File Viewer Plus 4 (File Viewer Plus 4 Setup) Sharpened Productions 文件恶意软件分析

File Viewer Plus 4 (File Viewer Plus 4 Setup) 文件分析

更新于 1 year ago

检查者 Malware Check

uploaded

哈希类型	值	操作
MD5	435da4770f698cf511b066e758a485ec
SHA1	2e3832e17a335b2ea46c5e0da3a37262d5c50ad9
SHA256	97bcee660cc9af807bdde77ba188a76acba1be398ebfdc2686ec3b60d2c9870f
SHA512	53f43c273503d68f57bd7bf778db7b0ff73455c9a47fba8ef60ca70fe6ac8269aae480f46c2161f8da4a4348df4c518c10f48b5eacad22d2e8503fa898f2bc63
ImpHash	20dd26497880c05caed9305b3c8b9109

哈希类型

值

操作

MD5

435da4770f698cf511b066e758a485ec

SHA1

2e3832e17a335b2ea46c5e0da3a37262d5c50ad9

SHA256

97bcee660cc9af807bdde77ba188a76acba1be398ebfdc2686ec3b60d2c9870f

SHA512

53f43c273503d68f57bd7bf778db7b0ff73455c9a47fba8ef60ca70fe6ac8269aae480f46c2161f8da4a4348df4c518c10f48b5eacad22d2e8503fa898f2bc63

ImpHash

20dd26497880c05caed9305b3c8b9109

PE 分析

基本信息

▼

图标	哈希: 02f304b73be345fc7c004ebdc8f92623 模糊: 8162088380eab34a935abbdb70976e5d dHash: 69ccb23333b2cc69
映像基址	`0x00400000`
入口点	`0x0041181c`
编译时间	2018-06-14 13:27:46
校验和	0x0621caec (实际: 0x0621caec)
操作系统版本	5.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	OK
导入	5 库 oleaut32, advapi32, user32, kernel32, comctl32
导出	0 函数
资源	17 资源
节	8 节

数字签名

▼

Microsoft Identity Verification Root Certificate Authority 2020	Microsoft Corporation (US)
Microsoft ID Verified Code Signing PCA 2021	Microsoft Corporation (US)
Microsoft Identity Verification Root Certificate Authority 2020	Microsoft Corporation (US)

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Sharpened Productions
FileDescription	File Viewer Plus 4 Setup
FileVersion	4.3.0.60
LegalCopyright	Copyright 2023 Sharpened Productions
ProductName	File Viewer Plus 4
ProductVersion	4.3.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	62,044 bytes	62,464 bytes	6.38 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`0DA5D73FFBC41792FA65A09058A91476`
`.itext`	`0x00011000`	4,004 bytes	4,096 bytes	5.78 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2EB275566563C3F1D0099A0DA7345B74`
`.data`	`0x00012000`	3,212 bytes	3,584 bytes	2.30 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`73B859E23F5FD17E00C08DB2E0E73DFE`
`.bss`	`0x00013000`	22,204 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00019000`	3,588 bytes	4,096 bytes	4.60 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E9B9C0328FD9628AD4D6AB8283DCB20E`
`.tls`	`0x0001a000`	8 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x0001b000`	24 bytes	512 bytes	0.20 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3DFFC444CCC131C9DCEE18DB49EE6403`
`.rsrc`	`0x0001c000`	70,584 bytes	70,656 bytes	5.08 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E2009F78F4202BFD4ABECB1F078F6FF9`

资源分析

▼

资源总数: 17 (69,530 字节)

资源类型	数量	总大小	百分比
RT_ICON	4	30,044 字节	43.2%
RT_STRING	6	2,668 字节	3.8%
RT_RCDATA	4	33,908 字节	48.8%
RT_GROUP_ICON	1	62 字节	0.1%
RT_VERSION	1	1,268 字节	1.8%
RT_MANIFEST	1	1,580 字节	2.3%

证书链分析

▼

证书 #1

主题	Microsoft Identity Verification Root Certificate Authority 2020 Microsoft Corporation US
颁发者	Microsoft Identity Verification Root Certificate Authority 2020
序列号	`112448656698853914600122667722938025881`

证书 #2

主题	Microsoft ID Verified CS AOC CA 02 Microsoft Corporation US
颁发者	Microsoft ID Verified Code Signing PCA 2021
序列号	`1137338005148879690812298596100550456084791300`

证书 #3

主题	Microsoft ID Verified Code Signing PCA 2021 Microsoft Corporation US
颁发者	Microsoft Identity Verification Root Certificate Authority 2020
序列号	`1137338005164158914005907550236393448033746951`

证书验证状态

发表评论

文件名	uploaded
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.140.174
数据库版本	2023-09-28 18:01:22 UTC

File Viewer Plus 4 (File Viewer Plus 4 Setup) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别