| 文件名 | ExAltered-0.7.5.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
|
| 扫描器版本 | 1.0.158.174 |
| 数据库版本 | 2024-02-11 02:00:41 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
aca31bb487d532595ebe0276b9e6845e
|
|
| SHA1 |
6f26008d3c8afec4840063cb95ea6f08d01549fb
|
|
| SHA256 |
071417d07e13fba923b30f42d8b9a23931721dccc6e61e16fdb3e50913c58fcd
|
|
| SHA512 |
399709a18e3a59edb2f8b34451ded36b2df231eadbbd6c3a7be198de5c0235504166967d5f81610b40c9f99558aaf6f01c62e392a7b14f8728e7e82b52978885
|
|
| ImpHash |
f8249d26a592433be7af944028ea9c84
|
| 图标 |
哈希: 9e581704d16472bc90f57d0a9cf10908
模糊: 96b251ec3f5a62a487fea920646f422b dHash: 55e8e8ccd4cce815 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x1400013d0 |
| 编译时间 | 1970-01-01 00:00:00 |
| 校验和 | 0x04264ec2 (实际: 0x042510e4) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
|
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 | 21 库 |
| 导出 | 18 函数 |
| 资源 | 9 资源 |
| 节 | 13 节 |
| CompanyName | Wrong Timeline |
| FileDescription | ExAltered |
| FileVersion | 1.0.0.0 |
| ProductName | ExAltered |
| Licence | MIT |
| LegalCopyright | Copyright (c) 2007-2023 Juan Linietsky, Ariel Manzur and contributors |
| Info | https://godotengine.org |
| ProductVersion | 1.0.0.0 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
56,168,408 bytes | 56,168,448 bytes | 6.31 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
A1FEE1D47C5B352F64FF15C0CBF7D66C |
.data |
0x03592000 |
308,032 bytes | 308,224 bytes | 1.80 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
3FF79F5B5F87B856143F25F90FF37C23 |
.rdata |
0x035de000 |
9,895,856 bytes | 9,895,936 bytes | 6.16 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
0770AFC4FE6E8F13F4104181451B84CE |
pck |
0x03f4e000 |
8 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BF619EAC0CDF3F68D496EA9344137E8B |
.pdata |
0x03f4f000 |
1,212,480 bytes | 1,212,928 bytes | 7.09 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F5228975F4396433DC53C33CF69D7B19 |
.xdata |
0x04078000 |
1,536,716 bytes | 1,537,024 bytes | 4.93 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3F44A5737E4BD1B3CC56A31FDC6D2E36 |
.bss |
0x041f0000 |
1,789,120 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.edata |
0x043a5000 |
1,096 bytes | 1,536 bytes | 4.51 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
AB99A77DEC2C296C0707DDB2C2FA2BD8 |
.idata |
0x043a6000 |
20,068 bytes | 20,480 bytes | 4.98 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
4CA0F25C44249DC8576D625B63881B53 |
.CRT |
0x043ab000 |
112 bytes | 512 bytes | 0.50 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
292BEC37B223E7A9B959D436EDE9C5AA |
.tls |
0x043ac000 |
16 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x043ad000 |
45,292 bytes | 45,568 bytes | 7.93 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
933C85C9F7028DBFAD3EE3FB49B314EB |
.reloc |
0x043b9000 |
321,044 bytes | 321,536 bytes | 5.46 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
BC52CE5505D5DD477CC7C27C913858BF |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 6 | 43,770 字节 | |
| RT_GROUP_ICON | 2 | 180 字节 | |
| RT_VERSION | 1 | 780 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
