0x00005000`	2,301 bytes	2,560 bytes	6.13 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`7399C32FEF321B54A6FF6ACBE98C03A7`
`BINK16`	`0x00006000`	4,107 bytes	4,608 bytes	6.04 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`C87C501A6ECDF7E4B80494121C7B7840`
`BINK32`	`0x00008000`	4,938 bytes	5,120 bytes	6.34 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`02B2CF0F4DBD65A0BD29D1D2B9591D48`
`BINK`	`0x0000a000`	115,380 bytes	115,712 bytes	6.58 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`F41F82B60656298CFB770EBB5148E8B2`
`RADCODE`	`0x00027000`	2,195 bytes	2,560 bytes	5.63 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`22F270833597B1E307BC075DD7761807`
`BINKBSS`	`0x00028000`	35,520 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00031000`	6,533 bytes	6,656 bytes	5.57 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C5F5B086C0593E34A8B3DE7FEB213871`
`.data`	`0x00033000`	15,104 bytes	15,360 bytes	7.82 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E3D82A09E7ECF6EF1DF313EE367E4657`
`BINKCONS`	`0x00037000`	21,769 bytes	22,016 bytes	6.24 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`381BD310182278A91FD8DE7E6335DBFF`
`BINKDATA`	`0x0003d000`	12,032 bytes	12,288 bytes	6.77 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`989D4B75F4287CC794F044EC2DEBD194`
`RADDATA`	`0x00040000`	52 bytes	512 bytes	0.07 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`649AFC58BAB0A8A660AE1CC34D9DF327`
`RADCONST`	`0x00041000`	159 bytes	512 bytes	2.21 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5E7BD23B0123F1BCC3551B2571DE1FDE`
`.rsrc`	`0x00042000`	8,568 bytes	8,704 bytes	4.74 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`84C01D176CF62C2DB6D6A33FDCD46AC7`
`.reloc`	`0x00045000`	6,748 bytes	7,168 bytes	6.07 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`06AB9A78B79E801F96AAB95C418EEA73`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 7 (8,110 字节)

资源类型	数量	总大小	百分比
RT_ICON	4	7,008 字节	86.4%
RT_STRING	1	132 字节	1.6%
RT_GROUP_ICON	1	62 字节	0.8%
RT_VERSION	1	908 字节	11.2%

证书链分析

▼

证书 Information

产品	Bink and Smacker
描述	RAD Video Tools
文件版本	1.99g
版权	Copyright (C) 1994-2011, RAD Game Tools, Inc.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	binkw32.dll
文件类型	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.226.174
数据库版本	2025-09-27 01:00:20 UTC

Binkw32.dll (RAD Video Tools) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别