Setup exe (Pro Evolution Soccer 2013 Setup) Konami Digital Entertainment Co , Ltd 文件恶意软件分析

Setup.exe (Pro Evolution Soccer 2013 Setup) 文件分析

更新于 1 month ago

检查者 Malware Check

Setup.exe

哈希类型	值	操作
MD5	eae9239b1d38d65e1d94d06b1169137d
SHA1	7ce49774458b2cb1b1aaa09a3e8ffcbc4e747af6
SHA256	e481b8bb70b145663ffb6c647f26107c85a36e0f329f628fe61dc4e9ed49e33c
SHA512	ea144452a56905058fe8bdd0d6088445361042a75ece9810708216b5b302a6dcb6dd06970bfa616ae3924992b12c51051fe07e582780da81c6fcd0308fa3ca11
ImpHash	483f0c4259a9148c34961abbda6146c1

哈希类型

值

操作

MD5

eae9239b1d38d65e1d94d06b1169137d

SHA1

7ce49774458b2cb1b1aaa09a3e8ffcbc4e747af6

SHA256

e481b8bb70b145663ffb6c647f26107c85a36e0f329f628fe61dc4e9ed49e33c

SHA512

ea144452a56905058fe8bdd0d6088445361042a75ece9810708216b5b302a6dcb6dd06970bfa616ae3924992b12c51051fe07e582780da81c6fcd0308fa3ca11

ImpHash

483f0c4259a9148c34961abbda6146c1

PE 分析

基本信息

▼

图标	哈希: d8c2e90790f1e11aa87024ba0dc61731 模糊: b1b39ac3a7e8007008eb25442f0d5eb1 dHash: 579f3c5cb8e85859
映像基址	`0x00400000`
入口点	`0x00416478`
编译时间	2012-07-26 13:09:48
校验和	0x00000000 (实际: 0x0023598b)
操作系统版本	5.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	5 库 oleaut32, advapi32, user32, kernel32, comctl32
导出	0 函数
资源	17 资源
节	8 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Konami Digital Entertainment Co., Ltd.
FileDescription	Pro Evolution Soccer 2013 Setup
FileVersion	1.4.0.0
LegalCopyright	Shegorat,ProFrager,nik1967
ProductName	Pro Evolution Soccer 2013
ProductVersion	1.4.0.0
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	82,936 bytes	82,944 bytes	6.48 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`345DB2B6911ADDC85B53F32245F969A0`
`.itext`	`0x00016000`	3,048 bytes	3,072 bytes	6.02 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`2E74D968CAEDEB2D71B9505530D43907`
`.data`	`0x00017000`	3,484 bytes	3,584 bytes	2.67 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D5B22EFF9E08EDAA95F493C1A71158C0`
`.bss`	`0x00018000`	22,352 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0001e000`	3,998 bytes	4,096 bytes	4.97 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`B47EACA4C149EE829DE76A342B5560D5`
`.tls`	`0x0001f000`	8 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00020000`	24 bytes	512 bytes	0.19 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`3746F5876803F8F30DB5BB2DEB8772AE`
`.rsrc`	`0x00021000`	132,264 bytes	132,608 bytes	7.15 (压缩)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E92E8F784FE7CE99CCCED0178128242E`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 17 (131,207 字节)

资源类型	数量	总大小	百分比
RT_ICON	4	91,357 字节	69.6%
RT_STRING	6	3,200 字节	2.4%
RT_RCDATA	4	34,004 字节	25.9%
RT_GROUP_ICON	1	62 字节	0%
RT_VERSION	1	1,208 字节	0.9%
RT_MANIFEST	1	1,376 字节	1%

证书链分析

▼

证书 Information

产品	Pro Evolution Soccer 2013
描述	Pro Evolution Soccer 2013 Setup
文件版本	1.4.0.0
版权	Shegorat,ProFrager,nik1967

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Setup.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.229.174
数据库版本	2025-11-22 16:00:21 UTC

Setup.exe (Pro Evolution Soccer 2013 Setup) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别