Tlchargement Need for Speed Pro Street Apun KaGames exe exe 文件恶意软件分析

Tlchargement Need for Speed Pro Street Apun KaGames exe.exe 文件分析

更新于 14 days ago

检查者 Malware Check

Tlchargement Need for Speed Pro Street Apun KaGames exe.exe

哈希类型	值	操作
MD5	6a6f051bda6231a048ff893f8e61bda0
SHA1	423fa3dd41e53a0fab5cc9e790aba817ac66a739
SHA256	c0719bf368dbe88f98d28f8eb883cfed4109aa8ded03596bfdab1644872c0c61
SHA512	0374fcd105d3219c838dd3afa8c8c02665e277819ae968896e1bef8ad633a52722b0a5135de1143ca5935ca501d797256a4f044fe8774a760dddd3cefbee0576
ImpHash	ac4ded70f85ef621e5f8917b250855be

哈希类型

值

操作

MD5

6a6f051bda6231a048ff893f8e61bda0

SHA1

423fa3dd41e53a0fab5cc9e790aba817ac66a739

SHA256

c0719bf368dbe88f98d28f8eb883cfed4109aa8ded03596bfdab1644872c0c61

SHA512

0374fcd105d3219c838dd3afa8c8c02665e277819ae968896e1bef8ad633a52722b0a5135de1143ca5935ca501d797256a4f044fe8774a760dddd3cefbee0576

ImpHash

ac4ded70f85ef621e5f8917b250855be

PE 分析

基本信息

▼

图标	哈希: a0ef7c81eee20e999575764306184ccf 模糊: 8341e53a6f1047f3c936b4d36dc8f542 dHash: 5050d274ccec82ae
映像基址	`0x00400000`
入口点	`0x004afe60`
编译时间	2025-11-19 13:11:24
校验和	0x00000000 (实际: 0x001e9321)
操作系统版本	6.1
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	5 库 kernel32, comctl32, user32, oleaut32, advapi32
导出	2 函数
资源	31 资源
节	11 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName
FileDescription	Tlchargement Need for Speed Pro Street Apun KaGames exe.exe
FileVersion	1.0.0.0
LegalCopyright	Tlchargement Need for Speed Pro Street Apun KaGames exe.exe
OriginalFileName
ProductName	Tlchargement Need for Speed Pro Street Apun KaGames exe.exe
ProductVersion	1.0.0.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	710,412 bytes	710,656 bytes	6.39 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`571104EB9C69B8D7EAC91F88E66F07F4`
`.itext`	`0x000af000`	6,128 bytes	6,144 bytes	6.21 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`98E6F67BF19450F022917BCE5EB33E70`
`.data`	`0x000b1000`	16,188 bytes	16,384 bytes	5.18 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5D0CC87460E7A0473A0EC3B57FDC3436`
`.bss`	`0x000b5000`	29,424 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000bd000`	4,136 bytes	4,608 bytes	4.77 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5AD2E4D67B0F9C9E1292015F1327F707`
`.didata`	`0x000bf000`	420 bytes	512 bytes	2.75 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E60D53E513D6FCCE014DF48C1C9CD917`
`.edata`	`0x000c0000`	113 bytes	512 bytes	1.25 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8A91A34B3439AB2B6242A5F7C56D4B82`
`.tls`	`0x000c1000`	24 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c2000`	93 bytes	512 bytes	1.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2F580775CE0C52C49EE681AE82E79E04`
`.reloc`	`0x000c3000`	70,728 bytes	71,168 bytes	6.71 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`BB44BD568D8BA75B9FE5C6225BDF6BBA`
`.rsrc`	`0x000d5000`	70,216 bytes	70,656 bytes	3.77 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`748EF05081051D0C7D680D6182E7D080`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 31 (68,509 字节)

资源类型	数量	总大小	百分比
RT_ICON	13	55,173 字节	80.5%
RT_STRING	12	8,788 字节	12.8%
RT_RCDATA	3	988 字节	1.4%
RT_GROUP_ICON	1	188 字节	0.3%
RT_VERSION	1	1,412 字节	2.1%
RT_MANIFEST	1	1,960 字节	2.9%

证书链分析

▼

无数字签名

此文件未进行数字签名。

安全影响:

无法验证发布者的身份
运行此文件时安全风险增加
可能在某些系统上触发安全警告

⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Tlchargement Need for Speed Pro Street Apun KaGames exe.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-26 14:00:39 UTC

Tlchargement Need for Speed Pro Street Apun KaGames exe.exe 文件分析

技术分析

干净文件

扫描另一个文件

文件识别