| 文件名 | exk.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
|
| 扫描器版本 | 1.0.158.174 |
| 数据库版本 | 2024-02-02 12:00:35 UTC |
恶意软件家族: Gen
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
75ea03e4b9a28a81f21e3f6226e3f65d
|
|
| SHA1 |
f58999cce54814080420513dc64242be8655b9bb
|
|
| SHA256 |
234cb35529c96c911095e47bdac688eb3b1f5935067f57d67714fd3180c81765
|
|
| SHA512 |
74bf9193d680ea8448ac10843e006dd163bdbf621e310e5b0fc3e55dbb1c3f62a6e43c2ff4e34c2b91a461641a1362fe70c0a5d6cd92984a37edb86fc28c32fb
|
|
| ImpHash |
ab5f7380db422e0165619daaeff0032b
|
| 图标 |
哈希: e14ffe4d77e21086d89f3f4148fb9d92
模糊: d517e26a6988230a360381f1dbfaeb22 dHash: f8b6b2f0d8cce031 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x0091b020 |
| 编译时间 | 2024-01-05 02:44:20 |
| 校验和 | 0x001e708a (实际: 0x001e708a) |
| 操作系统版本 | 5.1 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
|
| 数字签名 | OK |
| 导入 | 16 库 |
| 导出 | 0 函数 |
| 资源 | 26 资源 |
| 节 | 3 节 |
| AAA Certificate Services | The USERTRUST Network (US) |
| Sectigo RSA Code Signing CA | Beijing Huorong Network Technology Co., Ltd. (CN) |
| USERTrust RSA Certification Authority | Sectigo Limited (GB) |
| CompanyName | Huorong Security |
| FileDescription | 火绒恶性木马专杀工具 |
| FileVersion | 1.0.0.88 |
| InternalName | HRKill |
| LegalCopyright | Huorong Security |
| OriginalFilename | HRKill.exe |
| ProductName | Huorong Internet Security |
| ProductVersion | 1.0.0.0 |
| Translation | 0x0009 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
UPX0 |
0x00001000 |
3,432,448 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
UPX1 |
0x00347000 |
1,921,024 bytes | 1,917,952 bytes | 7.94 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
26EB0FD4A9392412BB17C5F69CD0EF2B |
.rsrc |
0x0051c000 |
53,248 bytes | 48,128 bytes | 5.95 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
9B26833399BE150C171759025CAB0D86 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| BINARY | 8 | 1,626,032 字节 | |
| ZIPRES | 1 | 79,199 字节 | |
| RT_ICON | 13 | 43,193 字节 | |
| RT_STRING | 1 | 192 字节 | |
| RT_GROUP_ICON | 1 | 188 字节 | |
| RT_VERSION | 1 | 724 字节 | |
| RT_MANIFEST | 1 | 1,040 字节 |
| 主题 |
USERTrust RSA Certification Authority The USERTRUST Network US |
| 颁发者 | AAA Certificate Services |
| 序列号 | 76359301477803385872276235234032301461 |
| 主题 |
Beijing Huorong Network Technology Co., Ltd. Beijing Huorong Network Technology Co., Ltd. CN |
| 颁发者 | Sectigo RSA Code Signing CA |
| 序列号 | 163875566581797712323045766437747179478 |
| 主题 |
Sectigo RSA Code Signing CA Sectigo Limited GB |
| 颁发者 | USERTrust RSA Certification Authority |
| 序列号 | 39390228139828865494873669055555031914 |
OK
按照以下步骤完全从系统中移除威胁
