| 文件名 | WinSpy-x64.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.168.174 |
| 数据库版本 | 2024-03-11 11:00:31 UTC |
恶意软件家族: Agent
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
7ecccf57da8e96c294f75a5ea9a0932f
|
|
| SHA1 |
786fdfb484860d0ffdd867466b2f5c295165094c
|
|
| SHA256 |
13ea79d2acb0b83963f7a1dd968d8e6175d5706501aa6f9ed782827fae026f70
|
|
| SHA512 |
c4cc3904f1a59b6709b8ef94f3229d94532ad5874a837e9e349950bcd2dd08345c9c37a040db879b89653f621aa08cb4999c0db1741ddca650c3d39a11e051df
|
|
| ImpHash |
b6f29f6dcef4cf7c121f3377a4ea0050
|
| 图标 |
哈希: 3e5f1c1d329c1664a0bdea8a6beb2f56
模糊: 7ca9a124ffd5fe3079b00a9387157cf4 dHash: 457a9a9a9a96ba45 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x1400a37a8 |
| 编译时间 | 2016-12-17 07:05:09 |
| 校验和 | 0x00000000 (实际: 0x00121659) |
| 操作系统版本 | 5.2 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 | 13 库 |
| 导出 | 0 函数 |
| 资源 | 17 资源 |
| 节 | 7 节 |
| FileDescription | |
| FileVersion | 1.1.24.04 |
| InternalName | |
| LegalCopyright | |
| OriginalFilename | |
| ProductName | |
| ProductVersion | 1.1.24.04 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
790,204 bytes | 790,528 bytes | 6.53 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
ADEE64EE28C5D2EDCA7C27145235D6BE |
.rdata |
0x000c2000 |
229,352 bytes | 229,376 bytes | 5.13 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
C8B0B50CE2DA6C603665C5F283510A5A |
.data |
0x000fa000 |
48,436 bytes | 14,336 bytes | 3.28 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
ADA89D0F965CEB03A7718EE324D7A142 |
.pdata |
0x00106000 |
28,296 bytes | 28,672 bytes | 5.98 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
48005810C75A9A3924041DAE6FCD37C6 |
.gfids |
0x0010d000 |
236 bytes | 512 bytes | 1.98 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F5E51796D174B45CAB03BE663B7CC771 |
.tls |
0x0010e000 |
9 bytes | 512 bytes | 0.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
1F354D76203061BFDD5A53DAE48D5435 |
.rsrc |
0x0010f000 |
89,812 bytes | 90,112 bytes | 6.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
523CEC04B473DDECC8402426835A65F0 |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 6 | 8,048 字节 | |
| RT_MENU | 1 | 712 字节 | |
| RT_DIALOG | 1 | 232 字节 | |
| RT_ACCELERATOR | 1 | 72 字节 | |
| RT_RCDATA | 1 | 77,906 字节 | |
| RT_GROUP_ICON | 5 | 114 字节 | |
| RT_VERSION | 1 | 508 字节 | |
| RT_MANIFEST | 1 | 1,159 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
