BedroomProducersBlog BPBSaturator v1 0 0 (201210 123409) exe (Bedroom Producers Blog BPB Saturator Setup) Bedroom Producers Blog 文件恶意软件分析

BedroomProducersBlog_BPBSaturator_v1_0_0_(201210-123409).exe (Bedroom Producers Blog BPB Saturator Setup) 文件分析

更新于 1 month ago

检查者 Malaware Check

BedroomProducersBlog_BPBSaturator_v1_0_0_(201210-123409).exe

哈希类型	值	操作
MD5	1d9edcba1554aa949ba3d7cf76e9a039
SHA1	02ba361770315beaaad49c21b7c7b96205d33dd8
SHA256	5b43b39ca6420ac7e5700a8dc6a1700e62e2e956a1206c861039300b0f39e1fb
SHA512	c9c7279298c116b2bcf97a7c7a2aa0ddbcc1f573f02c3adddaa909f040e183cd1fcec4424c5fdfcbc660c3642e8cf97f38d62aa270ed912b1078d81f0d878acc
ImpHash	5a594319a0d69dbc452e748bcf05892e

哈希类型

值

操作

MD5

1d9edcba1554aa949ba3d7cf76e9a039

SHA1

02ba361770315beaaad49c21b7c7b96205d33dd8

SHA256

5b43b39ca6420ac7e5700a8dc6a1700e62e2e956a1206c861039300b0f39e1fb

SHA512

c9c7279298c116b2bcf97a7c7a2aa0ddbcc1f573f02c3adddaa909f040e183cd1fcec4424c5fdfcbc660c3642e8cf97f38d62aa270ed912b1078d81f0d878acc

ImpHash

5a594319a0d69dbc452e748bcf05892e

PE 分析

基本信息

▼

图标	哈希: 6cb9e8daf2258134e733b31aaccf3191 模糊: 338deccadb4ac5a6d7680cf2441fbdee dHash: 304bd6a692da6900
映像基址	`0x00400000`
入口点	`0x004b5eec`
编译时间	2020-05-21 05:56:23
校验和	0x00000000 (实际: 0x00acf44d)
操作系统版本	6.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	7 库 kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
导出	3 函数
资源	23 资源
节	10 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Bedroom Producers Blog
FileDescription	Bedroom Producers Blog BPB Saturator Setup
FileVersion
LegalCopyright
OriginalFileName
ProductName	Bedroom Producers Blog BPB Saturator
ProductVersion	v1.0.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	734,724 bytes	735,232 bytes	6.35 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`364BC619A502D7F0A97ABA31E34B82D2`
`.itext`	`0x000b5000`	5,764 bytes	6,144 bytes	5.97 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`282B489EAC439B258C98EC516C03C2CD`
`.data`	`0x000b7000`	14,244 bytes	14,336 bytes	5.04 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`342785CF6BA6DE905CA393413E77B906`
`.bss`	`0x000bb000`	28,064 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c2000`	3,894 bytes	4,096 bytes	4.90 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A73D686F1E8B9BB06EC767721135E397`
`.didata`	`0x000c3000`	420 bytes	512 bytes	2.76 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`41B8CE23DD243D14BEEBC71771885C89`
`.edata`	`0x000c4000`	154 bytes	512 bytes	1.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`43F8D31E224BBD887C839F21E694B898`
`.tls`	`0x000c5000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c6000`	93 bytes	512 bytes	1.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8F2F090ACD9622C88A6A852E72F94E96`
`.rsrc`	`0x000c7000`	119,768 bytes	119,808 bytes	3.14 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`51420760C6CD96ABE609CD0571919203`

资源分析

▼

资源总数: 23 (118,442 字节)

资源类型	数量	总大小	百分比
RT_ICON	6	106,302 字节	89.8%
RT_STRING	11	8,040 字节	6.8%
RT_RCDATA	3	768 字节	0.6%
RT_GROUP_ICON	1	90 字节	0.1%
RT_VERSION	1	1,412 字节	1.2%
RT_MANIFEST	1	1,830 字节	1.5%

证书链分析

▼

证书 Information

产品	Bedroom Producers Blog BPB Saturator
描述	Bedroom Producers Blog BPB Saturator Setup

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	BedroomProducersBlog_BPBSaturator_v1_0_0_(201210-123409).exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.215.174
数据库版本	2025-05-01 13:00:23 UTC

BedroomProducersBlog_BPBSaturator_v1_0_0_(201210-123409).exe (Bedroom Producers Blog BPB Saturator Setup) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别