Setup exe (How to raise happy neet Setup) 文件恶意软件分析

Setup.exe (How to raise happy neet Setup) 文件分析

更新于 23 days ago

检查者 Malaware Check

setup.exe

哈希类型	值	操作
MD5	b16e42c74df783e019e7941db3e21e57
SHA1	a6be0279862041c1bacbda4228e1d9478738211c
SHA256	3ce96c1f71269ad5ae56fc0917bd7422f35d2a88723b967cdcf43e4a3826a02c
SHA512	f55830c3632c18b54d5dc2999ce596d9c4b3b56623a7e20ba1678a0e5b15fdce67d36129836612a76cfce1edade928e16d5320544b987566d7d1755f4e85a4db
ImpHash	483f0c4259a9148c34961abbda6146c1

哈希类型

值

操作

MD5

b16e42c74df783e019e7941db3e21e57

SHA1

a6be0279862041c1bacbda4228e1d9478738211c

SHA256

3ce96c1f71269ad5ae56fc0917bd7422f35d2a88723b967cdcf43e4a3826a02c

SHA512

f55830c3632c18b54d5dc2999ce596d9c4b3b56623a7e20ba1678a0e5b15fdce67d36129836612a76cfce1edade928e16d5320544b987566d7d1755f4e85a4db

ImpHash

483f0c4259a9148c34961abbda6146c1

PE 分析

基本信息

▼

图标	哈希: 200ae0fd5b7e39b241c6ce2d8d07d4d1 模糊: 02b50c95076577964ad98b0f734dbeb7 dHash: aa96d4ccaee4f092
映像基址	`0x00400000`
入口点	`0x00416478`
编译时间	2012-10-02 05:04:04
校验和	0x00000000 (实际: 0x002f071e)
操作系统版本	5.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	5 库 oleaut32, advapi32, user32, kernel32, comctl32
导出	0 函数
资源	21 资源
节	8 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName
FileDescription	How to raise happy neet Setup
FileVersion	2.06
LegalCopyright	CPGRepacks
ProductName	How to raise happy neet
ProductVersion	2.06
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	82,936 bytes	82,944 bytes	6.48 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`345DB2B6911ADDC85B53F32245F969A0`
`.itext`	`0x00016000`	3,048 bytes	3,072 bytes	6.02 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2E74D968CAEDEB2D71B9505530D43907`
`.data`	`0x00017000`	3,484 bytes	3,584 bytes	2.67 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D5B22EFF9E08EDAA95F493C1A71158C0`
`.bss`	`0x00018000`	22,352 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0001e000`	3,998 bytes	4,096 bytes	4.97 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B47EACA4C149EE829DE76A342B5560D5`
`.tls`	`0x0001f000`	8 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00020000`	24 bytes	512 bytes	0.19 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3746F5876803F8F30DB5BB2DEB8772AE`
`.rsrc`	`0x00021000`	202,880 bytes	203,264 bytes	4.83 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`DC144E13BCE092F72397A962DF4BC733`

资源分析

▼

资源总数: 21 (201,634 字节)

资源类型	数量	总大小	百分比
RT_ICON	8	161,728 字节	80.2%
RT_STRING	6	3,200 字节	1.6%
RT_RCDATA	4	34,004 字节	16.9%
RT_GROUP_ICON	1	118 字节	0.1%
RT_VERSION	1	1,208 字节	0.6%
RT_MANIFEST	1	1,376 字节	0.7%

证书链分析

▼

证书 Information

产品	How to raise happy neet
描述	How to raise happy neet Setup
文件版本	2.06
版权	CPGRepacks

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	setup.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.216.174
数据库版本	2025-05-15 02:00:23 UTC

Setup.exe (How to raise happy neet Setup) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别