AGE CHS EXE PUP Patched 文件恶意软件分析: 6e249770a893e7bc97de0d078194e323

AGE_CHS.EXE PUP Patched 分析

更新于 2 days ago

检查者 Malware Check

AGE_CHS.EXE

哈希类型	值	操作
MD5	6e249770a893e7bc97de0d078194e323
SHA1	f1f5814e040f69312d9e8d160fa615683bcf12af
SHA256	a43ce727056da4d1bb26380f16e1f4953ba3125e488fd3d27bb4b6bc7cdd8352
SHA512	a5baacaf747276bc9b74a6a03c3e964bf88ded22e03fa9f9c9559c96a866392ce872b044f88b03194fa795807c81eff96929fb5cdae29d17c0f82f7eaf9bbbfb
ImpHash	274e8773d52d241220ca1af683803c1e

哈希类型

值

操作

MD5

6e249770a893e7bc97de0d078194e323

SHA1

f1f5814e040f69312d9e8d160fa615683bcf12af

SHA256

a43ce727056da4d1bb26380f16e1f4953ba3125e488fd3d27bb4b6bc7cdd8352

SHA512

a5baacaf747276bc9b74a6a03c3e964bf88ded22e03fa9f9c9559c96a866392ce872b044f88b03194fa795807c81eff96929fb5cdae29d17c0f82f7eaf9bbbfb

ImpHash

274e8773d52d241220ca1af683803c1e

PE 分析

基本信息

▼

图标	哈希: db86ee0310a8566fa7f38518adaed9fb 模糊: 3c62a6392d598ee7dd8fb2ac1a927fab dHash: 58506a6870c0f87c
映像基址	`0x00400000`
入口点	`0x0058e561`
编译时间	2021-08-03 10:13:38
校验和	0x004a0789 (实际: 0x003d5d29)
操作系统版本	6.0
PEiD 签名	`MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows, MZ for MS-DOS`
数字签名	No valid SignedData structure was found.
导入	20 库
导出	1 函数
资源	29 资源
节	12 节

版本信息

▼

Comments	ARCGameEngine
CompanyName	ARC Software Laboratory
FileDesCription	ARCGameEngine
FileVersion	4.85S
InternalName	ARCGameEngine
LegalCopyright	Copyright (c) ARC Software Laboratory 1999-2021
OriginalFilename	AGE.EXE
ProductVersion	4.85.19.0
Translation	0x0411 0x03a4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
	`0x00001000`	2,523,136 bytes	2,521,421 bytes	5.83 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`0EE114C1C51EC80D1A4CF356C8BE47BF`
	`0x00269000`	847,872 bytes	835,415 bytes	4.48 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`01FA4C4C8094DF1047C4A53A8D8B405B`
	`0x00338000`	57,344 bytes	35,195 bytes	4.59 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1E30064280BE6EFA41A395785550827F`
	`0x00346000`	16,384 bytes	2,364 bytes	3.27 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F8F93CC6E61FEDCC037A998977A46336`
	`0x0034a000`	4,096 bytes	268 bytes	0.04 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E6BAE569FF7C4CC256D53FB9CEAEB666`
	`0x0034b000`	4,096 bytes	7 bytes	1.66 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4E8E220C285738825E9D7E4459CA86A3`
	`0x0034c000`	4,096 bytes	2,020 bytes	4.53 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1BBCF45C2C0D9D0621754BF479FAA7D7`
`.rsrc`	`0x0034d000`	602,112 bytes	500,329 bytes	5.31 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9AF86652F2654827389B9655DEA70B4C`
	`0x003e0000`	94,208 bytes	80,542 bytes	6.70 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`95D276C027D389C09C27B4D9E3129BA7`
	`0x003f7000`	4,096 bytes	641 bytes	0.92 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1323E34C8A4EA8FFDD65146F831C0A72`
`.SCY`	`0x003f8000`	8,192 bytes	8,015 bytes	5.64 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`78DAE035956501689EC7AD4AB8049944`
`.Silvana`	`0x003fa000`	4,096 bytes	456 bytes	3.25 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7C2E7670559D19EF9E294DBBA78D1E07`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 29 (498,789 字节)

资源类型	数量	总大小	百分比
CSO	11	184,788 字节	37%
RT_ICON	15	311,288 字节	62.4%
RT_GROUP_ICON	1	216 字节	0%
RT_VERSION	1	768 字节	0.2%
RT_MANIFEST	1	1,729 字节	0.3%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	AGE_CHS.EXE
文件类型	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows, MZ for MS-DOS
扫描器版本	1.0.218.174
数据库版本	2025-06-15 01:00:19 UTC

AGE_CHS.EXE PUP Patched 分析

技术分析

PUP.Win32.Patched.cld

扫描另一个文件

文件识别