Setup exe (WinGup for Notepad++) Don HO don h@free fr 文件恶意软件分析

Setup.exe (WinGup for Notepad++) 文件分析

更新于 23 days ago

检查者 Malware Check

setup.exe

哈希类型	值	操作
MD5	6c981d1b531bdfda9d7b227a886298fd
SHA1	63d0d13c30ce70755fd540456b61bbe8aca00df8
SHA256	5eb90daf1cad88ad33bceed04b0d01cb5aaf3883f991516ffc9e4b99a1c413de
SHA512	80d19922a9bfe92403f67ce647619609ad9c626ee4119e82bc7cabd768a42f59cf9405af4ee2e4d0520e8a6cd38879d265517ffbffaac463f7f9f701e671c6a4
ImpHash	438ba41dbcad9fa8b1400deab6a46b84

哈希类型

值

操作

MD5

6c981d1b531bdfda9d7b227a886298fd

SHA1

63d0d13c30ce70755fd540456b61bbe8aca00df8

SHA256

5eb90daf1cad88ad33bceed04b0d01cb5aaf3883f991516ffc9e4b99a1c413de

SHA512

80d19922a9bfe92403f67ce647619609ad9c626ee4119e82bc7cabd768a42f59cf9405af4ee2e4d0520e8a6cd38879d265517ffbffaac463f7f9f701e671c6a4

ImpHash

438ba41dbcad9fa8b1400deab6a46b84

PE 分析

基本信息

▼

映像基址	`0x140000000`
入口点	`0x14003f680`
编译时间	2025-08-04 23:30:54
校验和	0x000cfde6 (实际: 0x000cfde6)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
数字签名	Chain verification from [email protected], CN=Notepad\+\+, O=Notepad\+\+, L=Saint Cloud, ST=Ile-de-France, C=FR (serial:75519183144878202311272173362237260241, sha1:7f517e235584afc146f6d3b44cd34c6cc36a3ab2) failed: Unable to build a validation path for the certificate "Email Address: [email protected], Common Name: Notepad++, Organization: Notepad++, Locality: Saint Cloud, State/Province: Ile-de-France, Country: FR" - no issuer matching "Email Address: [email protected], Common Name: Notepad++ Root Certificate, Organization: Notepad++, Locality: Saint Cloud, State/Province: Ile-de-France, Country: FR" was found
导入	7 库 libcurl, COMCTL32, SHLWAPI, KERNEL32, USER32, GDI32, SHELL32
导出	0 函数
资源	6 资源
节	7 节

版本信息

▼

Translation	0x0409 0x04b0
CompanyName	Don HO [email protected]
FileDescription	WinGup for Notepad++
FileVersion	5.33
InternalName	gup.exe
LegalCopyright	Copyright 2018 by Don HO
OriginalFilename	gup.exe
ProductName	WinGup for Notepad++
ProductVersion	5.33

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	595,040 bytes	595,456 bytes	6.47 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AAD2BCB0AF02A33C99FB3209105B3A32`
`.rdata`	`0x00093000`	150,898 bytes	151,040 bytes	5.27 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F76824637217ED61F9A744DD77B423AC`
`.data`	`0x000b8000`	20,716 bytes	13,824 bytes	3.94 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`FDD37B322B424CAA93C18D99FCC82F01`
`.pdata`	`0x000be000`	23,664 bytes	24,064 bytes	5.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8FABFFD75B56B9E53CB23053EA0B4E98`
`.fptable`	`0x000c4000`	256 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x000c5000`	3,816 bytes	4,096 bytes	4.17 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3EF880B989EDDB09848986B626F9B7FD`
`.reloc`	`0x000c6000`	4,640 bytes	5,120 bytes	5.28 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`6F40CBC801C9357423D0BD2A1DB53D73`

资源分析

▼

资源总数: 6 (3,409 字节)

资源类型	数量	总大小	百分比
RT_DIALOG	4	1,480 字节	43.4%
RT_VERSION	1	738 字节	21.6%
RT_MANIFEST	1	1,191 字节	34.9%

证书链分析

▼

证书 Information

产品	WinGup for Notepad++
描述	WinGup for Notepad++
文件版本	5.33
原始名称	gup.exe
验证状态	A certificate chain could not be built to a trusted root authority.
内部名称	gup.exe
版权	Copyright 2018 by Don HO

证书链摘要

Notepad++ #1 主要

有效期: 2025-07-08 23:01:00 → 2028-07-08 23:01:00

签名算法: sha512RSA

序列号: 38 D0 77 32 D5 E4 A2 62 8A 30 3D 47 90 35 C1 D1

Microsoft Public RSA Timestamping CA 2020 #2 链

有效期: 2020-11-19 20:32:31 → 2035-11-19 20:42:31

签名算法: sha384RSA

序列号: 33 00 00 00 05 E5 CF 0F FF 66 2E C9 87 00 00 00 00 00 05

Microsoft Public RSA Time Stamping Authority #3 链

有效期: 2025-02-27 19:40:27 → 2026-02-26 19:40:27

签名算法: sha384RSA

序列号: 33 00 00 00 54 3F F2 00 3E BE A1 D8 A6 00 00 00 00 00 54

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

Chain verification from [email protected], CN=Notepad\+\+, O=Notepad\+\+, L=Saint Cloud, ST=Ile-de-France, C=FR (serial:75519183144878202311272173362237260241, sha1:7f517e235584afc146f6d3b44cd34c6cc36a3ab2) failed: Unable to build a validation path for the certificate "Email Address: [email protected], Common Name: Notepad++, Organization: Notepad++, Locality: Saint Cloud, State/Province: Ile-de-France, Country: FR" - no issuer matching "Email Address: [email protected], Common Name: Notepad++ Root Certificate, Organization: Notepad++, Locality: Saint Cloud, State/Province: Ile-de-France, Country: FR" was found

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	setup.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-17 09:00:35 UTC

Setup.exe (WinGup for Notepad++) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别