Photo 2025 06 03 13 19 18png scr PUP ChinAd File Malware Analysis: cfbf8daa7a8e620db253acb5e932aa7b

Technical Analysis

File Name	photo_2025-06-03_13-19-18png.scr
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.217.174
Database Version	2025-06-03 10:00:21 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	cfbf8daa7a8e620db253acb5e932aa7b
SHA1	f16fce550061b742f38dedd4c3c86ae302779276
SHA256	4c62ef0a86d28511037ffbbb3dc89f3809fe5b97af732ea8b718147aa61d15e7
SHA512	092f58f6c15d847a896c992c55399c7def7c590003209b8a5e7fd9b6f33f297c8603f0d1ecbeb6501248f5cd93e2177583ed34f98fe62335142a6631282950d7
ImpHash	595a7b4758e23b34aadfde07b3cb0980

PE Analysis

Basic Information

▼

Icon	Hash: 81f5c13507d6e3245b0cd649c979e508 Fuzzy: 69c8e4f0ef4801be008e6dcf877f7a3e dHash: 2f41518505158303
Image Base	`0x00400000`
Entry Point	`0x0040c88f`
Compilation Time	2025-03-27 03:03:02
Checksum	0x0007a637 (Actual: 0x00080f34)
OS Version	6.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
PDB Path	`I:\build\trunk_cn_9.1build\simulator\bin\ldplayerservice.pdb`
Digital Signature	The expected hash does not match the digest in SpcInfo
Imports	4 libraries KERNEL32, ADVAPI32, USERENV, WTSAPI32
Exports	0 functions
Resources	7 Resources
Sections	5 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	150,454 bytes	150,528 bytes	6.68 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`6979F4DB6BDAEDB4D8522F33F9671272`
`.rdata`	`0x00026000`	44,738 bytes	45,056 bytes	4.68 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C9CCB70A00DAE26D62EC8D7FA8CDE808`
`.data`	`0x00031000`	25,132 bytes	7,680 bytes	3.86 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`DB9AE299ACEC84DF44090DF86B93969B`
`.rsrc`	`0x00038000`	232,729 bytes	232,960 bytes	3.78 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B6D1FD11E01FEEA330C0F96319D7BDD4`
`.reloc`	`0x00071000`	8,696 bytes	8,704 bytes	6.60 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`63F5D86E22FA54A548313FE1CA9413B1`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 7 (232,209 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	1	231,304 bytes	99.6%
RT_MENU	1	80 bytes	0%
RT_DIALOG	1	316 bytes	0.1%
RT_STRING	1	92 bytes	0%
RT_ACCELERATOR	1	16 bytes	0%
RT_GROUP_ICON	1	20 bytes	0%
RT_MANIFEST	1	381 bytes	0.2%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Photo_2025-06-03_13-19-18png.scr PUP ChinAd Analysis