TokenFinder Fivem exe 文件恶意软件分析

TokenFinder Fivem.exe 文件分析

更新于 2 months ago

检查者 Malware Check

TokenFinder Fivem.exe

哈希类型	值	操作
MD5	295ef3e9ba74e13f737476c0b8441b29
SHA1	3ec69b0b338a43b160175e7f00a1238e751bd641
SHA256	5fa94fe30b3cacdb6d02455f7f2fbb0d30a716881fea7e4ed32d99a5dfa0f28b
SHA512	b742ad8fc453521e5bc97ffa76b48568c43a708e0782f4365af6f61c08a7c09f9e257d0bb0692a42a8be240c7be6910b07a9b793c5c5ab53531e5f1d20103896
ImpHash	640213fdd8a3bf6f88ec825e3d6f7c5f

哈希类型

值

操作

MD5

295ef3e9ba74e13f737476c0b8441b29

SHA1

3ec69b0b338a43b160175e7f00a1238e751bd641

SHA256

5fa94fe30b3cacdb6d02455f7f2fbb0d30a716881fea7e4ed32d99a5dfa0f28b

SHA512

b742ad8fc453521e5bc97ffa76b48568c43a708e0782f4365af6f61c08a7c09f9e257d0bb0692a42a8be240c7be6910b07a9b793c5c5ab53531e5f1d20103896

ImpHash

640213fdd8a3bf6f88ec825e3d6f7c5f

PE 分析

基本信息

▼

映像基址	`0x140000000`
入口点	`0x1400014e0`
编译时间	2025-08-22 16:39:57
校验和	0x00454c87 (实际: 0x00454c87)
操作系统版本	4.0
PEiD 签名	`PE32+ executable (console) x86-64, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	2 库 KERNEL32, msvcrt
导出	0 函数
资源	1 资源
节	19 节

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	985,656 bytes	986,112 bytes	6.12 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`62BB644ACE40641983BE567DDF948A7B`
`.data`	`0x000f2000`	13,168 bytes	13,312 bytes	0.71 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`99749BC7716D4B297CF82A75528E988D`
`.rdata`	`0x000f6000`	74,560 bytes	74,752 bytes	4.79 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_32BYTES`	`8DFA3407AE324F51E8966FE25638E072`
`.pdata`	`0x00109000`	74,208 bytes	74,240 bytes	6.09 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`C6F35F8E217B3895AB6F51ED49E48AA9`
`.xdata`	`0x0011c000`	96,688 bytes	96,768 bytes	4.89 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`EB8657691F20DD737B8CDD509E1552D5`
`.bss`	`0x00134000`	4,048 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00135000`	5,624 bytes	5,632 bytes	4.47 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`999F309FCE0BA7B8188D14F53C17F8C4`
`.CRT`	`0x00137000`	112 bytes	512 bytes	0.40 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_8BYTES`	`69E310E9D259AF13A62046197B6CE4D4`
`.tls`	`0x00138000`	16 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_8BYTES`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rsrc`	`0x00139000`	1,256 bytes	1,536 bytes	4.78 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`2C5AA7E3CC9AB12853504C23C3D89E26`
`.reloc`	`0x0013a000`	6,544 bytes	6,656 bytes	5.43 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`3FB0B505F5B9603ED9ADB23979BDF7E7`
`/4`	`0x0013c000`	2,752 bytes	3,072 bytes	1.83 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`051AD7505ACB160B52795085625D4734`
`/19`	`0x0013d000`	122,635 bytes	122,880 bytes	5.98 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`E85EFAD36D5C6D22DF4D5BCB33375403`
`/31`	`0x0015b000`	20,637 bytes	20,992 bytes	4.74 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`7FB8FB8A105D8F6222FCD7CFB738C33E`
`/45`	`0x00161000`	57,841 bytes	57,856 bytes	5.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`63960C5ADAAD68595DE5EC96C4BFC9E5`
`/57`	`0x00170000`	14,368 bytes	14,848 bytes	3.64 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_8BYTES`	`9AD46D40C8872058E6ADBFEF0F20B679`
`/70`	`0x00174000`	3,213 bytes	3,584 bytes	4.74 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`F1B261F3B86BADB9F618827C899827C6`
`/81`	`0x00175000`	157,001 bytes	157,184 bytes	2.78 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`E0FEBB1321A8D7262F21A87D1C1B45A2`
`/92`	`0x0019c000`	9,328 bytes	9,728 bytes	1.81 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_1BYTES`	`4CE58FEF2E8D39B359BB92D13756D6E7`

资源分析

▼

资源总数: 1 (1,167 字节)

资源类型	数量	总大小	百分比
RT_MANIFEST	1	1,167 字节	100%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	TokenFinder Fivem.exe
文件类型	PE32+ executable (console) x86-64, for MS Windows
扫描器版本	1.0.227.174
数据库版本	2025-10-14 13:00:20 UTC

TokenFinder Fivem.exe 文件分析

技术分析

干净文件

扫描另一个文件

文件识别