Onaylanmamış 189900 crdownload (OpenIV setup) New Technology Studio 文件恶意软件分析

Onaylanmamış 189900.crdownload (OpenIV setup) 文件分析

更新于 3 months ago

检查者 Malware Check

Onaylanmamış 189900.crdownload

哈希类型	值	操作
MD5	1692aec61ddcdda471defa199c62d25a
SHA1	484af221468ddb534b74e12970de80d5dfee2b28
SHA256	84bde632c5bfd2a7ff84e579e6f7561543ca0aad6d8e7275dae5926ba4f561c1
SHA512	19155d0770fc0931ab8ac1bf35f56b32c8c122379adac6866b07cebec28932f92be124638cd7bb9fdaff5edd091f3af0c1fbd0757a99de44e24f11214f13329a
ImpHash	c5d9cedbd18bada78cc05719373aa931

哈希类型

值

操作

MD5

1692aec61ddcdda471defa199c62d25a

SHA1

484af221468ddb534b74e12970de80d5dfee2b28

SHA256

84bde632c5bfd2a7ff84e579e6f7561543ca0aad6d8e7275dae5926ba4f561c1

SHA512

19155d0770fc0931ab8ac1bf35f56b32c8c122379adac6866b07cebec28932f92be124638cd7bb9fdaff5edd091f3af0c1fbd0757a99de44e24f11214f13329a

ImpHash

c5d9cedbd18bada78cc05719373aa931

PE 分析

基本信息

▼

图标	哈希: 2c11e33b8486e36bc7c2dc082e483b13 模糊: e0ecb51a90ad9ed4b96dd9f7a4b69790 dHash: 79d9d9c9d8c8cccc
映像基址	`0x00400000`
入口点	`0x007a03e8`
编译时间	2022-01-10 20:31:28
校验和	0x00000000 (实际: 0x0046bd0b)
操作系统版本	5.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	15 库
导出	3 函数
资源	93 资源
节	11 节

版本信息

▼

CompanyName	New Technology Studio
FileDescription	OpenIV setup
FileVersion	4.1.0.47
InternalName	setup.exe
LegalCopyright	© New Technology Studio
OriginalFilename	ovisetup.exe
ProductName	OpenIV
ProductVersion	4.1.0.0
Translation	0x0419 0x04e3

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	3,787,476 bytes	3,787,776 bytes	6.39 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`A98BDDAE5B9605B18667E1924F6C768C`
`.itext`	`0x0039e000`	10,612 bytes	10,752 bytes	6.32 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`516243725C8EF00D75216ADD225B16A1`
`.data`	`0x003a1000`	68,736 bytes	69,120 bytes	6.08 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`028001162AFFC2FA4B00AD796465D1D0`
`.bss`	`0x003b2000`	622,284 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0044a000`	17,022 bytes	17,408 bytes	5.18 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3554CA981DCC11790756D7D9D72A4AD2`
`.didata`	`0x0044f000`	3,162 bytes	3,584 bytes	3.90 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`52DDAE00583AEE078DC5B0B08BD3B7FA`
`.edata`	`0x00450000`	154 bytes	512 bytes	1.81 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6823FEF9BAE91AE4E5B388753F83A328`
`.tls`	`0x00451000`	76 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00452000`	93 bytes	512 bytes	1.37 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BF779EDE2AD4E66659CC70F6031D4B2F`
`.reloc`	`0x00453000`	339,484 bytes	339,968 bytes	6.71 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`62E5707964C8F2A65566BCC10DC552F4`
`.rsrc`	`0x004a6000`	396,288 bytes	396,288 bytes	5.97 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`83061BFB911EEB35A4069A359861295B`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 93 (390,800 字节)

资源类型	数量	总大小	百分比
UNICODEDATA	6	167,861 字节	43%
RT_CURSOR	7	2,156 字节	0.6%
RT_ICON	7	65,880 字节	16.9%
RT_STRING	49	56,352 字节	14.4%
RT_RCDATA	10	96,170 字节	24.6%
RT_GROUP_CURSOR	7	140 字节	0%
RT_GROUP_ICON	5	128 字节	0%
RT_VERSION	1	720 字节	0.2%
RT_MANIFEST	1	1,393 字节	0.4%

证书链分析

▼

证书 Information

产品	OpenIV
描述	OpenIV setup
文件版本	4.1.0.47
原始名称	ovisetup.exe
内部名称	setup.exe
版权	© New Technology Studio

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Onaylanmamış 189900.crdownload
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.226.174
数据库版本	2025-09-27 16:00:25 UTC

Onaylanmamış 189900.crdownload (OpenIV setup) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别