| 文件名 | Xeno.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.226.174 |
| 数据库版本 | 2025-09-28 12:00:26 UTC |
恶意软件家族: XWorm
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
e1a74d224d5465a906fbfed42f4a1a56
|
|
| SHA1 |
17412bf998bb1a24980b40f9b4e34f8b11c1c555
|
|
| SHA256 |
056dcc9d165e307afc640a027a0809c3be1cf53371808c95b1a3ffe94142a28d
|
|
| SHA512 |
c30dc828e4ee79cd7c21d0a53a1f082b0765104002d4b95d286f7117b0247d6cd43897fc785470f1dcb22e86f4280e3fa1e6a0764bcdb5e53ed66d3e3179d2bf
|
|
| ImpHash |
6a91eb82bfd19d2706c7d43c46f7064e
|
| 图标 |
哈希: a555f57d346157adb832b257d0c44628
模糊: e95a9a012cca762fa325e0a4b05fb51d dHash: 00e0c0d10c00a002 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x140011810 |
| 编译时间 | 2025-07-15 07:15:12 |
| 校验和 | 0x00029422 (实际: 0x00029422) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| PDB 路径 | D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb |
| 数字签名 | Chain verification from CN=Rizve A (serial:69584778256418573733429029698563849372, sha1:c32930d30686f298659124b96be5653cceb6d1fb) failed: The X.509 certificate provided is self-signed - "Common Name: Rizve A" |
| 导入 | 12 库 |
| 导出 | 0 函数 |
| 资源 | 4 资源 |
| 节 | 6 节 |
| Translation | 0x0000 0x04b0 |
| Comments | Xeno - Executor UI https://github.com/Riz-ve/Xeno |
| CompanyName | XenoUI |
| FileDescription | XenoUI |
| FileVersion | 1.2.65 |
| InternalName | XenoUI.dll |
| LegalCopyright | Rizve |
| OriginalFilename | XenoUI.dll |
| ProductName | Project Xeno by Rizve |
| ProductVersion | 1.2.65+87ae4f96f8a0927052c1120167982fb069afd1b4 |
| Assembly Version | 1.2.65.0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
89,852 bytes | 90,112 bytes | 6.33 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
49E9F5633A6244B24BD3B46CAF9D2FDB |
.rdata |
0x00017000 |
48,310 bytes | 48,640 bytes | 4.83 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
52F7E56450FEF6F443D67BED7EFBBEC1 |
.data |
0x00023000 |
6,304 bytes | 2,560 bytes | 2.37 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
59EE7BC05694087226B81F72A88AAF1D |
.pdata |
0x00025000 |
5,100 bytes | 5,120 bytes | 5.10 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
0B8F489DCD91A9F252BF6AF0C48BEB36 |
.reloc |
0x00027000 |
816 bytes | 1,024 bytes | 4.78 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
50228D4425809E80768545AABAD4E58E |
.rsrc |
0x00028000 |
6,016 bytes | 6,144 bytes | 2.90 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BC725D9D74CE713DAA8FF06F5599E307 |
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 1 | 4,264 字节 | |
| RT_GROUP_ICON | 1 | 20 字节 | |
| RT_VERSION | 1 | 934 字节 | |
| RT_MANIFEST | 1 | 490 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
Chain verification from CN=Rizve A (serial:69584778256418573733429029698563849372, sha1:c32930d30686f298659124b96be5653cceb6d1fb) failed: The X.509 certificate provided is self-signed - "Common Name: Rizve A"
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
