HelloNeighbor Win64 Shipping exe (HelloNeighbor) tinyBuild Games 文件恶意软件分析

HelloNeighbor-Win64-Shipping.exe (HelloNeighbor) 文件分析

更新于 26 days ago

检查者 Malware Check

HelloNeighbor-Win64-Shipping.exe

哈希类型	值	操作
MD5	7a70b0dd06b8992e4dd1b3ec42e8eb72
SHA1	614c08005c71e9d7043b5fb0f55c8e127b18ae23
SHA256	aa057bf03b911838528b2f264009ae2484f2fae50072a15f312f72645ccb1ea6
SHA512	13c0976b879c532bf196cc38ee51df41d56a358f1f4b447c0fb5fb0e99c7d6a86d207e7078a98734bedbd376baf68f4940e60e8b2b7a8d9f51944f3c7cdfd49b
ImpHash	08f1d3172a1588b40003d9a0699191ab

哈希类型

值

操作

MD5

7a70b0dd06b8992e4dd1b3ec42e8eb72

SHA1

614c08005c71e9d7043b5fb0f55c8e127b18ae23

SHA256

aa057bf03b911838528b2f264009ae2484f2fae50072a15f312f72645ccb1ea6

SHA512

13c0976b879c532bf196cc38ee51df41d56a358f1f4b447c0fb5fb0e99c7d6a86d207e7078a98734bedbd376baf68f4940e60e8b2b7a8d9f51944f3c7cdfd49b

ImpHash

08f1d3172a1588b40003d9a0699191ab

PE 分析

基本信息

▼

图标	哈希: c23f3ce5420b43f68d6a48c9def6a23e 模糊: 3c0261c000199673f99065af5d9fcbb9 dHash: c1cdccd3d2783fc7
映像基址	`0x140000000`
入口点	`0x141f28aec`
编译时间	2018-12-23 13:35:28
校验和	0x03275bb3 (实际: 0x032be726)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB 路径	`HelloNeighbor-Win64-Shipping.pdb`
数字签名	No valid SignedData structure was found.
导入	43 库
导出	375 函数
资源	13 资源
节	9 节

版本信息

▼

CompanyName	tinyBuild Games
LegalCopyright	Fill out your copyright notice in the Description page of Project Settings.
ProductName	HelloNeighbor
FileDescription	HelloNeighbor
InternalName	HelloNeighbor
OriginalFilename	HelloNeighbor-Win64-Shipping.exe
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	33,228,895 bytes	33,229,312 bytes	6.47 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`B176F5489C7A404D389D5193D5300014`
`.rdata`	`0x01fb2000`	13,969,954 bytes	13,970,432 bytes	5.57 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`496E71B9AC89710EDE899742AFA2EA6A`
`.data`	`0x02d05000`	5,351,152 bytes	2,687,488 bytes	3.06 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E8DB4FEF92F0DBC3B050E47BE5FB4B7E`
`.pdata`	`0x03220000`	2,024,112 bytes	2,024,448 bytes	6.92 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`FD5D87507C589C299FF7BAC72905562E`
`.tls`	`0x0340f000`	29 bytes	512 bytes	0.02 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BA27CBC596DCED9110BDFF8963A62F7E`
`.gfids`	`0x03410000`	56 bytes	512 bytes	0.30 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9C067D61F6C32A1851425272E2734CED`
`_RDATA`	`0x03411000`	40,496 bytes	40,960 bytes	7.21 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`874951945E13B7F805E6A5A5FDB39100`
`.rsrc`	`0x0341b000`	342,368 bytes	342,528 bytes	6.71 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`21D907364B5DFB6743B81D99496CD889`
`.reloc`	`0x0346f000`	866,812 bytes	866,816 bytes	5.47 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`628972B0655D1791D7DE2F666F3A0A9A`

熵分析警报

3 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 13 (341,604 字节)

资源类型	数量	总大小	百分比
RT_ICON	7	338,506 字节	99.1%
RT_DIALOG	3	892 字节	0.3%
RT_GROUP_ICON	1	20 字节	0%
RT_VERSION	1	768 字节	0.2%
RT_MANIFEST	1	1,418 字节	0.4%

证书链分析

▼

证书 Information

产品	HelloNeighbor
描述	HelloNeighbor
原始名称	HelloNeighbor-Win64-Shipping.exe
内部名称	HelloNeighbor
版权	Fill out your copyright notice in the Description page of Project Settings.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	HelloNeighbor-Win64-Shipping.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-16 12:00:28 UTC

HelloNeighbor-Win64-Shipping.exe (HelloNeighbor) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别