TS4 x64 exe Trojan Heuristic 文件恶意软件分析: 88b7a3239a2b17317b5f1615fa38d0c9

TS4_x64.exe Trojan Heuristic 分析

更新于 1 year ago

检查者 Malware Check

TS4_x64.exe

哈希类型	值	操作
MD5	88b7a3239a2b17317b5f1615fa38d0c9
SHA1	cab862a3ba18d9d6a8a451f51fa934127e8e78a2
SHA256	acdf7a13ef3a46763cfe49b60a47ce4e157a3e4e3833653fb6f2ba56ce5871f9
SHA512	032b524afee9757cf9ccff4d55565da9d23bb5ac8d9868a27ba33bca811ff1e5d2d2e403d623a14d02176c71622b2bb983ce98bcd038773e1cb1beac09cd1d78
ImpHash	3a458809e4e5f5f1557a63e3f0ecb45c

哈希类型

值

操作

MD5

88b7a3239a2b17317b5f1615fa38d0c9

SHA1

cab862a3ba18d9d6a8a451f51fa934127e8e78a2

SHA256

acdf7a13ef3a46763cfe49b60a47ce4e157a3e4e3833653fb6f2ba56ce5871f9

SHA512

032b524afee9757cf9ccff4d55565da9d23bb5ac8d9868a27ba33bca811ff1e5d2d2e403d623a14d02176c71622b2bb983ce98bcd038773e1cb1beac09cd1d78

ImpHash

3a458809e4e5f5f1557a63e3f0ecb45c

PE 分析

基本信息

▼

图标	哈希: 63af5380dff92c15b29cae394907c616 模糊: 65c6f11e63f8c5f4894b992099b1d104 dHash: e8cc9696068ecce8
映像基址	`0x140000000`
入口点	`0x1413698ac`
编译时间	2023-07-01 00:35:13
校验和	0x02329cdf (实际: 0x023311bc)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB 路径	`D:\dev\TS4\_compile\Sims4\Releasex64\TS4_x64.pdb`
数字签名	The expected hash does not match the digest in SpcInfo
导入	37 库
导出	6 函数
资源	33 资源
节	8 节

数字签名

▼

DigiCert Trusted Root G4	DigiCert, Inc. (US)
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1	Electronic Arts, Inc. (US)

版本信息

▼

FileVersion	1.99.264.1030
ProductVersion	1.99.264.1030
CompanyName	Electronic Arts Inc.
FileDescription	The Sims™ 4
LegalCopyright	© 2014 Electronic Arts Inc.
OriginalFilename	TS4_x64.exe
ProductName	The Sims™ 4
InternalName	TS4_x64.exe
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	26,655,962 bytes	26,656,256 bytes	6.47 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`4EB3ADFA0024634CC4FA3977C75E3AE0`
`.rdata`	`0x0196d000`	7,726,596 bytes	7,727,104 bytes	5.49 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B7EB62924D74E6B30A4733010D78430B`
`.data`	`0x020cc000`	1,229,588 bytes	666,112 bytes	4.56 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4E05DAE833B45AB7222BF264308ADA9F`
`.pdata`	`0x021f9000`	1,384,656 bytes	1,384,960 bytes	6.84 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`086B6D943268C2FFD70652DC465D1148`
`_RDATA`	`0x0234c000`	9,952 bytes	10,240 bytes	6.50 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`90CAA2A4E820FC374D3C9254B5D24D18`
`.rsrc`	`0x0234f000`	128,936 bytes	129,024 bytes	7.15 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`7618312A18EF21703966DCD2843BCB02`
`.reloc`	`0x0236f000`	268,928 bytes	269,312 bytes	5.47 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`72C2B1FFA910197A9E78186095C5A242`
`.anadius`	`0x023b1000`	1,554 bytes	2,048 bytes	1.90 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`2852C0443EFAE6258C61921E40CED9C7`

熵分析警报

3 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 33 (126,961 字节)

资源类型	数量	总大小	百分比
STR	18	50,759 字节	40%
RT_ICON	12	73,271 字节	57.7%
RT_GROUP_ICON	1	174 字节	0.1%
RT_VERSION	1	752 字节	0.6%
RT_MANIFEST	1	2,005 字节	1.6%

证书链分析

▼

证书 #1

主题	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 DigiCert, Inc. US
颁发者	DigiCert Trusted Root G4
序列号	`11533403529598586876501374841704918745`

证书 #2

主题	Electronic Arts, Inc. Electronic Arts, Inc. US
颁发者	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
序列号	`18371985912253300238230342045091841651`

证书验证状态

The expected hash does not match the digest in SpcInfo

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	TS4_x64.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.146.174
数据库版本	2023-11-04 17:00:44 UTC

TS4_x64.exe Trojan Heuristic 分析

技术分析

Trojan.Heur!.00052033

扫描另一个文件

文件识别