| 文件名 | AlmoristicsHelper.dll |
| 文件类型 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.211.174 |
| 数据库版本 | 2025-03-19 20:00:29 UTC |
恶意软件家族: Altruistik
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
23bf58508b78434b88f5aca5b86b7921
|
|
| SHA1 |
c1e0585db3245d7d59c7b3359c65dc1692c174be
|
|
| SHA256 |
4cf2831e502a7c345e0c468dc987e214e595d2643095e7f65ce930411c6a9ed7
|
|
| SHA512 |
82a0994bf0bac6e1761d3b42e6b6e4ad81c10676055a63af96126062173aeba7fb619b6a50078f277ee8f2cbe5d3889a51a138c8676717e9ac42774243bb3776
|
|
| ImpHash |
ab97a1bacfaebeeaee25537f41f2aaf4
|
| 映像基址 | 0x180000000 |
| 入口点 | 0x180010d30 |
| 编译时间 | 2025-03-10 11:31:57 |
| 校验和 | 0x00044c87 (实际: 0x00044c87) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 数字签名 | Chain verification from CN=PelmoDevGroup, O=PelmoDevGroup, ST=Tennessee, C=US (serial:-94609410529142442433877800137960204145, sha1:0d0f9dc59ffa72e67984bd2d1f1ab124fe76a36d) failed: The X.509 certificate provided is self-signed - "Common Name: PelmoDevGroup, Organization: PelmoDevGroup, State/Province: Tennessee, Country: US" |
| 导入 |
8 库
KERNEL32, ADVAPI32, SHELL32, OLEAUT32, WININET, SHLWAPI, WINMM, VERSION |
| 导出 | 5 函数 |
| 资源 | 2 资源 |
| 节 | 6 节 |
| FileDescription | Almoristics Helper |
| FileVersion | 1.7.9.5 |
| InternalName | AlmoristicsHelper |
| ProductVersion | 1.7.9.5 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
154,360 bytes | 154,624 bytes | 6.54 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
40E731B430D2CBF174DBC37824098A0A |
.rdata |
0x00027000 |
66,658 bytes | 67,072 bytes | 5.28 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D7F5A449E362A79077DBB1892AA3AE03 |
.data |
0x00038000 |
26,404 bytes | 21,504 bytes | 6.33 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
CFAA0E1802DD04D357CAB8F33AD7EF43 |
.pdata |
0x0003f000 |
7,152 bytes | 7,168 bytes | 5.39 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
FA60F6114F314870C6DA5024CB767304 |
.rsrc |
0x00041000 |
784 bytes | 1,024 bytes | 3.04 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
B5B3EEDAA187A2D0873E45BAC049D925 |
.reloc |
0x00042000 |
2,016 bytes | 2,048 bytes | 5.36 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
71F4D1A39C695EE9E266724EADBD2FA4 |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 468 字节 | |
| RT_MANIFEST | 1 | 145 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
Chain verification from CN=PelmoDevGroup, O=PelmoDevGroup, ST=Tennessee, C=US (serial:-94609410529142442433877800137960204145, sha1:0d0f9dc59ffa72e67984bd2d1f1ab124fe76a36d) failed: The X.509 certificate provided is self-signed - "Common Name: PelmoDevGroup, Organization: PelmoDevGroup, State/Province: Tennessee, Country: US"
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
