BLACK AND WHITE 8 professional exe (BLACK & WHITE #8 professional) Accelerated Vision UG 文件恶意软件分析

BLACK AND WHITE 8 professional.exe (BLACK & WHITE #8 professional) 文件分析

更新于 2 months ago

检查者 Malaware Check

BLACK AND WHITE 8 professional.exe

哈希类型	值	操作
MD5	fb18c80bbd547ced85fb6262c577fd97
SHA1	40c72d741c68019f1a7241201758f5589cd49169
SHA256	8d470226c352471b601a09d02e3becde48195e60e7cb41f8331d2d16804352e0
SHA512	c47516dc36710faf0f67a067ba495bafa18ea34175296bd7041e98521f8b119087e002b68cc7e2d1d6efa378ec41fc7fd6c7cae2ab9f5fcdae15c6383d001b44
ImpHash	19d9a19653c3eade4d2ce7dafdda9ec5

哈希类型

值

操作

MD5

fb18c80bbd547ced85fb6262c577fd97

SHA1

40c72d741c68019f1a7241201758f5589cd49169

SHA256

8d470226c352471b601a09d02e3becde48195e60e7cb41f8331d2d16804352e0

SHA512

c47516dc36710faf0f67a067ba495bafa18ea34175296bd7041e98521f8b119087e002b68cc7e2d1d6efa378ec41fc7fd6c7cae2ab9f5fcdae15c6383d001b44

ImpHash

19d9a19653c3eade4d2ce7dafdda9ec5

PE 分析

基本信息

▼

图标	哈希: 01fbe0ff9430f79c3cff89aad3e9c1e6 模糊: e91f3f3917f0a5cf09dc64280eeaad7e dHash: d0b0604040b0b060
映像基址	`0x140000000`
入口点	`0x145a7ba6d`
编译时间	2024-06-20 13:54:45
校验和	0x00f8b043 (实际: 0x00f8b043)
操作系统版本	5.2
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	10 库 FreeImage, ADVAPI32, SHELL32, QtXml4, QtGui4, QtNetwork4, QtCore4, MSVCR90, MSVCP90, KERNEL32
导出	0 函数
资源	16 资源
节	9 节

版本信息

▼

CompanyName	Accelerated Vision UG
FileDescription	BLACK & WHITE #8 professional
FileVersion	8.2.5.0
InternalName	BLACK & WHITE #8 professional
LegalCopyright	© Accelerated Vision UG
LegalTrademarks1	All Rights Reserved
LegalTrademarks2	All Rights Reserved
OriginalFilename	BLACK & WHITE #8 professional.exe
ProductName	BLACK & WHITE #8 professional
ProductVersion	8.25
Translation	0x0407 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	8,071,185 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x007b4000`	12,168,512 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x0134f000`	72,491,816 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.pdata`	`0x05872000`	566,244 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.t,F`	`0x058fd000`	1,353,354 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.L><`	`0x05a48000`	16,480 bytes	16,896 bytes	3.96 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`77C0B2EF951ABC341B01E26CF6CD96D9`
`.T:5`	`0x05a4d000`	15,840,156 bytes	15,840,256 bytes	7.97 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_NOT_PAGED\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`EAD8A24AAAB38748CB5453026424B37B`
`.reloc`	`0x06969000`	156 bytes	512 bytes	1.65 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`EC845F870A403CF7069B5E193B629A50`
`.rsrc`	`0x0696a000`	400,410 bytes	400,896 bytes	7.48 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`DECDC6C218773C7D4D467C309E7EA37E`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 16 (399,470 字节)

资源类型	数量	总大小	百分比
RT_ICON	12	397,388 字节	99.5%
RT_GROUP_ICON	2	180 字节	0%
RT_VERSION	1	1,028 字节	0.3%
RT_MANIFEST	1	874 字节	0.2%

证书链分析

▼

证书 Information

产品	BLACK & WHITE #8 professional
描述	BLACK & WHITE #8 professional
文件版本	8.2.5.0
原始名称	BLACK & WHITE #8 professional.exe
内部名称	BLACK & WHITE #8 professional
版权	© Accelerated Vision UG

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	BLACK AND WHITE 8 professional.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.211.174
数据库版本	2025-03-24 05:01:04 UTC

BLACK AND WHITE 8 professional.exe (BLACK & WHITE #8 professional) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别