| 文件名 | tftpd64.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.180.174 |
| 数据库版本 | 2024-06-24 05:00:14 UTC |
恶意软件家族: Agent
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
3c1e3215acc69f06f044802ed4695333
|
|
| SHA1 |
ea34a6bad04bc5a1fcb494668347cd302557f327
|
|
| SHA256 |
34de53b43c32e3ed5231a57683103acad1aebeef08309cf8e770c27acc90e4e7
|
|
| SHA512 |
82ed2edbb7286aac00b946f7f4c79e59079994fe8385e961abd1291440fdf26e14c724943eaabebb517e921ece4b384b9d50905898d71f2efaa427be7082d2d0
|
|
| ImpHash |
cd339696c8e5d1a47aa69598eea5f5d8
|
| 图标 |
哈希: edf69fdfc575b90c67888f30b4f23ac5
模糊: e73d03484a5389fd980e5262d7d9cd33 dHash: 9c76ca2da698f1c4 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x140019f08 |
| 编译时间 | 2019-02-27 12:18:22 |
| 校验和 | 0x00000000 (实际: 0x0006640f) |
| 操作系统版本 | 5.2 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 |
9 库
SHELL32, WS2_32, COMCTL32, IPHLPAPI, KERNEL32, USER32, GDI32, COMDLG32, ADVAPI32 |
| 导出 | 0 函数 |
| 资源 | 19 资源 |
| 节 | 7 节 |
| CompanyName | Ph. Jounin |
| FileDescription | TFTP server |
| LegalCopyright | see license in about box |
| OriginalFileName | tftpd32 |
| ProductVersion | 4.64 |
| Translation | 0x040c 0x04e4 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
230,896 bytes | 230,912 bytes | 6.46 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
C270544398209A3A2D52F25A8946F67A |
.rdata |
0x0003a000 |
72,718 bytes | 73,216 bytes | 5.34 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
A7935C60E8D392DE7929370D58FA7F70 |
.data |
0x0004c000 |
107,136 bytes | 12,288 bytes | 2.74 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
75C303AB6B320CE8F11C636D553DEECC |
.pdata |
0x00067000 |
9,720 bytes | 9,728 bytes | 5.58 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
30F34053BA313BB5E23C39349A256EBD |
_RDATA |
0x0006a000 |
148 bytes | 512 bytes | 1.43 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
75333C9895AD9E4EBE1BC543EBF8E6BE |
.rsrc |
0x0006b000 |
62,384 bytes | 62,464 bytes | 3.19 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
78706B718A05C67BC2E4476B1EEFE403 |
.reloc |
0x0007b000 |
2,084 bytes | 2,560 bytes | 4.94 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
FAA181D89F44777D4011B833D0024D8A |
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 6 | 51,600 字节 | |
| RT_MENU | 2 | 70 字节 | |
| RT_DIALOG | 7 | 8,592 字节 | |
| RT_GROUP_ICON | 2 | 96 字节 | |
| RT_VERSION | 1 | 532 字节 | |
| RT_MANIFEST | 1 | 381 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
