Aimp 5 11 2435 w64 exe (AIMP Setup) Artem Izmaylov 文件恶意软件分析

Aimp_5.11.2435_w64.exe (AIMP Setup) 文件分析

更新于 1 year ago

检查者 Malware Check

aimp_5.11.2435_w64.exe

哈希类型	值	操作
MD5	e9b882a5f55a041d4512954fb84ea64f
SHA1	d131527edbd57e2384236c369e827129abfd104f
SHA256	c65687d4d5c5f998cbe87a9fbe2bfcbf6ed266a3dbea495900088e687e1b1665
SHA512	5fa50862828cdd7fa26680ed7fb9724a4046f04ef6318e5808c8d732b0bfd6fa642b67963ac1a58adaa37da188f3599e13585a8405cf27d7aaad0d1af2af1fd0
ImpHash	3b3582b7b1135c556f1c69a5cbc9f45f

哈希类型

值

操作

MD5

e9b882a5f55a041d4512954fb84ea64f

SHA1

d131527edbd57e2384236c369e827129abfd104f

SHA256

c65687d4d5c5f998cbe87a9fbe2bfcbf6ed266a3dbea495900088e687e1b1665

SHA512

5fa50862828cdd7fa26680ed7fb9724a4046f04ef6318e5808c8d732b0bfd6fa642b67963ac1a58adaa37da188f3599e13585a8405cf27d7aaad0d1af2af1fd0

ImpHash

3b3582b7b1135c556f1c69a5cbc9f45f

PE 分析

基本信息

▼

图标	哈希: 91537593fafaac77f5d5cc19aedc31b7 模糊: 313cc34a2f53b9e0e6d153d920ee01a1 dHash: f0e8ccd496ecf0b2
映像基址	`0x00400000`
入口点	`0x00810b40`
编译时间	2023-08-20 18:53:03
校验和	0x011f5f73 (实际: 0x011f5f73)
操作系统版本	5.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
数字签名	OK
导入	11 库
导出	3 函数
资源	69 资源
节	10 节

数字签名

▼

GlobalSign GCC R45 CodeSigning CA 2020	IP Izmaylov Artem Andreevich (RU)
GlobalSign Code Signing Root R45	GlobalSign nv-sa (BE)

版本信息

▼

Comments	Made in Russia
CompanyName	Artem Izmaylov
FileDescription	AIMP Setup
FileVersion	5.1.1.2435
LegalCopyright	Artem Izmaylov
ProductName	AIMP
ProductVersion	5.1.1.2435
Translation	0x0419 0x04e3

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	4,330,388 bytes	4,330,496 bytes	5.80 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`CA2F85107B8E4C0975108ADDF8FC197D`
`.data`	`0x00423000`	449,448 bytes	449,536 bytes	5.13 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`46434B0A22489E7095C6BD118E60D198`
`.bss`	`0x00491000`	188,472 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x004c0000`	18,384 bytes	18,432 bytes	4.36 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3AB5070D9FEAF5DFF26C4B6CD72F08F2`
`.didata`	`0x004c5000`	8,968 bytes	9,216 bytes	3.57 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`00B2B65C00C0DEFD9944AF523E9F6911`
`.edata`	`0x004c8000`	156 bytes	512 bytes	1.88 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5009690322417159B4C3BE3A1F5399D7`
`.tls`	`0x004c9000`	632 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x004ca000`	109 bytes	512 bytes	1.39 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`084BC860B4762186E60B8624E8E23C7B`
`.pdata`	`0x004cb000`	225,948 bytes	226,304 bytes	6.38 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`1B743DE7553641170783269A12ED340D`
`.rsrc`	`0x00503000`	13,728,768 bytes	13,728,768 bytes	7.99 (打包/加密)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`64C5622D704CEF16812440FE4550B330`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

资源分析

▼

资源总数: 69 (13,724,486 字节)

资源类型	数量	总大小	百分比
PNG	1	680 字节	0%
RT_CURSOR	16	94,712 字节	0.7%
RT_BITMAP	2	400 字节	0%
RT_ICON	5	34,408 字节	0.3%
RT_STRING	22	16,944 字节	0.1%
RT_RCDATA	10	13,574,684 字节	98.9%
RT_GROUP_CURSOR	10	284 字节	0%
RT_GROUP_ICON	1	76 字节	0%
RT_VERSION	1	632 字节	0%
RT_MANIFEST	1	1,666 字节	0%

证书链分析

▼

证书 #1

主题	IP Izmaylov Artem Andreevich IP Izmaylov Artem Andreevich RU
颁发者	GlobalSign GCC R45 CodeSigning CA 2020
序列号	`4380536419725040226601421263`

证书 #2

主题	GlobalSign GCC R45 CodeSigning CA 2020 GlobalSign nv-sa BE
颁发者	GlobalSign Code Signing Root R45
序列号	`159159759846135372329575655669707113543`

证书验证状态

发表评论

文件名	aimp_5.11.2435_w64.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.140.174
数据库版本	2023-09-30 23:03:17 UTC

Aimp_5.11.2435_w64.exe (AIMP Setup) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别