| 文件名 | 𝗦𝗲𝘁𝘂𝗽.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.210.174 |
| 数据库版本 | 2025-03-15 03:01:05 UTC |
恶意软件家族: Gen
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
10f001cb65295e6a4bb8771ff181b41c
|
|
| SHA1 |
c55ff1bbd683348e396147b6b91ef2d31efbd500
|
|
| SHA256 |
1ccf1b85bd7f94d187e3f066c3ca3fcb83b8569815e63510348b83272801a5a7
|
|
| SHA512 |
1115abd3e1ba14afea8d74bc1589f5219423b2960e4d80d9d2955d09de0560999fe8015ee0dca7087719c9677cbb30791c98893b4ac856472ffc8eea528a3f7e
|
|
| ImpHash |
25bfdb24295c41a4edb48c4ecad85a40
|
| 图标 |
哈希: 6599c8287d6f1364fc16c059c6b8f74d
模糊: 308005336b6c26bc3137c3163065d9e4 dHash: 40d0dca6a694e870 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x00682dd3 |
| 编译时间 | 2025-01-16 09:46:41 |
| 校验和 | 0x00a21e0f (实际: 0x00a21e0f) |
| 操作系统版本 | 5.1 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| PDB 路径 | f:\workspace\installer\online\setup\Release\R_Online.pdb |
| 数字签名 | The expected hash does not match the digest in SpcInfo |
| 导入 | 16 库 |
| 导出 | 0 函数 |
| 资源 | 93 资源 |
| 节 | 6 节 |
| CompanyName | UniFab |
| FileDescription | UniFab |
| FileVersion | 1.0.0.0 |
| InternalName | setup.exe |
| LegalCopyright | Copyright (c)2025 unifab.ai All Rights Reserved. |
| OriginalFilename | setup.exe |
| ProductName | unifab.ai |
| ProductVersion | 1.0.0.0 |
| Translation | 0x0804 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
2,916,364 bytes | 2,916,864 bytes | 6.58 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
5773C64F8B319C9E294FBD7F749EBD87 |
.rdata |
0x002ca000 |
769,338 bytes | 769,536 bytes | 5.33 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
7BA46A3D52F600620618AA391C68621E |
.data |
0x00386000 |
139,752 bytes | 66,048 bytes | 5.40 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
F00FF89436D798ABFB755BAA020D970A |
.tls |
0x003a9000 |
2 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x003aa000 |
5,301,429 bytes | 5,301,760 bytes | 6.09 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
466557E25524A0856212798EDA204E17 |
.reloc |
0x008b9000 |
1,543,680 bytes | 1,543,680 bytes | 7.94 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
9A4700E8C4D378322E21013B6274F2C7 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| TXT | 2 | 58 字节 | |
| XML | 2 | 34,277 字节 | |
| RT_BITMAP | 57 | 4,835,194 字节 | |
| RT_ICON | 20 | 424,836 字节 | |
| RT_MENU | 1 | 74 字节 | |
| RT_DIALOG | 4 | 558 字节 | |
| RT_STRING | 2 | 124 字节 | |
| RT_ACCELERATOR | 1 | 16 字节 | |
| RT_GROUP_ICON | 2 | 292 字节 | |
| RT_VERSION | 1 | 724 字节 | |
| RT_MANIFEST | 1 | 381 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The expected hash does not match the digest in SpcInfo
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
