文件名 | app.exe |
文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
扫描器版本 | 1.0.165.174 |
数据库版本 | 2024-02-17 03:00:21 UTC |
恶意软件家族: XWorm
哈希类型 | 值 | 操作 |
---|---|---|
MD5 |
a916b72f95566268aeca2298759b2018
|
|
SHA1 |
dc449a1a8200a1ced9ea6d681c4738700d6a015f
|
|
SHA256 |
1f833964e95405776234ba73738ca25360c43a54ed71030c978fdf56d1cf11ba
|
|
SHA512 |
36210c0be16498d7c41095b0841d0472ab5bd1afda5051fbbcf119117c3763686602b4a9d49d9954839d8c33047870bbdd470c9e29dfd628ff0eac8671a1618c
|
|
ImpHash |
3e4ea5a76e68c74643536824830b0523
|
映像基址 | 0x140000000 |
入口点 | 0x1400010f6 |
编译时间 | 2024-02-05 17:08:29 |
校验和 | 0x0004c384 (实际: 0x0004c384) |
操作系统版本 | 4.0 |
PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
数字签名 | The PE file does not contain a certificate table. |
导入 |
3 库
KERNEL32, msvcrt, USER32 |
导出 | 0 函数 |
资源 | 1 资源 |
节 | 20 节 |
名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
117,496 bytes | 117,760 bytes | 5.99 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES
|
2CD28190633C61882FA57F64938C31EA |
.data |
0x0001e000 |
53,136 bytes | 53,248 bytes | 7.44 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES
|
A11F8630C0358F45BC706E364F929D9C |
.rdata |
0x0002b000 |
8,576 bytes | 8,704 bytes | 5.24 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_32BYTES
|
8C0086192FF221A1362B3762C68A07FD |
/4 |
0x0002e000 |
4 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
BF619EAC0CDF3F68D496EA9344137E8B |
.pdata |
0x0002f000 |
5,952 bytes | 6,144 bytes | 5.29 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
6A96851ED50B31A6600DB8C820C2963A |
.xdata |
0x00031000 |
5,864 bytes | 6,144 bytes | 3.98 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
FE56ED9C1D64D839FFDD4ED898BB8057 |
.bss |
0x00033000 |
3,440 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x00034000 |
4,104 bytes | 4,608 bytes | 4.10 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
D773DF2B0D4FFE980D8352EA31C0434A |
.CRT |
0x00036000 |
112 bytes | 512 bytes | 0.43 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES
|
A3453752D96B07DF53CED805F3DF1BC0 |
.tls |
0x00037000 |
16 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_8BYTES
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x00038000 |
552 bytes | 1,024 bytes | 3.41 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
BFA1C04600A1C8B2E8C1FC6B14F6DD19 |
.reloc |
0x00039000 |
216 bytes | 512 bytes | 2.51 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
3011FB66F84AF6CB9307D0D7CAC632D6 |
/14 |
0x0003a000 |
144 bytes | 512 bytes | 0.54 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES
|
DE13DBF0BB46F986C063D4848CD1F2B5 |
/29 |
0x0003b000 |
9,944 bytes | 10,240 bytes | 5.61 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
BB0C1B9FC5CE9C2912FF24F2523CC181 |
/41 |
0x0003e000 |
1,090 bytes | 1,536 bytes | 3.97 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
445310D78317DFE90942A16CF6CD9A00 |
/55 |
0x0003f000 |
1,314 bytes | 1,536 bytes | 4.83 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
5FB3B4400A9ED9DBD8C73BAF4BADE3A6 |
/67 |
0x00040000 |
448 bytes | 512 bytes | 2.95 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_8BYTES
|
FF49B236E696D0F3F554F8D2714E9603 |
/80 |
0x00041000 |
132 bytes | 512 bytes | 2.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
E647DC8783FC2F6F90F3541C4DB762C0 |
/91 |
0x00042000 |
945 bytes | 1,024 bytes | 4.18 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
60F8D74B656D5D047E4471243008977B |
/107 |
0x00043000 |
170 bytes | 512 bytes | 1.64 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
B8FCD785A65F6FEE8172BACF46FEFF32 |
1 检测到较高熵(≥6.5)的节 - 可能存在压缩
资源类型 | 数量 | 总大小 | 百分比 |
---|---|---|---|
RT_MANIFEST | 1 | 458 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁