Setup exe (The Last of Us Part II Setup) Decepticon 文件恶意软件分析

Setup.exe (The Last of Us Part II Setup) 文件分析

更新于 1 month ago

检查者 Malaware Check

Setup.exe

哈希类型	值	操作
MD5	9ff659e150b4111ee6ead6c260d0ceb0
SHA1	12cf3f2a770ebc1b6a4cc0bbaa0d29948ac233b8
SHA256	f10df8f7c30db89b2e6ba95a25ecb7d0a9bc194042cea50da91f1d26829e9df4
SHA512	c5651bea3df2f65234a42ddf2dfb2752fe7add52358f969849edb48f38a017c7e538c3059aa9855905a2bdba095873b3b09477c2ac9a9b2621cad8f32f55e649
ImpHash	884310b1928934402ea6fec1dbd3cf5e

哈希类型

值

操作

MD5

9ff659e150b4111ee6ead6c260d0ceb0

SHA1

12cf3f2a770ebc1b6a4cc0bbaa0d29948ac233b8

SHA256

f10df8f7c30db89b2e6ba95a25ecb7d0a9bc194042cea50da91f1d26829e9df4

SHA512

c5651bea3df2f65234a42ddf2dfb2752fe7add52358f969849edb48f38a017c7e538c3059aa9855905a2bdba095873b3b09477c2ac9a9b2621cad8f32f55e649

ImpHash

884310b1928934402ea6fec1dbd3cf5e

PE 分析

基本信息

▼

图标	哈希: 66ea26ec654d543312d77f0ef2333f94 模糊: 3471b7e04ec2650abe6e0009862eba2f dHash: 24cece1c1c5cdcdc
映像基址	`0x00400000`
入口点	`0x00409c14`
编译时间	1992-06-19 22:22:17
校验和	0x00000000 (实际: 0x0045620a)
操作系统版本	1.0
PEiD 签名	`PE32 executable (GUI) Intel 80386, for MS Windows`
数字签名	No valid SignedData structure was found.
导入	5 库 kernel32, user32, oleaut32, advapi32, comctl32
导出	0 函数
资源	21 资源
节	8 节

版本信息

▼

Comments	This installation was built with Inno Setup.
CompanyName	Decepticon
FileDescription	The Last of Us Part II Setup
FileVersion
LegalCopyright	Decepticon
ProductName	The Last of Us Part II
ProductVersion	v.1.0.10407.0714
Translation	0x0000 0x04b0

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`CODE`	`0x00001000`	37,688 bytes	37,888 bytes	6.56 (压缩)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`0F1E58BEE0E7F7B353DE3DDE9DE0259D`
`DATA`	`0x0000b000`	588 bytes	1,024 bytes	2.75 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`E7DD09E5875D98F57A11BE52CD2304A5`
`BSS`	`0x0000c000`	3,664 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0000d000`	2,384 bytes	2,560 bytes	4.43 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BB5485BF968B970E5EA81292AF2ACDBA`
`.tls`	`0x0000e000`	8 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x0000f000`	24 bytes	512 bytes	0.20 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`9BA824905BF9C7922B6FC87A38B74366`
`.reloc`	`0x00010000`	2,224 bytes	0 bytes	0.00 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`D41D8CD98F00B204E9800998ECF8427E`
`.rsrc`	`0x00011000`	41,036 bytes	41,472 bytes	6.45 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`04F18F0BB33A0F405A32CB56E297A3A7`

熵分析警报

1 检测到较高熵（≥6.5）的节 - 可能存在压缩

资源分析

▼

资源总数: 21 (39,842 字节)

资源类型	数量	总大小	百分比
RT_ICON	11	34,344 字节	86.2%
RT_STRING	6	2,710 字节	6.8%
RT_RCDATA	1	44 字节	0.1%
RT_GROUP_ICON	1	160 字节	0.4%
RT_VERSION	1	1,208 字节	3%
RT_MANIFEST	1	1,376 字节	3.5%

证书链分析

▼

证书 Information

产品	The Last of Us Part II
描述	The Last of Us Part II Setup
版权	Decepticon

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	Setup.exe
文件类型	PE32 executable (GUI) Intel 80386, for MS Windows
扫描器版本	1.0.212.174
数据库版本	2025-04-09 20:01:07 UTC

Setup.exe (The Last of Us Part II Setup) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别