EOSSDK Win64 Shipping dll (Free DLC for everyone ʕ ᵔᴥᵔʔ) ʕ •ᴥ•ʔ acidicoala 文件恶意软件分析

EOSSDK-Win64-Shipping.dll (Free DLC for everyone ʕ ᵔᴥᵔʔ) 文件分析

更新于 1 month ago

检查者 Malware Check

EOSSDK-Win64-Shipping.dll

哈希类型	值	操作
MD5	cbc89e2221713b0d4482f91282030a88
SHA1	b6a968f70972c21766969ad62edebb548ffa369c
SHA256	50878b3b20f9e93e1bfd21309628964cf8fe1ad57f31022322bc2be4f806daef
SHA512	79eb62d3ac0a3f9808c67fcf43b6a8a1113b0a9c00e1986458a492a3680adc2b54c178e289b94d4f8bdd9bcacb923c14c61e1dd3cffe81d2f5a597ff4a9defed
ImpHash	4828424a7fe1d8a7af504ec64ff08b98

哈希类型

值

操作

MD5

cbc89e2221713b0d4482f91282030a88

SHA1

b6a968f70972c21766969ad62edebb548ffa369c

SHA256

50878b3b20f9e93e1bfd21309628964cf8fe1ad57f31022322bc2be4f806daef

SHA512

79eb62d3ac0a3f9808c67fcf43b6a8a1113b0a9c00e1986458a492a3680adc2b54c178e289b94d4f8bdd9bcacb923c14c61e1dd3cffe81d2f5a597ff4a9defed

ImpHash

4828424a7fe1d8a7af504ec64ff08b98

PE 分析

基本信息

▼

映像基址	`0x180000000`
入口点	`0x18000169f`
编译时间	2023-03-14 12:00:21
校验和	0x00000000 (实际: 0x0096945c)
操作系统版本	6.0
PEiD 签名	`PE32+ executable (DLL) (console) x86-64, for MS Windows`
PDB 路径	`D:\a\ScreamAPI\ScreamAPI\build\64\ScreamAPI\Debug\EOSSDK-Win64-Shipping.pdb`
数字签名	No valid SignedData structure was found.
导入	9 库 WS2_32, ADVAPI32, CRYPT32, KERNEL32, USER32, SHELL32, WINHTTP, COMCTL32, VERSION
导出	627 函数
资源	2 资源
节	10 节

版本信息

▼

CompanyName	ʕ •ᴥ•ʔ acidicoala
FileDescription	Free DLC for everyone ʕ ᵔᴥᵔʔ
FileVersion	4.0.0
InternalName	ScreamAPI
LegalCopyright	Fuck the copyright \ud83d\udd95
OriginalFilename	ScreamAPI.dll
ProductName	ScreamAPI
ProductVersion	4.0.0
Translation	0x0409 0x04e4

PE 节

▼

名称	虚拟地址	虚拟大小	原始大小	熵	特征	MD5
`.text`	`0x00001000`	5,871,697 bytes	5,872,128 bytes	5.11 (正常)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`6D5D62578F1315A896061681932F48D0`
`.rdata`	`0x0059b000`	3,264,730 bytes	3,265,024 bytes	4.11 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4FB3841A89A7FA2723A13CE81533B6F4`
`.data`	`0x008b9000`	295,744 bytes	277,504 bytes	3.80 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`71757A6B00A7448DE99DC99BC7F41F50`
`.pdata`	`0x00902000`	359,436 bytes	359,936 bytes	6.01 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`4CD4494A060C1278B66F270B4D6645F3`
`.idata`	`0x0095a000`	13,503 bytes	13,824 bytes	3.93 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`63D35D1CB980E5EC27E08896EF000C64`
`.tls`	`0x0095e000`	799 bytes	1,024 bytes	0.01 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`954DFEBF227F2124AE8F5D9143D12CF3`
`.00cfg`	`0x0095f000`	373 bytes	512 bytes	0.41 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9264C8DE9C570B1D73202CF618D035DF`
`_RDATA`	`0x00960000`	671 bytes	1,024 bytes	1.95 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`6497A78806DAAEBFA8A660D01CA24123`
`.rsrc`	`0x00961000`	2,364 bytes	2,560 bytes	3.17 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`035BDA8324A9B2C7111863563AC70AA3`
`.reloc`	`0x00962000`	53,429 bytes	53,760 bytes	3.74 (正常)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`34DA6FFDDA3E3DE20EE9D1E0670B32DB`

资源分析

▼

资源总数: 2 (1,374 字节)

资源类型	数量	总大小	百分比
RT_VERSION	1	732 字节	53.3%
RT_MANIFEST	1	642 字节	46.7%

证书链分析

▼

证书 Information

产品	ScreamAPI
描述	Free DLC for everyone ʕ ᵔᴥᵔʔ
文件版本	4.0.0
原始名称	ScreamAPI.dll
内部名称	ScreamAPI
版权	Fuck the copyright 🖕

✓ 此文件已进行数字签名，证书链已验证。

签名确保文件的完整性和发布者的真实性。
时间戳证明签名的应用时间。

证书验证状态

No valid SignedData structure was found.

建议: 验证文件来源并确保它来自可信的发布者.

发表评论

文件名	EOSSDK-Win64-Shipping.dll
文件类型	PE32+ executable (DLL) (console) x86-64, for MS Windows
扫描器版本	1.0.229.174
数据库版本	2025-11-25 23:00:28 UTC

EOSSDK-Win64-Shipping.dll (Free DLC for everyone ʕ ᵔᴥᵔʔ) 文件分析

技术分析

干净文件

扫描另一个文件

文件识别