AT Win64 Shipping exe (DRAGONBALLZKAKAROT) BANDAI NAMCO Entertainment Inc 文件恶意软件分析

AT-Win64-Shipping.exe (DRAGONBALLZKAKAROT) 文件分析

更新于 27 days ago

检查者 Malware Check

AT-Win64-Shipping.exe

哈希类型	值	操作
MD5	755b7ae5840c631e3b2bbd3eed8b05b9
SHA1	bce9c2dbaec3c842b3d2b765edf17a2d31b2f587
SHA256	d115f24470771c511c1d18531d6dbb60b8cf1307d00db74370957265c1d5482e
SHA512	5e8ea5d775415d8ee81561889ddc982b3b38ab191b89b93718431eb16231cdc35a1134a6d1d94658cc5a4e6d41431cd30f94a91f552f2c7c7538bbed40366f83
ImpHash	5f95b4891c1f0863d8176f76f92a6756

哈希类型

值

操作

MD5

755b7ae5840c631e3b2bbd3eed8b05b9

SHA1

bce9c2dbaec3c842b3d2b765edf17a2d31b2f587

SHA256

d115f24470771c511c1d18531d6dbb60b8cf1307d00db74370957265c1d5482e

SHA512

5e8ea5d775415d8ee81561889ddc982b3b38ab191b89b93718431eb16231cdc35a1134a6d1d94658cc5a4e6d41431cd30f94a91f552f2c7c7538bbed40366f83

ImpHash

5f95b4891c1f0863d8176f76f92a6756

PE 分析

基本信息

▼

图标	哈希: 06f3ea9f9b07e135cd4ada757fa2c280 模糊: 6806ee4c4c44087b11e85e3c21077a9d dHash: a5270b06d5c364af
映像基址	`0x140000000`
入口点	`0x1436dcfd4`
编译时间	2025-06-05 16:39:49
校验和	0x05ca8849 (实际: 0x05ce3b79)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB 路径	`AT-Win64-Shipping.pdb`
数字签名	No valid SignedData structure was found.
导入	41 库
导出	126 函数
资源	13 资源
节	9 节

版本信息

▼

CompanyName	BANDAI NAMCO Entertainment Inc.
LegalCopyright	Copyright 1998-2018 Epic Games, Inc. All Rights Reserved.
ProductName	DRAGONBALLZKAKAROT
FileDescription	DRAGONBALLZKAKAROT
InternalName	AT
OriginalFilename	AT-Win64-Shipping.exe
Translation	0x0409 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	58,150,503 bytes	58,150,912 bytes	6.53 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`7526114664ED320E84ED66AF8A11E05A`
`.rdata`	`0x03776000`	27,531,088 bytes	27,531,264 bytes	5.20 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9674195F8315D0617CC522D03F053F3A`
`.data`	`0x051b8000`	12,263,928 bytes	5,332,992 bytes	2.64 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`6EB76DD394CD3979E5D2B402B5627EAF`
`.pdata`	`0x05d6b000`	3,485,952 bytes	3,486,208 bytes	7.10 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`688E5B2B15A7DE466C048D579CE24133`
`.rodata`	`0x060bf000`	4,400 bytes	4,608 bytes	5.74 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9C7425D2014ABCB2AB2092B200BE9CCF`
`_RDATA`	`0x060c1000`	40,496 bytes	40,960 bytes	7.21 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3AC8E0852870921D608D16143CB68E7F`
`.rsrc`	`0x060cb000`	315,864 bytes	315,904 bytes	5.61 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`2DAE819F9110C39427CB8BFCC43A6452`
`.reloc`	`0x06119000`	2,275,628 bytes	2,275,840 bytes	5.47 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`C6B768445BE2751549DF9C7BEA9DB1E7`
`.bind`	`0x06345000`	230,416 bytes	230,416 bytes	7.96 (打包/加密)	`IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`0208C81B2EB3241CDBD585026674554A`

熵分析警报

1 检测到高熵（≥7.5）的节 - 可能存在打包/加密

3 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 13 (315,090 字节)

资源类型	数量	总大小	百分比
RT_ICON	7	311,544 字节	98.9%
RT_DIALOG	3	892 字节	0.3%
RT_GROUP_ICON	1	104 字节	0%
RT_VERSION	1	744 字节	0.2%
RT_MANIFEST	1	1,806 字节	0.6%

证书链分析

▼

证书 Information

产品	DRAGONBALLZKAKAROT
描述	DRAGONBALLZKAKAROT
原始名称	AT-Win64-Shipping.exe
内部名称	AT
版权	Copyright 1998-2018 Epic Games, Inc. All Rights Reserved.

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	AT-Win64-Shipping.exe
文件类型	PE32+ executable (GUI) x86-64, for MS Windows
扫描器版本	1.0.231.174
数据库版本	2025-12-14 16:00:28 UTC

AT-Win64-Shipping.exe (DRAGONBALLZKAKAROT) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别