The NieRAutomata v1 31 ZoG exe (Русификация для «NieR: Automata») Zone of Games File Malware Analysis

The NieRAutomata_v1.31_ ZoG.exe (Русификация для «NieR: Automata») File Analysis

Updated 2 months ago

Checked by Malaware Check

NieRAutomata_v1.31_ ZoG.exe

Hash Type	Value	Action
MD5	a49cd4c1564d1ab244b2323d5d677102
SHA1	bcf37734919c9e44e00722da99afaf173615e534
SHA256	fd14b9f739b0df5fc5833f92b6b77b685ce6562433124141be9683dbef8e14d6
SHA512	aed30cc7ac2877d0ea16413fb5c369bde903227a21a2476b5fecbe003df151c19cd960874b095ac2b51c3ac3049793da8e52a7559aa5195b8daff5dcbc340fa9
ImpHash	5a594319a0d69dbc452e748bcf05892e

Hash Type

Value

Action

MD5

a49cd4c1564d1ab244b2323d5d677102

SHA1

bcf37734919c9e44e00722da99afaf173615e534

SHA256

fd14b9f739b0df5fc5833f92b6b77b685ce6562433124141be9683dbef8e14d6

SHA512

aed30cc7ac2877d0ea16413fb5c369bde903227a21a2476b5fecbe003df151c19cd960874b095ac2b51c3ac3049793da8e52a7559aa5195b8daff5dcbc340fa9

ImpHash

5a594319a0d69dbc452e748bcf05892e

PE Analysis

Basic Information

▼

Icon	Hash: ed5546451e7d4ef333c9e669d3cf0202 Fuzzy: a9022dcac0be4ff002a2304f4e50fecf dHash: 79fd79dbd3e26a1e
Image Base	`0x00400000`
Entry Point	`0x004b5eec`
Compilation Time	2020-11-15 09:48:30
Checksum	0x00000000 (Actual: 0x0215ee03)
OS Version	6.1
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	7 libraries kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
Exports	3 functions
Resources	22 Resources
Sections	10 Sections

Version Information

▼

Comments	This installation was built with Inno Setup.
CompanyName	Zone of Games
FileDescription	Русификация для «NieR: Automata»
FileVersion	1.3.1.12
LegalCopyright	© Zone of Games
OriginalFileName
ProductName	NieR: Automata
ProductVersion	1.3.1.12
Translation	0x0000 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	734,748 bytes	735,232 bytes	6.36 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AD6E46E3A3ACDB533EB6A077F6D065AF`
`.itext`	`0x000b5000`	5,768 bytes	6,144 bytes	5.97 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D40FC822339D01F2ABCC5493AC101C94`
`.data`	`0x000b7000`	14,244 bytes	14,336 bytes	5.04 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4C195D5591F6D61265DF08A3733DE3A2`
`.bss`	`0x000bb000`	28,136 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c2000`	3,894 bytes	4,096 bytes	4.90 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A73D686F1E8B9BB06EC767721135E397`
`.didata`	`0x000c3000`	420 bytes	512 bytes	2.76 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`41B8CE23DD243D14BEEBC71771885C89`
`.edata`	`0x000c4000`	154 bytes	512 bytes	1.87 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`37C1A5C63717831863E018C0F51DABB7`
`.tls`	`0x000c5000`	24 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c6000`	93 bytes	512 bytes	1.38 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8F2F090ACD9622C88A6A852E72F94E96`
`.rsrc`	`0x000c7000`	100,864 bytes	100,864 bytes	6.81 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`BAFABB749FAC810DB865B9C58D2543C4`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 22 (99,590 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	5	87,464 bytes	87.8%
RT_STRING	11	8,040 bytes	8.1%
RT_RCDATA	3	768 bytes	0.8%
RT_GROUP_ICON	1	76 bytes	0.1%
RT_VERSION	1	1,412 bytes	1.4%
RT_MANIFEST	1	1,830 bytes	1.8%

Certificate Chain Analysis

▼

Certificate Information

Product	NieR: Automata
Description	Русификация для «NieR: Automata»
File Version	1.3.1.12
Copyright	© Zone of Games

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	NieRAutomata_v1.31_ ZoG.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.211.174
Database Version	2025-03-24 17:01:09 UTC

The NieRAutomata_v1.31_ ZoG.exe (Русификация для «NieR: Automata») File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification