| 文件名 | Tibia.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.168.174 |
| 数据库版本 | 2024-03-09 05:00:32 UTC |
恶意软件家族: Downloader
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
b56b4916accaaecf87a0eb5fea9a5b30
|
|
| SHA1 |
12578d8f094f149cbae7d0c1d22200e81167c335
|
|
| SHA256 |
52107dcd1fe24c75ecd987d01f3f1157556eb01cc4c74b99037eb9749e247c13
|
|
| SHA512 |
44c8d8b7ac00c2e786c67a86fc1fd32a8a91acf8d3cea1220abccf4dbd44ab311fea6b526f9c529a909b3df63aa71078fbad9abe972db799fee3e1d4e891dd80
|
|
| ImpHash |
0f3a6fc847e94ff8dc4fa05ad68da0ea
|
| 图标 |
哈希: f2fcbc697e0c2bc5bc8fb8dffbfcec81
模糊: 1ee179f3803535889559fd353e85095c dHash: 18dcca38b0f1a420 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x005625eb |
| 编译时间 | 2010-06-29 09:08:59 |
| 校验和 | 0x002522ba (实际: 0x0025ce31) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 | 13 库 |
| 导出 | 0 函数 |
| 资源 | 63 资源 |
| 节 | 4 节 |
| Comments | Tibia is a massively multiplayer online roleplaying game. Enter a medieval fantasy scenery, meet players from all over the world and have adventures together with them. |
| CompanyName | CipSoft GmbH |
| FileDescription | Tibia Player |
| FileVersion | 8.60 |
| InternalName | Player |
| LegalCopyright | Copyright (C) CipSoft GmbH 2002-2010 |
| LegalTrademarks | Tibia is a registered Trademark of CipSoft GmbH. |
| OriginalFilename | Tibia.exe |
| ProductName | Tibia Player |
| ProductVersion | 8.60 |
| Translation | 0x0000 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
1,796,700 bytes | 1,798,144 bytes | 6.33 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
2C6C3DCC682D57C3AB62FD2D721EA66A |
.rdata |
0x001b8000 |
524,762 bytes | 528,384 bytes | 5.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
7B6F2115B4399FD6C45DBACC692898FD |
.data |
0x00239000 |
1,754,580 bytes | 20,480 bytes | 4.69 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D2DC793B6683D8A5934342C364953929 |
.rsrc |
0x003e6000 |
77,984 bytes | 81,920 bytes | 6.48 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F969B6F3C884C8DF0156E11FB8850051 |
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_CURSOR | 18 | 5,416 字节 | |
| RT_BITMAP | 2 | 508 字节 | |
| RT_ICON | 9 | 60,651 字节 | |
| RT_DIALOG | 1 | 232 字节 | |
| RT_STRING | 13 | 5,824 字节 | |
| RT_GROUP_CURSOR | 17 | 354 字节 | |
| RT_GROUP_ICON | 1 | 132 字节 | |
| RT_VERSION | 1 | 1,224 字节 | |
| RT_MANIFEST | 1 | 366 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
