| 文件名 | msimg32.dll |
| 文件类型 |
PE32 executable (DLL) (console) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.171.174 |
| 数据库版本 | 2024-04-05 00:00:13 UTC |
恶意软件家族: Agent
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
ee65387b0f03a635a8bc7ca0c7b67a62
|
|
| SHA1 |
903a144baf7ef7e2581d664e27c50d90b8b20c57
|
|
| SHA256 |
562691427bece511b7ebdd270c7afe9d37392ae006982f7978f74781d6851351
|
|
| SHA512 |
add4f4cf21c733fdd0e68c04732f592f15adfe96b95294d711e7a6fd41525424606571abeef0c2111b9b317b6d20e97b2d476f17b7959564c892ceb51e216c9e
|
|
| ImpHash |
7891b90c290e6528525cdd954119062c
|
| 映像基址 | 0x10000000 |
| 入口点 | 0x10001000 |
| 编译时间 | 2022-04-28 16:58:33 |
| 校验和 | 0x00000000 (实际: 0x00012979) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (DLL) (console) Intel 80386, for MS Windows
|
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 |
3 库
MSVCRT, KERNEL32, USER32 |
| 导出 | 5 函数 |
| 资源 | 1 资源 |
| 节 | 6 节 |
| CompanyName | Microsoft Corporation |
| FileDescription | GDIEXT Client DLL |
| FileVersion | 6.3.9600.17415 (winblue_r4.141028-1500) |
| InternalName | gdiext |
| LegalCopyright | © Microsoft Corporation. All rights reserved. |
| OriginalFilename | gdiext |
| ProductName | Microsoft® Windows® Operating System |
| ProductVersion | 6.3.9600.17415 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.code |
0x00001000 |
2,700 bytes | 3,072 bytes | 5.15 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
42A7DD8111A4BA13A8AD7708F876CD58 |
.text |
0x00002000 |
9,368 bytes | 9,728 bytes | 6.30 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
55275FA3CE44FB9B02DE589C53A926DB |
.rdata |
0x00005000 |
217 bytes | 512 bytes | 2.25 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
5F41B4581B6EB1586EA4D20A2F82B6ED |
.data |
0x00006000 |
4,004 bytes | 2,560 bytes | 4.48 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
A5584E1B0E8C170F30A17D7F7A72E29B |
.rsrc |
0x00007000 |
980 bytes | 1,024 bytes | 3.42 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
A54BBDEF1C1F22D6559ECE74330C6372 |
.reloc |
0x00008000 |
740 bytes | 1,024 bytes | 5.35 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
7354BFAAAADBA4F7D1C077412B9781DD |
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 892 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
