| 文件名 | OnlineFix64.dll |
| 文件类型 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.168.174 |
| 数据库版本 | 2024-03-01 21:00:17 UTC |
恶意软件家族: Patcher
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
891d5812ed5120816ddc9b0f5ece5d1a
|
|
| SHA1 |
e531c210c06781b1c73bef512a1707afc2eb6f61
|
|
| SHA256 |
06adedee59ab558d32b09ebe94e2ff05cbe5fdb41c2e7f00c24c552e5a8a0d3e
|
|
| SHA512 |
1053afe17a12a6aa2adb2ae22d6f8c19cdde3b06baba2ec6b97735337c637635c3d7a24e0152c30c83ce65ec0cd081a22d994903ecd584fffaed2dd8dfeda65c
|
|
| ImpHash |
4a3dec248fc3d9b95d52f3733f93bec8
|
| 映像基址 | 0x180000000 |
| 入口点 | 0x1804206a7 |
| 编译时间 | 2021-02-19 11:48:57 |
| 校验和 | 0x00453702 (实际: 0x00453702) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 数字签名 | Chain verification from CN=OnlineFix, OU=OnlineFix, O=OnlineFix, L=OnlineFix, ST=OnlineFix, [email protected], C=CA (serial:361051798580697185074278552919792508455156591697, sha1:50f7d45aae6b69020917aceff35d8bb5d6cabaac) failed: Unable to build a validation path for the certificate "Common Name: OnlineFix, Organizational Unit: OnlineFix, Organization: OnlineFix, Locality: OnlineFix, State/Province: OnlineFix, Email Address: [email protected], Country: CA" - no issuer matching "Common Name: Ascertia Root CA 2, Organization: Ascertia, Country: GB" was found |
| 导入 |
6 库
KERNEL32, USER32, SHELL32, WS2_32, WLDAP32, ADVAPI32 |
| 导出 | 60 函数 |
| 资源 | 1 资源 |
| 节 | 9 节 |
| CompanyName | Online-Fix |
| FileDescription | Online-Fix Steamclient |
| FileVersion | 1.1.1.3 |
| LegalCopyright | Copyright (C) 2021, 0xdeadc0de |
| ProductVersion | 1.1.1.3 |
| Translation | 0x0007 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
1,671,568 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x0019a000 |
522,324 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x0021a000 |
313,760 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.pdata |
0x00267000 |
78,396 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
_RDATA |
0x0027b000 |
148 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.of0 |
0x0027c000 |
1,711,000 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.of1 |
0x0041e000 |
4,515,896 bytes | 4,516,352 bytes | 7.85 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
31880CFF04CF2A96BF6150ECFDF21857 |
.reloc |
0x0086d000 |
208 bytes | 512 bytes | 2.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D60E24B632DDC7A426953080F5D74B08 |
.rsrc |
0x0086e000 |
652 bytes | 1,024 bytes | 2.25 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
2D0C6FA41ABE8211896E3254237740BD |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 564 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
Chain verification from CN=OnlineFix, OU=OnlineFix, O=OnlineFix, L=OnlineFix, ST=OnlineFix, [email protected], C=CA (serial:361051798580697185074278552919792508455156591697, sha1:50f7d45aae6b69020917aceff35d8bb5d6cabaac) failed: Unable to build a validation path for the certificate "Common Name: OnlineFix, Organizational Unit: OnlineFix, Organization: OnlineFix, Locality: OnlineFix, State/Province: OnlineFix, Email Address: [email protected], Country: CA" - no issuer matching "Common Name: Ascertia Root CA 2, Organization: Ascertia, Country: GB" was found
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
