NolitaV73 exe (Game Center d0GL) GameTech Systems 文件恶意软件分析

哈希类型	值	操作
MD5	14f0f1ba33d30adcbc487feb2eb0f335
SHA1	b9d06801d4dac217b461d3179689cf1d50e4cb02
SHA256	5dfd79008a16eaffa49e6ad376c97d80586c0e0299dea20fd5bcd0a8b34ab6f5
SHA512	24c0dd2b368e045b7e35e2ad7b55c2b030de9152a5318c6ccb7db06fdefda787f5c0cc6765c23f70c472b7717bd086bef903dea00f9a9ddb53f2efd1e7e2048f
ImpHash	adccc51866f03809bfca28b15bc152ce

基本信息

▼

图标	哈希: cb4a47107f464facb0da3879b7301c6f 模糊: c4b65cfe133b7f38b4cabb2bd4747c5a dHash: 60e0b2aababec000
映像基址	`0x140000000`
入口点	`0x1400013d0`
编译时间	2025-06-09 11:14:12
校验和	0x02b4fc34 (实际: 0x02b4b5bf)
操作系统版本	4.0
PEiD 签名	`PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows`
数字签名	The expected hash does not match the digest in SpcInfo
导入	21 库
导出	0 函数
资源	4 资源
节	10 节

版本信息

▼

InternalName	launcherwin_217.exe
FileSubtype	0x00000000
FileFlags	0x00000000
LegalCopyright	© GameTech Systems 2025. All rights reserved.
ProductName	Game Center d0GL
Type	Application
FileDescription	Game Center d0GL
FileOS	0x00000004
FileVersion	6.75.5.68
FileFlagsExMask	0x00000000
OriginalFilename	launcherwin_217.exe
Language	0409
FileFlagsEx	0x00000000
ProductVersion	6.75.5.68
CodePage	0409
CompanyName	GameTech Systems
Charset	0409
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	14,307,184 bytes	14,307,328 bytes	5.62 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D7F26091AE6FED320B3041E8EC8BC6DB`
`.data`	`0x00da6000`	9,744 bytes	10,240 bytes	1.71 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A8C13851740A836639F9F86B876625C1`
`.rdata`	`0x00da9000`	29,359,400 bytes	29,359,616 bytes	7.95 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B9CF348F543903D17687F491D8AF9D47`
`.pdata`	`0x029a9000`	946,596 bytes	946,688 bytes	6.73 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5003B0296267E341EDED339B93892CA0`
`.xdata`	`0x02a91000`	665,828 bytes	666,112 bytes	3.08 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`15115E6AEF31997CF96702180F553DED`
`.bss`	`0x02b34000`	1,440 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x02b35000`	16,608 bytes	16,896 bytes	4.65 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`12C3BA13A877A7E39C2E82C5367A03B0`
`.tls`	`0x02b3a000`	16 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x02b3b000`	6,944 bytes	7,168 bytes	4.54 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`453AF090E02AE5AEFA3B5227C4FF5402`
`.reloc`	`0x02b3d000`	68,712 bytes	69,120 bytes	5.49 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`E633EACF58AAFA133DAE88255553F765`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 4 (6,631 字节)

资源类型	数量	总大小	百分比
RT_ICON	1	4,264 字节	64.3%
RT_GROUP_ICON	1	20 字节	0.3%
RT_VERSION	1	1,240 字节	18.7%
RT_MANIFEST	1	1,107 字节	16.7%

证书链分析

▼

证书 Information

产品	Game Center d0GL
描述	Game Center d0GL
文件版本	6.75.5.68
原始名称	launcherwin_217.exe
验证状态	The digital signature of the object did not verify.
签名者	RIDEV YAZILIM SİSTEMLERİ LTD ŞTİ; Sectigo Public Code Signing CA EV R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)
内部名称	launcherwin_217.exe
版权	© GameTech Systems 2025. All rights reserved.

证书链摘要

Sectigo Public Code Signing Root R46 #1 主要

有效期: 2021-05-25 00:00:00 → 2028-12-31 23:59:59

签名算法: sha384RSA

序列号: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16

Sectigo Public Code Signing CA EV R36 #2 链

有效期: 2021-03-22 00:00:00 → 2036-03-21 23:59:59

签名算法: sha384RSA

序列号: 33 D7 08 A8 91 40 53 19 E2 A5 BB D3 39 B9 AD 6E

RIDEV YAZILIM SİSTEMLERİ LTD ŞTİ #3 链

有效期: 2023-02-20 00:00:00 → 2026-02-19 23:59:59

签名算法: sha256RSA

序列号: 29 5A F1 11 A9 E1 80 67 5A 33 5D F9 E6 48 53 6E

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

The expected hash does not match the digest in SpcInfo

建议: 验证文件来源并确保它来自可信的发布者.

文件名	NolitaV73.exe
文件类型	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
扫描器版本	1.0.218.174
数据库版本	2025-06-09 23:02:13 UTC

NolitaV73.exe (Game Center d0GL) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别

PE 分析