| 文件名 | DDSurvivors.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.226.174 |
| 数据库版本 | 2025-10-02 06:00:34 UTC |
恶意软件家族: Wacatac
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
6ea2b82430d39b7cd7d6ec8e2653eb4b
|
|
| SHA1 |
05124952608a0abfef4404f36aea6b0b1b5fca78
|
|
| SHA256 |
535852716eb6acf5928bbba250d57f9774415334b548b676e935793d1e0eab49
|
|
| SHA512 |
bc38e2cac83a84c43895afc02f13b675b534af0f5a0b2e482bb6ac0ea1efdf8c75acb43fc10166e9707067330393b1ab0efcab10f65dc09ee887baace7e11837
|
|
| ImpHash |
055e3f3e659a81f413c7fd133a3e7587
|
| 图标 |
哈希: 10d45c855e372009fb11201b6bbde333
模糊: 719c3f65d28bc8f0e0961a4ac2f40c0c dHash: 1979696160626079 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x140eaa4dc |
| 编译时间 | 2098-11-29 06:38:03 |
| 校验和 | 0x00030044 (实际: 0x0033ec49) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 |
9 库
kernel32, user32, advapi32, oleaut32, gdi32, shell32, version, ole32, SHLWAPI |
| 导出 | 0 函数 |
| 资源 | 13 资源 |
| 节 | 10 节 |
| FileVersion | ++UE5+Release-5.6-CL-44394996 |
| CompanyName | Epic Games, Inc. |
| LegalCopyright | Fill out your copyright notice in the Description page of Project Settings. |
| ProductName | BootstrapPackagedGame |
| ProductVersion | ++UE5+Release-5.6-CL-44394996 |
| FileDescription | BootstrapPackagedGame |
| InternalName | UnrealEngine |
| OriginalFilename | BootstrapPackagedGame-Win64-Shipping.exe |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
|
0x00001000 |
86,016 bytes | 45,568 bytes | 7.99 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
A18D8375B635F6ACE76019073E0AEFC9 |
|
0x00016000 |
49,152 bytes | 19,456 bytes | 7.99 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
54A0A2D8A779CCF50EA62BAEA0F4FF98 |
|
0x00022000 |
8,192 bytes | 512 bytes | 6.94 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
9C55F249A8EA7B78E14BD7BED2CA163B |
|
0x00024000 |
8,192 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
|
0x00026000 |
4,096 bytes | 512 bytes | 4.75 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
594B1BFA07C2ECE125AE8AA8B919A1BC |
|
0x00027000 |
114,688 bytes | 512 bytes | 2.05 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
4DDD917FC2A2223DA6BCF94CC9CF336D |
|
0x00043000 |
4,096 bytes | 1,536 bytes | 7.12 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
A7D85C17A4C007C2B6A3D0D56D5695EF |
.rsrc |
0x00044000 |
114,688 bytes | 111,616 bytes | 3.46 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
F301106BC646DE09DB846A862F46B321 |
|
0x00060000 |
12,054,528 bytes | 278,528 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
0FA605B942581C712E3ACD0CAD4F8406 |
|
0x00bdf000 |
2,940,928 bytes | 2,938,880 bytes | 7.96 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
F9AFA3536BD7F74C32F47722F88777BD |
4 检测到高熵（≥7.5）的节 - 可能存在打包/加密
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 7 | 107,913 字节 | |
| RT_RCDATA | 2 | 140 字节 | |
| RT_GROUP_ICON | 2 | 194 字节 | |
| RT_VERSION | 1 | 1,008 字节 | |
| RT_MANIFEST | 1 | 1,408 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
保持无恶意软件：使用 Gridinsoft 反恶意软件 保护您的 PC
Gridinsoft 反恶意软件正是如此——提供强大、用户友好的解决方案，让您安心，并不断更新以应对最新威胁。由网络安全专家设计，它提供实时保护和轻松删除恶意软件。这不仅仅是检测威胁；它是通过不间断的安全来增强您的数字生活。试一试，体验无忧浏览的感觉！
