| 文件名 | LTCG-TPGame.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.220.174 |
| 数据库版本 | 2025-07-14 10:00:21 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
a49abb72c64d6787d5faf4e422662860
|
|
| SHA1 |
5514e626e4f46767d561b23a2a7c0e7c7db463a6
|
|
| SHA256 |
0515ee5b05eddf264c2c97b9049c597ac16b140d4537258caf31b8366f2ffb0b
|
|
| SHA512 |
1ee29c84ef9038ecc014366093ea3bf60bcb0fd42260b9d71d9bb28e8b6973958d79e3bd17b094baf0c101a655571cdfd9a06849a28636f59764ed2862bf74c6
|
|
| ImpHash |
d4349f38d6cdb3a671c0fd0aed75a74a
|
| 图标 |
哈希: 39e197b40e22d8d60987aa9727e0e4fa
模糊: 44a8315976d637a9597259fd85561bbe dHash: cc8ccc8cae1aaaa2 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x02551640 |
| 编译时间 | 2008-02-13 01:21:03 |
| 校验和 | 0x01fcc1af (实际: 0x01fcc1af) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| PDB 路径 | S:\BuildData\Binaries\Lib\ReleaseShippingPC\TPGame.pdb |
| 数字签名 | OK |
| 导入 | 37 库 |
| 导出 | 3 函数 |
| 资源 | 30 资源 |
| 节 | 11 节 |
| CompanyName | Codemasters |
| FileDescription | Turning Point: Fall of Liberty |
| FileVersion | 1.0.0.0 |
| InternalName | LTCG-TPGame |
| LegalCopyright | |
| LegalTrademarks1 | |
| LegalTrademarks2 | |
| OriginalFilename | LTCG-TPGame.exe |
| ProductName | Turning Point: Fall of Liberty |
| ProductVersion | 1.0 |
| Translation | 0x0409 0x04e4 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
20,115,353 bytes | 20,115,456 bytes | 6.95 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D1D75241D1DD9B8CB8AEF9C28519965F |
.textidx |
0x01330000 |
666,048 bytes | 667,648 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
876B8635AA8EC2E4EABC8EC39AB68DD7 |
CONST |
0x013d3000 |
80 bytes | 4,096 bytes | 0.26 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
564C6BF1A67078A5511D3B15F5B9DDF1 |
.rdata |
0x013d4000 |
5,770,540 bytes | 5,771,264 bytes | 5.46 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
EA32851567936F78DF69CFA48E57F40C |
.data |
0x01955000 |
1,866,712 bytes | 393,216 bytes | 5.99 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
88BD33C595DFC4EC65EA72EF26BAC6E9 |
.rsrc |
0x01b1d000 |
274,172 bytes | 274,432 bytes | 6.83 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
FC70CDD910E238B0B1688F1DF3AA5728 |
ars |
0x01b60000 |
6,214,640 bytes | 3,248,128 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
7D4E53BEEFB3024A3DFE482B2E1E0726 |
est |
0x0214e000 |
29,008 bytes | 32,768 bytes | 6.23 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
3AC7C98528C7907C149263E72040347A |
artem |
0x02156000 |
3,474,144 bytes | 1,032,192 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
4BA24C3AB94EB178632652882EFFACD8 |
celare |
0x024a7000 |
21,432 bytes | 24,576 bytes | 5.63 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
A962B1AE8A49E68E22142FACE7D7D794 |
.securom |
0x024ad000 |
1,748,529 bytes | 1,748,992 bytes | 6.23 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
993CA2306EBBB7D41C8E3535F827786A |
3 检测到高熵（≥7.5）的节 - 可能存在打包/加密
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_CURSOR | 4 | 1,232 字节 | |
| RT_BITMAP | 1 | 108 字节 | |
| RT_ICON | 15 | 268,256 字节 | |
| RT_DIALOG | 2 | 644 字节 | |
| RT_GROUP_CURSOR | 4 | 80 字节 | |
| RT_GROUP_ICON | 2 | 222 字节 | |
| RT_VERSION | 1 | 812 字节 | |
| RT_MANIFEST | 1 | 1,094 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
OK
按照以下步骤完全从系统中移除威胁
