Norton 360 online setup exe (Norton Self Extract Package) Gen Digital Inc 文件恶意软件分析

Norton_360_online_setup.exe (Norton Self-Extract Package) 文件分析

更新于 8 months ago

检查者 Malware Check

norton_360_online_setup.exe

哈希类型	值	操作
MD5	138a03a7e9d84cb98aee8f704b72d0b7
SHA1	c28506dbb4fd46b00ac2d2e2cd7467bfeba5a644
SHA256	d0fbb495b51769df84e36d1e6bf516188ab31bc39231fc467674286b35aadb3d
SHA512	e1ba63be71d90c22a16db7bc3f8d93884b7427e9053dd906c9a11f97cad0baf450eb25c2d1c74bfabda18b85aa6aaf4b8b26f8daa4e194dc8f7a316a4677df40
ImpHash	de891f2bd0a399a633c6dfb1aa520d9e

哈希类型

值

操作

MD5

138a03a7e9d84cb98aee8f704b72d0b7

SHA1

c28506dbb4fd46b00ac2d2e2cd7467bfeba5a644

SHA256

d0fbb495b51769df84e36d1e6bf516188ab31bc39231fc467674286b35aadb3d

SHA512

e1ba63be71d90c22a16db7bc3f8d93884b7427e9053dd906c9a11f97cad0baf450eb25c2d1c74bfabda18b85aa6aaf4b8b26f8daa4e194dc8f7a316a4677df40

ImpHash

de891f2bd0a399a633c6dfb1aa520d9e

PE 分析

基本信息

▼

图标	哈希: f966dfde7cf40215ce1f8845a71c4123 模糊: ffacbbea78bb6df272b1b5f888a2336d dHash: b24f921b2bb20fb2
映像基址	`0x00400000`
入口点	`0x00466fe0`
编译时间	2025-03-26 12:07:28
校验和	0x001db92a (实际: 0x001db92a)
操作系统版本	6.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB 路径	`C:\BUILD\work\b1fc704878a8d844\BUILDS\Release\x86\icarus_sfx.pdb`
数字签名	OK
导入	11 库
导出	4 函数
资源	15 资源
节	6 节

版本信息

▼

CompanyName	Gen Digital Inc.
FileDescription	Norton Self-Extract Package
FileVersion	25.3.8935.0
InternalName	icarus_sfx
LegalCopyright	Copyright © 2025 Gen Digital Inc. All rights reserved.
MainProductId	norton-suite
OriginalFilename	icarus_sfx.exe
ProductId	norton-icarus
ProductName	Norton Installer
ProductVersion	25.3.9983.1516
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	1,147,354 bytes	1,147,392 bytes	6.60 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`5E98F1D0B43BC064E1E2110DD6E43FD3`
`.rdata`	`0x0011a000`	355,170 bytes	355,328 bytes	5.77 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`54FE37B1767F34E0F66299D1DD7D38B4`
`.data`	`0x00171000`	54,624 bytes	44,544 bytes	4.91 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7E55F6A9223272C0710C41C2B347CF2F`
`.didat`	`0x0017f000`	88 bytes	512 bytes	0.92 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`5226BFE24B00373CBAD1754A6D3DC12D`
`.rsrc`	`0x00180000`	329,512 bytes	329,728 bytes	4.02 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`FB17D27A457CE2B71C70A18682467265`
`.reloc`	`0x001d1000`	55,672 bytes	55,808 bytes	6.65 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`0F621AF0A9E54D1B19A802D31911E66E`

熵分析警报

2 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 15 (328,552 字节)

资源类型	数量	总大小	百分比
COLOR	1	4 字节	0%
GIF	1	6,877 字节	2.1%
LZMA	1	19,483 字节	5.9%
RT_ICON	9	299,021 字节	91%
RT_GROUP_ICON	1	132 字节	0%
RT_VERSION	1	972 字节	0.3%
RT_MANIFEST	1	2,063 字节	0.6%

证书链分析

▼

证书 Information

产品	Norton Installer
描述	Norton Self-Extract Package
文件版本	25.3.8935.0
原始名称	icarus_sfx.exe
签名日期	03:19 PM 04/09/2025 (253 天前)
验证状态	Signed
签名者	NortonLifeLock Inc.; DigiCert Trusted G4 Code Signing RSA4096 SHA256 2021 CA1; DigiCert Trusted Root G4
副签名者	Sectigo Public Time Stamping Signer R35; Sectigo Public Time Stamping CA R36; Sectigo Public Time Stamping Root R46; Sectigo
内部名称	icarus_sfx
版权	Copyright © 2025 Gen Digital Inc. All rights reserved.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

发表评论

文件名	norton_360_online_setup.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.214.174
数据库版本	2025-04-20 23:00:23 UTC

Norton_360_online_setup.exe (Norton Self-Extract Package) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别