| 文件名 | BitComet.exe |
| 文件类型 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.194.174 |
| 数据库版本 | 2024-10-28 12:00:38 UTC |
恶意软件家族: InstallCore
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
cbb6d49fcb708b9aeb7ba74567091fe9
|
|
| SHA1 |
dbde15b4ee94437a82cace375ad1ca55739ad57f
|
|
| SHA256 |
5760e7283ea31834aa16976fe052c156c26cc1c2459a043152c06ce2b8a4fd1e
|
|
| SHA512 |
bee080ec0d335cc1774c05f98e4480fc4d0ff825bfcee3822171adc461023c3f6952ecb064d33b5c8709e520bc8ee29a63e28381f0847aa3919e097586428a8e
|
|
| ImpHash |
d2fca41c9e84b9f5f8a2abb235194346
|
| 图标 |
哈希: 5771b0fae29f38cac49fcbccd914d4c2
模糊: b7621093455d12c52d863db1873a2897 dHash: f0f0bed4d4d4f0f0 |
| 映像基址 | 0x140000000 |
| 入口点 | 0x1409b30ec |
| 编译时间 | 2024-08-20 14:20:48 |
| 校验和 | 0x01b0c216 (实际: 0x01b0c216) |
| 操作系统版本 | 5.2 |
| PEiD 签名 |
PE32+ executable (GUI) x86-64, for MS Windows
|
| PDB 路径 | D:\develop\BitComet_2.09\app\Release_unicode_x64\GUI_BitComet_wx.pdb |
| 数字签名 | An error occurred while validating the countersignature: The root Certum Trusted Network CA 2 lists its extended key usages, but {'time_stamping'} are not present |
| 导入 | 21 库 |
| 导出 | 0 函数 |
| 资源 | 154 资源 |
| 节 | 8 节 |
| CompanyName | www.BitComet.com |
| FileDescription | BitComet - a BitTorrent Client |
| FileVersion | 2.09 |
| InternalName | BitComet.exe |
| LegalCopyright | Copyright(C) 2003-2024 All Rights Reserved. |
| ProductName | BitComet 64-bit |
| ProductVersion | 2.09 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
16,640,872 bytes | 16,641,024 bytes | 6.52 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D8172A89727D5A90675AFF866AE8297F |
.rdata |
0x00fe0000 |
7,819,386 bytes | 7,819,776 bytes | 5.24 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
18D2DC02F0F2359F67CE82A478659E94 |
.data |
0x01756000 |
1,904,976 bytes | 518,656 bytes | 4.46 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
083DD69B886CF0AD13627C0F1E07B3D5 |
.pdata |
0x01928000 |
684,092 bytes | 684,544 bytes | 6.77 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
9F3FA5744D00E0E2B55F73DD73A57539 |
.detourc |
0x019d0000 |
8,720 bytes | 9,216 bytes | 2.81 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
CAD5D451B901B03DC9C75917F5B6FD70 |
.detourd |
0x019d3000 |
24 bytes | 512 bytes | 0.12 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
EDDA25907019E5CC74C177F6952E5E4B |
.rsrc |
0x019d4000 |
2,313,136 bytes | 2,313,216 bytes | 7.95 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
024B004BDC7022110ACC023346570B60 |
.reloc |
0x01c09000 |
350,760 bytes | 351,232 bytes | 5.46 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
254FC73B275AC4CCC4BCA95C5E1A4FEB |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| DLL | 1 | 2,560 字节 | |
| MHT | 3 | 74,651 字节 | |
| PNG | 87 | 1,707,536 字节 | |
| ZIP | 7 | 321,401 字节 | |
| RT_ICON | 36 | 171,173 字节 | |
| RT_GROUP_ICON | 6 | 540 字节 | |
| RT_VERSION | 1 | 732 字节 | |
| RT_HTML | 12 | 22,213 字节 | |
| RT_MANIFEST | 1 | 794 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
An error occurred while validating the countersignature: The root Certum Trusted Network CA 2 lists its extended key usages, but {'time_stamping'} are not present
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft 能够识别并消除 Adware.Win64.InstallCore.vl!c，无需用户进一步干预。
下载反恶意软件按照以下步骤完全从系统中移除威胁
