The 兵器知识 exe File Malware Analysis

Technical Analysis

File Name	兵器知识.exe
File Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Scanner Version	1.0.211.174
Database Version	2025-03-26 12:01:14 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	4c11b054f084cfe4f5cc11c8f7ff5fe3
SHA1	d61a492667f21801b5109129f92a0dca4ebd2b91
SHA256	70b7e20e183ab80c7c26960ef0c6c264536a888b1a7fb7c2d9eebaaa54cf1214
SHA512	08d00611dc8f767bd8eb7c4e57dff92749b724001ffc34cf50c346f53b82a123f5033f22a95903bdadbd7b3f55d11063b9bbaf401e426b826b75dcce7e0a9e59
ImpHash	c6f1c80c3ecae57c8ca1f72ff0bfa5a9

PE Analysis

Basic Information

▼

Icon	Hash: 47c1efad49c8ba562b2a1d68d9f3ea08 Fuzzy: 761f509310455ea6d1be2e2dca960958 dHash: c884e0e2f171b84a
Image Base	`0x00400000`
Entry Point	`0x00401cbc`
Compilation Time	2018-08-28 10:19:02
Checksum	0x00000000 (Actual: 0x005ea2c6)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	14 libraries
Exports	15786 functions
Resources	329 Resources
Sections	8 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	4,083,712 bytes	4,080,128 bytes	6.55 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`CEDD5F7A1498888D4472FED2CE513036`
`.data`	`0x003e6000`	208,896 bytes	181,248 bytes	6.16 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`3308B0A710FA48B6E8CD6098FB2C5B55`
`.tls`	`0x00419000`	4,096 bytes	512 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BF619EAC0CDF3F68D496EA9344137E8B`
`.rdata`	`0x0041a000`	4,096 bytes	512 bytes	0.20 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`2932D8BA38D783E36B15E99002F2C4A6`
`.idata`	`0x0041b000`	16,384 bytes	15,872 bytes	5.20 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B3FFEA04DFAB4966E8AFAEBA7CB39239`
`.edata`	`0x0041f000`	1,048,576 bytes	1,045,504 bytes	5.84 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`718FFCAC819622733229F27564094981`
`.rsrc`	`0x0051f000`	593,920 bytes	591,360 bytes	6.36 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8C34ABCFC0B30CC92EB7DB0CA3FEA75E`
`.reloc`	`0x005b0000`	225,280 bytes	222,720 bytes	6.64 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`DD4C6F8A6AF5832AE1F3067BE64D136F`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 329 (567,146 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	14	4,312 bytes	0.8%
RT_BITMAP	229	383,866 bytes	67.7%
RT_ICON	1	4,264 bytes	0.8%
RT_DIALOG	1	82 bytes	0%
RT_STRING	56	40,314 bytes	7.1%
RT_RCDATA	13	134,008 bytes	23.6%
RT_GROUP_CURSOR	14	280 bytes	0%
RT_GROUP_ICON	1	20 bytes	0%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The 兵器知识.exe File Analysis