| 文件名 | keyfinder.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.214.174 |
| 数据库版本 | 2025-04-20 19:00:23 UTC |
恶意软件家族: MagicalJellyBean
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
4187dfaf99e89cc211eb3f2bf6af81ca
|
|
| SHA1 |
55fc92048228aaab920a9d164dff7ba92117ec82
|
|
| SHA256 |
3cf64f198a3a58f608639823ae689cbff75dc475996cbd14ebd16550d9886f1c
|
|
| SHA512 |
9ffc1e6f76ad4826abe7ece3dcf0a59c49564f03bb3ebde9a11d8dbaeb5f870cb5d9affcebd001ffe6d84aa6bd34fa8f94851de4d8f2a22e1941002e49b86d61
|
|
| ImpHash |
2c32faf0f683349987f751b5b51888a0
|
| 图标 |
哈希: 8bb0b2a1406f5d2b361a4c4b4cfdc1a1
模糊: ae79c7bfbc99823f5bd21324c39c9d6e dHash: b23934a479d3932c |
| 映像基址 | 0x00400000 |
| 入口点 | 0x004938fc |
| 编译时间 | 1992-06-19 22:22:17 |
| 校验和 | 0x000d4793 (实际: 0x000d4793) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 数字签名 | Chain verification from CN=One Up Ltd, O=One Up Ltd, L=Limassol, ST=Limassol, C=CY (serial:3403635888393928309166173920, sha1:d99ca19bcec3f6a9e7eb00ab428e1926f8f03f12) failed: The path could not be validated because the end-entity certificate expired 2022-11-19 15:03:38Z |
| 导入 | 11 库 |
| 导出 | 0 函数 |
| 资源 | 61 资源 |
| 节 | 8 节 |
| CompanyName | ONE UP LTD. |
| FileDescription | Magical Jelly Bean Keyfinder |
| FileVersion | 2.0.10.14 |
| InternalName | KeyFinder |
| LegalCopyright | © ONE UP LTD. All rights reserved. |
| LegalTrademarks | |
| OriginalFilename | keyfinder.exe |
| ProductName | Magical Jelly Bean Keyfinder |
| ProductVersion | 2.0.10.14 |
| Comments | Product key recovery utility |
| Translation | 0x0409 0x04e4 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
CODE |
0x00001000 |
600,992 bytes | 601,088 bytes | 6.56 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
2012AB4ED4A2CFD0BA9AF77ECE86A970 |
DATA |
0x00094000 |
8,472 bytes | 8,704 bytes | 4.72 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
B557272FC255C62EFD4160F998CBE00E |
BSS |
0x00097000 |
5,969 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x00099000 |
10,072 bytes | 10,240 bytes | 5.01 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
B7F3978E56A2254D189B9B5CBB447E39 |
.tls |
0x0009c000 |
16 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x0009d000 |
24 bytes | 512 bytes | 0.20 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ
|
7663CD7968AA5584B9008C65B366243E |
.reloc |
0x0009e000 |
40,588 bytes | 40,960 bytes | 6.68 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ
|
C6B3338112022B4EBAAE44C81F9095CD |
.rsrc |
0x000a8000 |
132,608 bytes | 132,608 bytes | 7.22 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ
|
DFCCBB8770E21A303600FDCBB8B38D40 |
3 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_CURSOR | 7 | 2,156 字节 | |
| RT_BITMAP | 11 | 4,892 字节 | |
| RT_ICON | 6 | 22,384 字节 | |
| RT_DIALOG | 1 | 82 字节 | |
| RT_STRING | 18 | 11,792 字节 | |
| RT_RCDATA | 8 | 84,812 字节 | |
| RT_GROUP_CURSOR | 7 | 140 字节 | |
| RT_GROUP_ICON | 1 | 90 字节 | |
| RT_VERSION | 1 | 932 字节 | |
| RT_MANIFEST | 1 | 1,382 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
Chain verification from CN=One Up Ltd, O=One Up Ltd, L=Limassol, ST=Limassol, C=CY (serial:3403635888393928309166173920, sha1:d99ca19bcec3f6a9e7eb00ab428e1926f8f03f12) failed: The path could not be validated because the end-entity certificate expired 2022-11-19 15:03:38Z
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft 能够识别并消除 PUP.Win32.MagicalJellyBean.dd!c，无需用户进一步干预。
下载反恶意软件按照以下步骤完全从系统中移除威胁
