NFL1 exe Trojan Sabsik 文件恶意软件分析: abb0f51eb90a5371a08e322a2366f43b

NFL1.exe Trojan Sabsik 分析

更新于 5 days ago

检查者 Malaware Check

NFL1.exe

哈希类型	值	操作
MD5	abb0f51eb90a5371a08e322a2366f43b
SHA1	692712fec4be6c684680e2a6abd395eed0a03943
SHA256	84f6a1e5720f164b0f21686cd611eeaa418ca4162204a1609b4f617a0b9836fe
SHA512	26d87379974f8fc6457282ea43710f7e1f1d3d6f0466696de9b889a757637440c46e5084ad738e7e4c7f05f3806a5ecdf229a646b9d87401a1d6751214b857bd
ImpHash	055e3f3e659a81f413c7fd133a3e7587

哈希类型

值

操作

MD5

abb0f51eb90a5371a08e322a2366f43b

SHA1

692712fec4be6c684680e2a6abd395eed0a03943

SHA256

84f6a1e5720f164b0f21686cd611eeaa418ca4162204a1609b4f617a0b9836fe

SHA512

26d87379974f8fc6457282ea43710f7e1f1d3d6f0466696de9b889a757637440c46e5084ad738e7e4c7f05f3806a5ecdf229a646b9d87401a1d6751214b857bd

ImpHash

055e3f3e659a81f413c7fd133a3e7587

PE 分析

基本信息

▼

图标	哈希: 02278fdf83e7718ee6c2169411ac88f1 模糊: 85078b52934aecd66e760d390e12c0fe dHash: 2c8f272565313332
映像基址	`0x140000000`
入口点	`0x140ef2fc4`
编译时间	2073-04-09 04:49:05
校验和	0x00030869 (实际: 0x00367ffd)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	9 库 kernel32, user32, advapi32, oleaut32, gdi32, shell32, version, ole32, SHLWAPI
导出	0 函数
资源	13 资源
节	10 节

版本信息

▼

CompanyName	Epic Games, Inc.
LegalCopyright	Fill out your copyright notice in the Description page of Project Settings.
ProductName	BootstrapPackagedGame
ProductVersion	UE5-CL-0
FileDescription	BootstrapPackagedGame
InternalName	UnrealEngine
OriginalFilename	BootstrapPackagedGame-Win64-Shipping.exe
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
	`0x00001000`	86,016 bytes	45,056 bytes	7.99 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`75EEDC29DDD7583B5831ECCDD69E1FC4`
	`0x00016000`	49,152 bytes	19,456 bytes	7.97 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`CCBDC61F0053FBF0D8962B2636F6E5C9`
	`0x00022000`	8,192 bytes	512 bytes	6.96 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E53065BFB52702A5DE18981907B0236C`
	`0x00024000`	8,192 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x00026000`	4,096 bytes	512 bytes	4.72 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5CAA09921CBD08B6A5AF688FCD0EE07F`
	`0x00027000`	299,008 bytes	512 bytes	2.41 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`978C2EAF486DCAC88AA8171EEC9F4E08`
	`0x00070000`	4,096 bytes	1,536 bytes	7.14 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`100F7DAAC0D4270388DFBA7696C3AB71`
`.rsrc`	`0x00071000`	299,008 bytes	295,424 bytes	5.07 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5ABD926C21484D95A0EC17780F9CC478`
	`0x000ba000`	12,054,528 bytes	278,528 bytes	8.00 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`55FA6276FC172B0413B88A47B9C3D0C1`
	`0x00c39000`	2,871,296 bytes	2,868,224 bytes	7.96 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A468D4EFAC409DF06D4C06E66C807112`

熵分析警报

4 检测到高熵（≥7.5）的节 - 可能存在打包/加密

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 13 (294,607 字节)

资源类型	数量	总大小	百分比
RT_ICON	7	292,101 字节	99.1%
RT_RCDATA	2	98 字节	0%
RT_GROUP_ICON	2	124 字节	0%
RT_VERSION	1	876 字节	0.3%
RT_MANIFEST	1	1,408 字节	0.5%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	NFL1.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.217.174
数据库版本	2025-06-01 20:00:19 UTC

NFL1.exe Trojan Sabsik 分析

技术分析

Ransom.Win64.Sabsik.sa

扫描另一个文件

文件识别