The 登录启动 exe 登陆启动 File Malware Analysis

The 登录启动.exe File Analysis

Updated 1 month ago

Checked by Malaware Check

登录启动.exe

Hash Type	Value	Action
MD5	bb2f6040c79eaaf9e3441cebe3eee727
SHA1	db1a8a36dfa7a43c59937e10819387023dae72b3
SHA256	a879b2fe9fe48679516269ab5fb7d66250a8b2448fc864a606043be36d0147e0
SHA512	5e79459f62031fb875ab010975ef852934fd6e9ef7b9427845d922ca8e955f27b4d645b2e67be8793e92abe9133206569ffeb787e8f6d4715c0935e04f71e5c3
ImpHash	3819d0e725c5d7db08d68f33ce42bc0f

Hash Type

Value

Action

MD5

bb2f6040c79eaaf9e3441cebe3eee727

SHA1

db1a8a36dfa7a43c59937e10819387023dae72b3

SHA256

a879b2fe9fe48679516269ab5fb7d66250a8b2448fc864a606043be36d0147e0

SHA512

5e79459f62031fb875ab010975ef852934fd6e9ef7b9427845d922ca8e955f27b4d645b2e67be8793e92abe9133206569ffeb787e8f6d4715c0935e04f71e5c3

ImpHash

3819d0e725c5d7db08d68f33ce42bc0f

PE Analysis

Basic Information

▼

Icon	Hash: 5be2954607bdaa59a374466bd7008c54 Fuzzy: d6e2da8123493395ef598f62d93ff084 dHash: b1a08e9eca8eccd0
Image Base	`0x140000000`
Entry Point	`0x1410929f4`
Compilation Time	2025-04-09 02:59:42
Checksum	0x00591474 (Actual: 0x008e8bb7)
OS Version	6.0
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
Digital Signature	The expected hash does not match the digest in SpcInfo
Imports	9 libraries kernel32, user32, advapi32, oleaut32, gdi32, shell32, version, ole32, COMCTL32
Exports	0 functions
Resources	4 Resources
Sections	10 Sections

Version Information

▼

CompanyName	登陆启动
FileDescription	登陆启动
FileVersion	1,0,0,0
LegalCopyright	Copyright (C) 2000-2030 7KaMao All Rights Reserved
ProductName	登陆启动
ProductVersion	1,0,0,0
Translation	0x0804 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
	`0x00001000`	176,128 bytes	90,112 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`6C7ABA29A83E5B8887FF54288F6BF33E`
	`0x0002c000`	77,824 bytes	38,400 bytes	7.99 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`85D3C1B432375AEE0C00D3AC577FB446`
	`0x0003f000`	24,576 bytes	512 bytes	7.31 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`1FBCC730B31920BF2FC2220706AA3185`
	`0x00045000`	12,288 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x00048000`	4,096 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x00049000`	73,728 bytes	512 bytes	0.47 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`AB52A5F04FA35A76F474EB12AD9370D0`
	`0x0005b000`	4,096 bytes	1,536 bytes	7.51 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`620104F1223FAB068E1B98F11128577D`
`.rsrc`	`0x0005c000`	73,728 bytes	70,144 bytes	2.51 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`E025BAA8A3B97BAFB312ABB81D0786DE`
	`0x0006e000`	13,639,680 bytes	304,128 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`46CDEE0F4DD55B440C12E88645CC6F51`
	`0x00d70000`	3,305,472 bytes	3,301,888 bytes	7.96 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`2C510029BD6B6F7AEC49EBA11DE24D0B`

Entropy Analysis Alert

5 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 4 (69,548 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	1	67,624 bytes	97.2%
RT_GROUP_ICON	1	20 bytes	0%
RT_VERSION	1	600 bytes	0.9%
RT_MANIFEST	1	1,304 bytes	1.9%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The expected hash does not match the digest in SpcInfo

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	登录启动.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.212.174
Database Version	2025-04-09 10:01:00 UTC

The 登录启动.exe File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification