| 文件名 | steam_api.dll |
| 文件类型 |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.224.174 |
| 数据库版本 | 2025-09-11 17:00:47 UTC |
恶意软件家族: Downloader
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
5da698830ce02225ec7bcbcdb6e29ecc
|
|
| SHA1 |
e114b24438ab8fdacc7dcc8dc1d2e38d1e0bb763
|
|
| SHA256 |
71ceafbb73fe5b8f0c591295931fc5c5588db5bca2a859da7aee4f226235b046
|
|
| SHA512 |
0a85873ff144cd7546de938a26f50dbf191133e6fab23c015cbfdc010c790440eaa53a703c68d5c6d28feb4803ef812a61dcfd4b0563300c41d2d13e9b656bd8
|
|
| ImpHash |
b28807e91e42006be54adb629a5c4174
|
| 映像基址 | 0x10000000 |
| 入口点 | 0x10c9fe22 |
| 编译时间 | 2021-04-02 09:30:13 |
| 校验和 | 0x000d82d7 (实际: 0x000d82d7) |
| 操作系统版本 | 5.1 |
| PEiD 签名 |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 |
10 库
KERNEL32, USER32, ADVAPI32, SHELL32, ole32, WS2_32, WINHTTP, SHLWAPI, PSAPI, bcrypt |
| 导出 | 1422 函数 |
| 资源 | 2 资源 |
| 节 | 7 节 |
| Comments | Valve SpecialBuild |
| CompanyName | Valve Corporation |
| FileDescription | Steam Client API |
| FileVersion | 06.28.18.86 |
| InternalName | Steam Client API (buildbot_steam-relclient-win32-builder_steam_rel_client_win32@steam-relclient-win32-builder) |
| LegalCopyright | Copyright (C) 2007 |
| OriginalFilename | steam_api.dll |
| ProductName | Steam Client API |
| ProductVersion | 01.00.00.01 |
| Source Control ID | 6281886 |
| Translation | 0x0804 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
402,376 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x00064000 |
177,659 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x00090000 |
11,367,300 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.UPX0 |
0x00b68000 |
700,032 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.UPX1 |
0x00c13000 |
868,576 bytes | 868,864 bytes | 7.96 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
F2837283482F6FB7FF237CA57BD66F37 |
.reloc |
0x00ce8000 |
256 bytes | 512 bytes | 2.96 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
24C04BCC4080F33EF6EAC24A829A6B87 |
.rsrc |
0x00ce9000 |
1,578 bytes | 2,048 bytes | 3.37 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
E6404E4D9F0E19932E7A5EA6BBC0739F |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 1,072 字节 | |
| RT_MANIFEST | 1 | 346 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft 能够识别并消除 Trojan.Win32.Downloader.oa!s5，无需用户进一步干预。
下载反恶意软件按照以下步骤完全从系统中移除威胁
