GTATR GTA IV Turkce Yama v2 4 exe (Grand Theft Auto IV Türkçe Yama) GTA TR 文件恶意软件分析

GTATR-GTA-IV-Turkce-Yama-v2.4.exe (Grand Theft Auto IV Türkçe Yama) 文件分析

更新于 3 months ago

检查者 Malware Check

GTATR-GTA-IV-Turkce-Yama-v2.4.exe

哈希类型	值	操作
MD5	b8f17228dc03f54367f12132df0827e5
SHA1	de9fa70bf5292fe2c4829b821634acc69220abd7
SHA256	b186d7717d8c9539e3030b0838c610df5ca493fe4e51b5af9fb7bfee0a01e3dc
SHA512	30c4bcd55400685e00f2f92fa6d0c93d7eebde7a09007a2a265ef219c335ef3d61d4174a2b46daf653d1698c4e992fdce9bcdb05cd2f137d3b91f27ee46fad8a
ImpHash	5a594319a0d69dbc452e748bcf05892e

哈希类型

值

操作

MD5

b8f17228dc03f54367f12132df0827e5

SHA1

de9fa70bf5292fe2c4829b821634acc69220abd7

SHA256

b186d7717d8c9539e3030b0838c610df5ca493fe4e51b5af9fb7bfee0a01e3dc

SHA512

30c4bcd55400685e00f2f92fa6d0c93d7eebde7a09007a2a265ef219c335ef3d61d4174a2b46daf653d1698c4e992fdce9bcdb05cd2f137d3b91f27ee46fad8a

ImpHash

5a594319a0d69dbc452e748bcf05892e

PE 分析

基本信息

▼

图标	哈希: 6d3f1364c4eb3a479b1b816ada6cc2eb 模糊: 5bb1f19dd90419b3eab08890e8cf2d6f dHash: 72d0f8a4cac37a18
映像基址	`0x00400000`
入口点	`0x004b5eec`
编译时间	2020-11-15 09:48:30
校验和	0x00000000 (实际: 0x004cba0f)
操作系统版本	6.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	7 库 kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
导出	3 函数
资源	22 资源
节	10 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	GTA TR
FileDescription	Grand Theft Auto IV Türkçe Yama
FileVersion
LegalCopyright	GTA TR
OriginalFileName
ProductName	Grand Theft Auto IV Türkçe Yama
ProductVersion	2.4
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	734,748 bytes	735,232 bytes	6.36 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AD6E46E3A3ACDB533EB6A077F6D065AF`
`.itext`	`0x000b5000`	5,768 bytes	6,144 bytes	5.97 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D40FC822339D01F2ABCC5493AC101C94`
`.data`	`0x000b7000`	14,244 bytes	14,336 bytes	5.04 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4C195D5591F6D61265DF08A3733DE3A2`
`.bss`	`0x000bb000`	28,136 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c2000`	3,894 bytes	4,096 bytes	4.90 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A73D686F1E8B9BB06EC767721135E397`
`.didata`	`0x000c3000`	420 bytes	512 bytes	2.76 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`41B8CE23DD243D14BEEBC71771885C89`
`.edata`	`0x000c4000`	154 bytes	512 bytes	1.87 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`37C1A5C63717831863E018C0F51DABB7`
`.tls`	`0x000c5000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c6000`	93 bytes	512 bytes	1.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8F2F090ACD9622C88A6A852E72F94E96`
`.rsrc`	`0x000c7000`	94,356 bytes	94,720 bytes	7.36 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`71FC447F676B56B399259D30575B5C29`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 22 (93,080 字节)

资源类型	数量	总大小	百分比
RT_ICON	5	80,954 字节	87%
RT_STRING	11	8,040 字节	8.6%
RT_RCDATA	3	768 字节	0.8%
RT_GROUP_ICON	1	76 字节	0.1%
RT_VERSION	1	1,412 字节	1.5%
RT_MANIFEST	1	1,830 字节	2%

证书链分析

▼

证书 Information

产品	Grand Theft Auto IV Türkçe Yama
描述	Grand Theft Auto IV Türkçe Yama
版权	GTA TR

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	GTATR-GTA-IV-Turkce-Yama-v2.4.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.226.174
数据库版本	2025-09-26 15:00:27 UTC

GTATR-GTA-IV-Turkce-Yama-v2.4.exe (Grand Theft Auto IV Türkçe Yama) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别