Sultan's Game exe Trojan Sabsik 文件恶意软件分析: fd2acfc3bf27f5372e064a21307ccccf

Sultan's Game.exe Trojan Sabsik 分析

更新于 28 days ago

检查者 Malaware Check

Sultan's Game.exe

哈希类型	值	操作
MD5	fd2acfc3bf27f5372e064a21307ccccf
SHA1	17f26dbf8e9d8aff54002d525a0f9ddbfbf4925a
SHA256	31f96d081fb70878d753cf25bb81706a33553024f60574bc5a774cf00a7f7561
SHA512	6cb86f1d202abcf720ba1bbaa626e29f7c2e6943ddf136e1c5fb06930fd1d0ab0bb43b1ffd18edebaef668b9dc197ad3de37198535df806219c093cb9aee8556
ImpHash	4bec1f56b28ab6a6614f6734e69744ca

哈希类型

值

操作

MD5

fd2acfc3bf27f5372e064a21307ccccf

SHA1

17f26dbf8e9d8aff54002d525a0f9ddbfbf4925a

SHA256

31f96d081fb70878d753cf25bb81706a33553024f60574bc5a774cf00a7f7561

SHA512

6cb86f1d202abcf720ba1bbaa626e29f7c2e6943ddf136e1c5fb06930fd1d0ab0bb43b1ffd18edebaef668b9dc197ad3de37198535df806219c093cb9aee8556

ImpHash

4bec1f56b28ab6a6614f6734e69744ca

PE 分析

基本信息

▼

图标	哈希: 3c680fb02e0d09c8a60366aba798772d 模糊: e8333c638a04d6301fe29d8b04e82aee dHash: ad9d67c7a3b38364
映像基址	`0x140000000`
入口点	`0x140f763b8`
编译时间	2025-02-05 01:50:43
校验和	0x00000000 (实际: 0x003afb43)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	9 库 kernel32, user32, advapi32, oleaut32, gdi32, shell32, version, ole32, UnityPlayer
导出	2 函数
资源	12 资源
节	10 节

版本信息

▼

FileVersion	2022.3.58.15564654
LegalCopyright	(c) 2005-2025 Unity Technologies. All rights reserved.
ProductVersion	2022.3.58f1 (ed7f6eacb62e)
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
	`0x00001000`	53,248 bytes	30,208 bytes	7.97 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4A4E93ACF5635D25A2D8762832486AA0`
	`0x0000e000`	40,960 bytes	14,848 bytes	7.98 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`892108FA6B3BA657CA6365460F0ECB14`
	`0x00018000`	8,192 bytes	512 bytes	6.65 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B708F5CE7920F970892AC6DFE0CD6D26`
	`0x0001a000`	4,096 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x0001b000`	4,096 bytes	512 bytes	1.59 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D071E5BC4A2E674C2D2D97B6D7C5E63B`
	`0x0001c000`	569,344 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x000a7000`	4,096 bytes	1,536 bytes	7.10 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`596668B5EB7DD0D22F642ADE785EBF8D`
`.rsrc`	`0x000a8000`	569,344 bytes	565,760 bytes	5.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D3A726700C2BA318593131656C379D86`
	`0x00133000`	12,058,624 bytes	285,184 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`33D8BA91499162FA1A416EBC1AEAC8BD`
	`0x00cb3000`	2,908,160 bytes	2,906,624 bytes	7.97 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`C2A0C4BAAE2134B88F125D69B8512A2C`

熵分析警报

4 检测到高熵（≥7.5）的节 - 可能存在打包/加密

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 12 (564,961 字节)

资源类型	数量	总大小	百分比
RT_ICON	9	562,568 字节	99.6%
RT_GROUP_ICON	1	132 字节	0%
RT_VERSION	1	532 字节	0.1%
RT_MANIFEST	1	1,729 字节	0.3%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Sultan's Game.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.216.174
数据库版本	2025-05-10 03:00:24 UTC

Sultan's Game.exe Trojan Sabsik 分析

技术分析

Ransom.Win64.Sabsik.sa

扫描另一个文件

文件识别