Psychopatrolr exe (Godot Engine) Consumer Softproducts Oy 文件恶意软件分析

Psychopatrolr.exe (Godot Engine) 文件分析

更新于 1 month ago

检查者 Malware Check

psychopatrolr.exe

哈希类型	值	操作
MD5	cf98fffbe4441a0b8bef8fe57875b794
SHA1	3eb3cc7858766a9e57224c32bcc3fd97a8f0da99
SHA256	3012c4019c1298daacb02dfb3e397b8a85bd8c207b5b02ba235b49890f7c6b20
SHA512	7f7e02e9c54723b4f52aa4a2bade898b7104ce98ad13187aa364b12009e18f488d08a5d3cd8345cfffb8c2ea123cb2cb15845dd6811ab4a51c81e627f6f33e1c
ImpHash	e9c5a8f2cd85f95728aa345f9790b57e

哈希类型

值

操作

MD5

cf98fffbe4441a0b8bef8fe57875b794

SHA1

3eb3cc7858766a9e57224c32bcc3fd97a8f0da99

SHA256

3012c4019c1298daacb02dfb3e397b8a85bd8c207b5b02ba235b49890f7c6b20

SHA512

7f7e02e9c54723b4f52aa4a2bade898b7104ce98ad13187aa364b12009e18f488d08a5d3cd8345cfffb8c2ea123cb2cb15845dd6811ab4a51c81e627f6f33e1c

ImpHash

e9c5a8f2cd85f95728aa345f9790b57e

PE 分析

基本信息

▼

图标	哈希: 0f52de5830fb026144bed16f0f62a4e4 模糊: f1696e4b6e579390bc5f3540ed8d8c2f dHash: 68e8b2c49496e8f0
映像基址	`0x140000000`
入口点	`0x1400014c0`
编译时间	1970-01-01 00:00:00
校验和	0x0245084b (实际: 0x024502ec)
操作系统版本	4.0
PEiD 签名	`PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows`
数字签名	No valid SignedData structure was found.
导入	18 库
导出	5 函数
资源	8 资源
节	13 节

版本信息

▼

CompanyName	Consumer Softproducts Oy
FileDescription	Godot Engine
FileVersion	3.5.2
ProductName	Psycho Patrol R
Licence	MIT
LegalCopyright	Consumer Softproducts Oy
Info	https://godotengine.org
ProductVersion	3.5.2.stable.official
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	30,836,024 bytes	30,836,224 bytes	6.38 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`26520C47D2989E7A776CEA50FA493660`
`.data`	`0x01d6a000`	25,568 bytes	25,600 bytes	2.43 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8AAD779F01F84C8FB2866F6A2FA701E6`
`.rdata`	`0x01d71000`	3,707,264 bytes	3,707,392 bytes	6.14 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6B552FB6E0A2ED2BF805A32DED7BFEBF`
`pck`	`0x020fb000`	8 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.pdata`	`0x020fc000`	597,264 bytes	597,504 bytes	6.96 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2DB416673E4B1627D5B341AE4E9A8BA5`
`.xdata`	`0x0218e000`	2,356,168 bytes	2,356,224 bytes	5.83 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5083A4F7954688AD205C8AEF61DA33DE`
`.bss`	`0x023ce000`	77,552 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.edata`	`0x023e1000`	209 bytes	512 bytes	2.82 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C949C2FDDC18564DDE71AE0E1F797416`
`.idata`	`0x023e2000`	15,792 bytes	15,872 bytes	4.92 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`EFA0B669E0584F5D8A64B8CB16D70641`
`.CRT`	`0x023e6000`	112 bytes	512 bytes	0.49 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F377C38F477CE1142258A7C5329D9635`
`.tls`	`0x023e7000`	16 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x023e8000`	360,808 bytes	360,960 bytes	2.72 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5EA773AA649C55EE55558B7DB66FAEAF`
`.reloc`	`0x02441000`	169,480 bytes	169,984 bytes	5.47 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`3A6EB5FFA38A08A80A9E624F16D3FC02`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 8 (360,307 字节)

资源类型	数量	总大小	百分比
RT_ICON	6	359,457 字节	99.8%
RT_GROUP_ICON	1	90 字节	0%
RT_VERSION	1	760 字节	0.2%

证书链分析

▼

证书 Information

产品	Psycho Patrol R
描述	Godot Engine
文件版本	3.5.2
版权	Consumer Softproducts Oy

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	psychopatrolr.exe
文件类型	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
扫描器版本	1.0.229.174
数据库版本	2025-11-23 03:00:27 UTC

Psychopatrolr.exe (Godot Engine) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别