PYG64 dll (Baymax Patch Tools x64) 飘云阁论坛官方出品文件恶意软件分析

PYG64.dll (Baymax Patch Tools x64) 文件分析

更新于 7 months ago

检查者 Malware Check

PYG64.dll

哈希类型	值	操作
MD5	793fcccb90c2ada0110ffa0eceb6f790
SHA1	c2410fd142e351c843cf5c34f7401297c87d2fe7
SHA256	8e3fe8247873e1bc81e86ec3bb71e119bd7c0252559ef38a169984616e93f587
SHA512	058abe542939bec25e723577d156d29b92ca9caf6cca19140c6539328aafecdafa2e5cd92b75cc9407af9cd52985ee67097d10588ee1460b6d7f5ed52b924517
ImpHash	bbceac87f8d480082f9cf1b4cca7cd9d

哈希类型

值

操作

MD5

793fcccb90c2ada0110ffa0eceb6f790

SHA1

c2410fd142e351c843cf5c34f7401297c87d2fe7

SHA256

8e3fe8247873e1bc81e86ec3bb71e119bd7c0252559ef38a169984616e93f587

SHA512

058abe542939bec25e723577d156d29b92ca9caf6cca19140c6539328aafecdafa2e5cd92b75cc9407af9cd52985ee67097d10588ee1460b6d7f5ed52b924517

ImpHash

bbceac87f8d480082f9cf1b4cca7cd9d

PE 分析

基本信息

▼

图标	哈希: dc5da33dfaedf1a823c345f3897aaf75 模糊: 18f0cc81bdb2e12a2b3978ebf14e9a20 dHash: 8e071d946841398e
映像基址	`0x180000000`
入口点	`0x1801eb423`
编译时间	2019-04-26 18:41:48
校验和	0x000fde5d (实际: 0x0010445b)
操作系统版本	5.2
PEiD 签名	`PE32+ executable (DLL) (GUI) x86-64, for MS Windows`
PDB 路径	`d:\NsStudio\Tools\Baymax\PatchUi\res\x64\PYG64.pdb`
数字签名	No valid SignedData structure was found.
导入	9 库 KERNEL32, USER32, ADVAPI32, SHELL32, ole32, OLEAUT32, SHLWAPI, VERSION, GDI32
导出	1 函数
资源	7 资源
节	10 节

版本信息

▼

Comments	Www.ChinaPYG.CoM
CompanyName	飘云阁论坛官方出品
FileDescription	Baymax Patch Tools x64
FileVersion	3, 0, 1, 1011
InternalName	PYG64.dll
LegalCopyright	Copyright (C) 2016
OriginalFilename	PYG64.dll
ProductName	PYG64
ProductVersion	3, 0, 1, 1011
Translation	0x0804 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	460,487 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00072000`	125,909 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.data`	`0x00091000`	27,640 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.pdata`	`0x00098000`	24,720 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.Baymax0`	`0x0009f000`	702,056 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.tls`	`0x0014b000`	48 bytes	512 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.Baymax1`	`0x0014c000`	971,172 bytes	971,264 bytes	7.95 (打包/加密)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B00FA3F38A893C900FBCC57F9BD6F6C3`
`.reloc`	`0x0023a000`	108 bytes	512 bytes	1.36 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D8FBE57527CABE799EBD27F4AA726E7E`
`.rsrc`	`0x0023b000`	28,232 bytes	11,776 bytes	5.08 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1607F9FF2E2B921F192104BD3F20506E`
`.BaymaxN`	`0x00242000`	16,384 bytes	16,384 bytes	0.56 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8B892F42AE0E6AB67C135C72F91697D5`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 7 (27,718 字节)

资源类型	数量	总大小	百分比
BAYMAX	1	16,516 字节	59.6%
RT_ICON	1	9,640 字节	34.8%
RT_DIALOG	2	420 字节	1.5%
RT_GROUP_ICON	1	20 字节	0.1%
RT_VERSION	1	776 字节	2.8%
RT_MANIFEST	1	346 字节	1.2%

证书链分析

▼

证书 Information

产品	PYG64
描述	Baymax Patch Tools x64
文件版本	3, 0, 1, 1011
原始名称	PYG64.dll
内部名称	PYG64.dll
版权	Copyright (C) 2016

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	PYG64.dll
文件类型	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
扫描器版本	1.0.215.174
数据库版本	2025-04-27 20:00:20 UTC

PYG64.dll (Baymax Patch Tools x64) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别