The f i v e exe (nwjs) The NW js Community File Malware Analysis

The f i v e.exe (nwjs) File Analysis

Updated 2 months ago

Checked by Malaware Check

f i v e.exe

Hash Type	Value	Action
MD5	601f079bf88ac2735766df4bf4ba46d2
SHA1	b812a9d8aa779fff77adfa140004a77084f3b067
SHA256	5a27bb86f5505a701e4301e800d865fff2e2edf0ee3c86c74c6a3488b6d0cda8
SHA512	4c31e288b912531820b9f786b374532c3a2d41545ab83ed697a10a1bd098356c989ec30f143351c0a0936aaf767f7a1b0d045946eafc8bc13ac812d2e3a720fb
ImpHash	094a2fa69ff2589aaed2c2a0eff7c4b8

Hash Type

Value

Action

MD5

601f079bf88ac2735766df4bf4ba46d2

SHA1

b812a9d8aa779fff77adfa140004a77084f3b067

SHA256

5a27bb86f5505a701e4301e800d865fff2e2edf0ee3c86c74c6a3488b6d0cda8

SHA512

4c31e288b912531820b9f786b374532c3a2d41545ab83ed697a10a1bd098356c989ec30f143351c0a0936aaf767f7a1b0d045946eafc8bc13ac812d2e3a720fb

ImpHash

094a2fa69ff2589aaed2c2a0eff7c4b8

PE Analysis

Basic Information

▼

Icon	Hash: 10fb173b89fe88ac9030ae2d207b89c1 Fuzzy: 3b5d3c7d207e37dceeedd301e35e2e58 dHash: 0000000000000000
Image Base	`0x140000000`
Entry Point	`0x140142190`
Compilation Time	2020-10-04 05:00:00
Checksum	0x00209b6a (Actual: 0x00200ada)
OS Version	5.2
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB Path	`nw.exe.pdb`
Digital Signature	No valid SignedData structure was found.
Imports	3 libraries nw_elf, KERNEL32, VERSION
Exports	2 functions
Resources	23 Resources
Sections	12 Sections

Version Information

▼

CompanyName	The NW.js Community
FileDescription	nwjs
FileVersion	0.54.0
InternalName	nw_exe
LegalCopyright	Copyright 2021, The NW.js community and The Chromium Authors. All rights reserved.
OriginalFilename	nw.exe
ProductName	nwjs
ProductVersion	0.54.0
CompanyShortName	nwjs.io
ProductShortName	nwjs
LastChange	62f83a7521ae1f32e563795732dff0c9da1b660d-refs/heads/master@{#812354}
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	1,521,105 bytes	1,521,152 bytes	6.58 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`53C8D295452F1A14134CC94E833D0F5F`
`.rdata`	`0x00175000`	302,908 bytes	303,104 bytes	5.63 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`D33DA385E7BA8429288EA60A40E7CE98`
`.data`	`0x001bf000`	37,936 bytes	15,360 bytes	3.34 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`0AA98ED65A96A2AE925432A037700C86`
`.pdata`	`0x001c9000`	55,596 bytes	55,808 bytes	6.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`5674A5E9164C0EEADDC03D232905FA3C`
`.00cfg`	`0x001d7000`	40 bytes	512 bytes	0.42 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F2BD9CC9431F52E508EDD1FA2F2EDE4C`
`.gehcont`	`0x001d8000`	84 bytes	512 bytes	0.58 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C2361E1CE85543604FC8F6C97C936BE5`
`.retplne`	`0x001d9000`	24 bytes	512 bytes	0.40 (Normal)	`0x00000000`	`2523F52E128493F3A56E9683BDE9244C`
`.tls`	`0x001da000`	305 bytes	512 bytes	0.14 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`9EFA43AF7B1FAAE15FFBD428D0485819`
`CPADinfo`	`0x001db000`	56 bytes	512 bytes	0.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`60D3EA61D541C9BE2E845D2787FB9574`
`_RDATA`	`0x001dc000`	244 bytes	512 bytes	2.44 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`115A0792330DBB0133A4A9CD037D24A7`
`.rsrc`	`0x001dd000`	176,052 bytes	176,128 bytes	4.08 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B42D51013C55EEB1B31D83513AAD23BE`
`.reloc`	`0x00208000`	8,572 bytes	8,704 bytes	5.43 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`62C386B0C21045D71265C374ED2D5209`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 23 (174,639 bytes)

Resource Type	Count	Total Size	Percentage
GOOGLEUPDATEAPPLICATIONCOMMANDS	1	4 bytes	0%
RT_ICON	17	172,239 bytes	98.6%
RT_GROUP_ICON	3	256 bytes	0.1%
RT_VERSION	1	1,072 bytes	0.6%
RT_MANIFEST	1	1,068 bytes	0.6%

Certificate Chain Analysis

▼

Certificate Information

Product	nwjs
Description	nwjs
File Version	0.54.0
Original Name	nw.exe
Internal Name	nw_exe
Copyright	Copyright 2021, The NW.js community and The Chromium Authors. All rights reserved.

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	f i v e.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.212.174
Database Version	2025-04-04 16:00:46 UTC

The f i v e.exe (nwjs) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification