文件名 | KeyFinderInstaller.exe.infected |
文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
扫描器版本 | 1.0.170.174 |
数据库版本 | 2024-03-26 12:00:26 UTC |
恶意软件家族: OpenCandy
哈希类型 | 值 | 操作 |
---|---|---|
MD5 |
80f381187b6511739472b88d72b34206
|
|
SHA1 |
10329743bab3aa7b2073c1962f3e16744967ea11
|
|
SHA256 |
35e605862069aeb3d8413cd512ae05f2831f21f1f496c9cdb90d1c3b8a3cfb97
|
|
SHA512 |
9d78920293c0338216a40eccd683c3783f46a84da3a1e975fada66caeb3a601d090240c084c62120850e6b9d8ee573a463985816e18ba814c49fbf3f7ddbd4dc
|
|
ImpHash |
20dd26497880c05caed9305b3c8b9109
|
图标 |
哈希: 8bb0b2a1406f5d2b361a4c4b4cfdc1a1
模糊: ae79c7bfbc99823f5bd21324c39c9d6e dHash: b23934a479d3932c |
映像基址 | 0x00400000 |
入口点 | 0x004117dc |
编译时间 | 2016-04-06 14:39:04 |
校验和 | 0x000e72c9 (实际: 0x000e72c9) |
操作系统版本 | 5.0 |
PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
数字签名 | OK |
导入 |
5 库
oleaut32, advapi32, user32, kernel32, comctl32 |
导出 | 0 函数 |
资源 | 19 资源 |
节 | 8 节 |
Comments | This installation was built with Inno Setup. |
CompanyName | Magical Jelly Bean |
FileDescription | KeyFinder Setup |
FileVersion | 2.0.10.13 |
LegalCopyright | © ONE UP LTD. All rights reserved. |
ProductName | KeyFinder |
ProductVersion | 2.0.10.13 |
Translation | 0x0000 0x04b0 |
名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
62,020 bytes | 62,464 bytes | 6.38 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
A33E9FF7181115027D121CD377C28C8F |
.itext |
0x00011000 |
3,940 bytes | 4,096 bytes | 5.73 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
CAEC456C18277B579A94C9508DAF36EC |
.data |
0x00012000 |
3,208 bytes | 3,584 bytes | 2.30 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
746954890499546D73DCE0E994642192 |
.bss |
0x00013000 |
22,204 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x00019000 |
3,588 bytes | 4,096 bytes | 4.60 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
E9B9C0328FD9628AD4D6AB8283DCB20E |
.tls |
0x0001a000 |
8 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x0001b000 |
24 bytes | 512 bytes | 0.20 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3DFFC444CCC131C9DCEE18DB49EE6403 |
.rsrc |
0x0001c000 |
63,048 bytes | 63,488 bytes | 4.90 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
A7723AF3AACBF2B859484D124BFB8EDC |
资源类型 | 数量 | 总大小 | 百分比 |
---|---|---|---|
RT_ICON | 6 | 22,384 字节 | |
RT_STRING | 6 | 2,668 字节 | |
RT_RCDATA | 4 | 33,908 字节 | |
RT_GROUP_ICON | 1 | 90 字节 | |
RT_VERSION | 1 | 1,268 字节 | |
RT_MANIFEST | 1 | 1,580 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
OK
按照以下步骤完全从系统中移除威胁