InstaII exe Stealer Gen 文件恶意软件分析: 98099292ac1b0f59c50e291da7f5d05c

InstaII.exe Stealer Gen 分析

更新于 3 months ago

检查者 Malaware Check

instaII.exe

哈希类型	值	操作
MD5	98099292ac1b0f59c50e291da7f5d05c
SHA1	38fbb9aeb808e9c2a6bd0200160908e2e4e2d0a7
SHA256	3bcf8487cbee03221ff01420d41a3cc70efc76f3c2998b3db3e5caf8da1cc7b7
SHA512	cbf562bd4e49d8c1d3b639f98b038fcff2dd67db5fcbc50db2694e5658f623e3b6b44412a8b3c832d65433356e794808245ab978f1a100ff59045a91b1beefe6
ImpHash	5a594319a0d69dbc452e748bcf05892e

哈希类型

值

操作

MD5

98099292ac1b0f59c50e291da7f5d05c

SHA1

38fbb9aeb808e9c2a6bd0200160908e2e4e2d0a7

SHA256

3bcf8487cbee03221ff01420d41a3cc70efc76f3c2998b3db3e5caf8da1cc7b7

SHA512

cbf562bd4e49d8c1d3b639f98b038fcff2dd67db5fcbc50db2694e5658f623e3b6b44412a8b3c832d65433356e794808245ab978f1a100ff59045a91b1beefe6

ImpHash

5a594319a0d69dbc452e748bcf05892e

PE 分析

基本信息

▼

图标	哈希: 04c7e800fc1f74858f19570a2fe24c2b 模糊: 2ce6c32178eb8500764df0ce62da48ff dHash: e8e2eae6b696c6cc
映像基址	`0x00400000`
入口点	`0x004b5eec`
编译时间	2020-09-13 09:00:51
校验和	0x0126e1c9 (实际: 0x0130e1fa)
操作系统版本	6.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	The expected hash does not match the digest in SpcInfo
导入	7 库 kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
导出	3 函数
资源	21 资源
节	10 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Bitwar Dll Fixer
FileDescription	BitwarDllFixer Setup
FileVersion	2.1.5.0
LegalCopyright	Copyright \xA9 Bitwarsoft Limited All Rights Reserved.
OriginalFileName
ProductName	Bitwar Dll Fixer
ProductVersion	2.1.5.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	734,748 bytes	735,232 bytes	6.36 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AD6E46E3A3ACDB533EB6A077F6D065AF`
`.itext`	`0x000b5000`	5,768 bytes	6,144 bytes	5.97 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D40FC822339D01F2ABCC5493AC101C94`
`.data`	`0x000b7000`	14,244 bytes	14,336 bytes	5.04 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4C195D5591F6D61265DF08A3733DE3A2`
`.bss`	`0x000bb000`	28,136 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c2000`	3,894 bytes	4,096 bytes	4.90 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A73D686F1E8B9BB06EC767721135E397`
`.didata`	`0x000c3000`	420 bytes	512 bytes	2.76 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`41B8CE23DD243D14BEEBC71771885C89`
`.edata`	`0x000c4000`	154 bytes	512 bytes	1.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`37C1A5C63717831863E018C0F51DABB7`
`.tls`	`0x000c5000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c6000`	93 bytes	512 bytes	1.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8F2F090ACD9622C88A6A852E72F94E96`
`.rsrc`	`0x000c7000`	22,212 bytes	22,528 bytes	6.25 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`230F47A2CE4CB91C05DA696599A85262`

资源分析

▼

资源总数: 21 (20,978 字节)

资源类型	数量	总大小	百分比
RT_ICON	4	8,866 字节	42.3%
RT_STRING	11	8,040 字节	38.3%
RT_RCDATA	3	768 字节	3.7%
RT_GROUP_ICON	1	62 字节	0.3%
RT_VERSION	1	1,412 字节	6.7%
RT_MANIFEST	1	1,830 字节	8.7%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

The expected hash does not match the digest in SpcInfo

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	instaII.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.209.174
数据库版本	2025-03-02 01:00:31 UTC

InstaII.exe Stealer Gen 分析

技术分析

Spy.Win32.Gen.tr

扫描另一个文件

文件识别