| 文件名 | CLIPStudioPaint.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.220.174 |
| 数据库版本 | 2025-07-18 17:00:24 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
12b8470ab8f14cbfa7c593e61d155f3b
|
|
| SHA1 |
01e6f2e9352239389c9c99df09b0461e5589b16f
|
|
| SHA256 |
3a53719e3d9bb69480d313b797bcffa5726c69a1667abb9dcb42ef7e4cbd3357
|
|
| SHA512 |
f11663cc38c8e947d30d5be0369d980351de668077a298bb029553411f3ac5fc22c5a61781dad181f6e390358b7c9caa1f08408668453df3493e74d049c2e1f9
|
|
| ImpHash |
867806cca77b37011b64371186c5be5b
|
| 图标 |
哈希: e65f3c7453f847e5818b05481fed7da9
模糊: bfa3998a6732c5d384dc9a5c46d20f9d dHash: c88e236d338cceb8 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x1441e4752 |
| 编译时间 | 2022-06-01 10:28:10 |
| 校验和 | 0x01a56b1c (实际: 0x01a56b1c) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 | 52 库 |
| 导出 | 0 函数 |
| 资源 | 86 资源 |
| 节 | 8 节 |
| CompanyName | CELSYS,Inc. |
| FileDescription | CLIP STUDIO PAINT |
| FileVersion | 1.12.1.0 |
| InternalName | CLIP STUDIO PAINT |
| LegalCopyright | (C) CELSYS,Inc. All Rights Reserved. |
| OriginalFilename | CLIPStudioPaint.exe |
| ProductName | CLIP STUDIO PAINT |
| ProductVersion | 1.12.1 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
50,949,212 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x03098000 |
8,861,178 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x0390c000 |
3,985,816 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.pdata |
0x03cda000 |
1,601,568 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
_RDATA |
0x03e62000 |
9,224 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.krv0 |
0x03e65000 |
3,364,092 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.krv1 |
0x0419b000 |
23,955,328 bytes | 23,955,456 bytes | 7.98 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
20508DF22A2773CE0EE3CCF1E596E4A4 |
.rsrc |
0x05874000 |
3,632,317 bytes | 3,632,640 bytes | 4.88 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
7A60C3EB744B5811FD9410B8C7093530 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 72 | 3,625,122 字节 | |
| RT_GROUP_ICON | 12 | 1,080 字节 | |
| RT_VERSION | 1 | 784 字节 | |
| RT_MANIFEST | 1 | 1,021 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
