| 文件名 | Setup (2).exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.155.174 |
| 数据库版本 | 2024-01-17 05:02:21 UTC |
恶意软件家族: WebCompanion
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
4329e751d1eaf1c42ecf288b5729b1f6
|
|
| SHA1 |
9d232f56149dc6d6665f4803ea5cd307453a164f
|
|
| SHA256 |
4a8ad32fea2a3fc643955a06422316c15635a0f24c1b43ee91d1bc208fc9fda5
|
|
| SHA512 |
0538321643e64476cdf48ee433744e62abd2c7f159028b9733346f5c88a504a85df1bad770f191da3bff23ce6e839b6f1e831ebac1f7b82403d5b81154c046fc
|
|
| ImpHash |
e00de6e48b9b06aceb12a81e7bf494c9
|
| 图标 |
哈希: 5d22a7ff7121dddf8a76e69fbfa77d4f
模糊: 12c3f1debd31ced5359a163aa35b6563 dHash: 00118ac8c4686900 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x004148d4 |
| 编译时间 | 2011-04-18 18:54:06 |
| 校验和 | 0x0009021c (实际: 0x0008ac44) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 数字签名 | OK |
| 导入 |
4 库
OLEAUT32, USER32, SHELL32, KERNEL32 |
| 导出 | 0 函数 |
| 资源 | 14 资源 |
| 节 | 5 节 |
| Entrust Root Certification Authority - G2 | Entrust, Inc. (US) |
| Entrust Root Certification Authority - G2 | Entrust, Inc. (US) |
| Entrust Code Signing Root Certification Authority - CSBR1 | Entrust, Inc. (US) |
| Entrust Extended Validation Code Signing CA - EVCS2 | Lavasoft Software Canada Inc. (CA) |
| FileVersion | 12.901.2.991 |
| ProductVersion | 12.901.2.991 |
| CompanyName | Lavasoft |
| FileDescription | Web Companion Installer |
| InternalName | Installer.exe |
| LegalCopyright | c Lavasoft Limited. All Rights Reserved. |
| OriginalFilename | Installer.exe |
| ProductName | Web Companion Installer |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
104,384 bytes | 104,448 bytes | 6.61 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
206B62D600BEB166F8BF863AD5301F8C |
.rdata |
0x0001b000 |
17,552 bytes | 17,920 bytes | 4.38 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
B0314F39355CAB7D4674A0928D3B15F2 |
.data |
0x00020000 |
23,144 bytes | 12,800 bytes | 1.38 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
8D44C03D32E0C923339CDA9FAE15827A |
.sxdata |
0x00026000 |
4 bytes | 512 bytes | 0.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_LNK_INFO|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
35925CFDC1176BD9FFC634A58B40EC17 |
.rsrc |
0x00027000 |
29,132 bytes | 29,184 bytes | 4.66 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
80D1267689DD064ED497A799C053CA89 |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 7 | 25,291 字节 | |
| RT_DIALOG | 1 | 184 字节 | |
| RT_STRING | 2 | 200 字节 | |
| RT_GROUP_ICON | 2 | 110 字节 | |
| RT_VERSION | 1 | 828 字节 | |
| RT_MANIFEST | 1 | 1,663 字节 |
| 主题 |
Entrust Root Certification Authority - G2 Entrust, Inc. US |
| 颁发者 | Entrust Root Certification Authority - G2 |
| 序列号 | 1246989352 |
| 主题 |
Entrust Code Signing Root Certification Authority - CSBR1 Entrust, Inc. US |
| 颁发者 | Entrust Root Certification Authority - G2 |
| 序列号 | 104016719443392582891195013311543612543 |
| 主题 |
Entrust Extended Validation Code Signing CA - EVCS2 Entrust, Inc. US |
| 颁发者 | Entrust Code Signing Root Certification Authority - CSBR1 |
| 序列号 | 71361457201517752660581604742734624043 |
| 主题 |
Lavasoft Software Canada Inc. Lavasoft Software Canada Inc. CA |
| 颁发者 | Entrust Extended Validation Code Signing CA - EVCS2 |
| 序列号 | 155432911550719099163106291658133271269 |
OK
按照以下步骤完全从系统中移除威胁
