| 在线病毒检测器 | v.1.0.202.174 |
| 数据库版本: | 2024-12-31 01:00:20 |
这是一个通用检测名称，用于识别具有特洛伊木马特征的潜在有害或可疑文件或程序。这是一种伪装成合法或良性程序但包含恶意代码或功能的恶意软件。
| File | swift-bootstrapper.exe |
| 已检查 | 2024-12-30 23:09:55 |
| MD5 | 26e350b6f17a777a79b8be46e1b06ac0 |
| SHA1 | acdbbef171b2361604bb7678645acf62fc2cc7af |
| SHA256 | 29c535c85ca221059c46b364b9b6a81e68a0e0a6aef5da460dcb0daddf90d2f1 |
| SHA512 | 1b8c77ef6764405cec4946cb877dca5fd5d500cc1c9dd51346f617c545f60cf3b2b6ab2b6e5781d6e83975553f24bc0c22a248c57aa5a7ea50096b1b55965a39 |
| Imphash | 3d1aac9ff7e58c1e6f2aae45b5e2bb4b |
| File Size | 5979648 bytes |
Gridinsoft能够识别并消除Spy.Win64.Gen.tr，无需进一步的用户干预。
| Image Base: | 0x140000000 |
| Entry Point: | 0x1403f65a0 |
| Compilation: | 2024-12-06 18:09:31 |
| Checksum: | 0x00000000 (Actual: 0x005c2ef1) |
| OS Version: | 6.0 |
| PDB Path: | bunni_bootstrapper.pdb |
| PEiD: | PE32+ executable (console) x86-64, for MS Windows |
| Sign: | No valid SignedData structure was found. |
| Sections: | 5 |
| Imports: | bcryptprimitives, api-ms-win-core-synch-l1-2-0, ADVAPI32, secur32, crypt32, kernel32, ws2_32, ntdll, VCRUNTIME140, api-ms-win-crt-math-l1-1-0, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-stdio-l1-1-0, api-ms-win-crt-locale-l1-1-0, api-ms-win-crt-heap-l1-1-0, |
| Exports: | 0 |
| Resources: | 0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | MD5 | 熵 |
|---|---|---|---|---|---|
| .text | 0x00001000 | 0x003f847f | 0x003f8600 | 2561dc9490d3d1530bd907f77ac6fd04 | 5.74 |
| .rdata | 0x003fa000 | 0x00169bba | 0x00169c00 | 6b4b3ba00c804a4b58fb44247cf15e7f | 5.44 |
| .data | 0x00564000 | 0x000025e0 | 0x00002400 | 339d794ce97d9e6e94538681b0afe574 | 2.34 |
| .pdata | 0x00567000 | 0x00049788 | 0x00049800 | 01a6ead88cf91c04f8e986f985867601 | 6.41 |
| .reloc | 0x005b1000 | 0x00005b3c | 0x00005c00 | 5b763bbad5b702eedf969a8c8345ca05 | 5.45 |
