| 文件名 | gbpsv.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.143.174 |
| 数据库版本 | 2023-10-18 00:02:19 UTC |
我们的扫描器未检测到威胁
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
1aa4c26b7f5dc9b39cfd196934cb8a79
|
|
| SHA1 |
92ad8aa0888f1ad4d71fd6bc7b6434be3cbb2af3
|
|
| SHA256 |
71eb0797db8de8ff5a9fe84b5568cd728b4b089537e4e1b5fd55b42de8b3fa07
|
|
| SHA512 |
54f48d02d7597c2f535b05580852c8869706227b215acc8a8f291d6b0596fbb3841810cccd0cbeab166957d8b31fa0c09bd945937acc3f587444853bb238c30b
|
|
| ImpHash |
d379682e54286be7f3bcb6b807919bfd
|
| 图标 |
哈希: 5aa6ec19aab9441ad7fdf7e44fcc7711
模糊: 3345b047b0fcc0f16cce008d3fb58dc7 dHash: c8c0f0f0f0c64860 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x0053feaa |
| 编译时间 | 2015-11-16 10:32:32 |
| 校验和 | 0x0009b1e7 (实际: 0x0009b1e7) |
| 操作系统版本 | 5.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| PDB 路径 | F:\buildagent\workspace\root\GbPlugin\RB\GbpSv\src\main\GbpSv\GbpSv.pdb |
| 数字签名 | OK |
| 导入 |
6 库
KERNEL32, USER32, ADVAPI32, ole32, OLEAUT32, FLTLIB |
| 导出 | 0 函数 |
| 资源 | 4 资源 |
| 节 | 9 节 |
| Thawte Timestamping CA | Symantec Corporation (US) |
| Symantec Time Stamping Services CA - G2 | Symantec Corporation (US) |
| VeriSign Class 3 Code Signing 2010 CA | GAS INFORMATICA LTDA (BR) |
| VeriSign Class 3 Public Primary Certification Authority - G5 | VeriSign, Inc. (US) |
| Comments | |
| CompanyName | GAS Tecnologia |
| FileDescription | G-Buster Browser Defense - Service |
| FileVersion | 3.9.3.0 |
| InternalName | GbpSv |
| LegalCopyright | Copyright © 2003-2015, ® GAS Tecnologia |
| LegalTrademarks | GbpSv |
| OriginalFilename | GbpSv.exe |
| PrivateBuild | |
| ProductName | Gbp Service |
| ProductVersion | 3.9.3.0 |
| SpecialBuild | |
| Translation | 0x0416 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
706,422 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
CODE |
0x000ae000 |
134,560 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x000cf000 |
283,448 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x00115000 |
59,644 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
DATA |
0x00124000 |
5,344 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
BSS |
0x00126000 |
1,889 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.gas0 |
0x00127000 |
12,070 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.gas1 |
0x0012a000 |
578,172 bytes | 578,560 bytes | 7.93 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
1268DD01FA75575B2B9D4714C586675F |
.rsrc |
0x001b8000 |
3,810 bytes | 4,096 bytes | 3.68 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
93F26FE46DC4A0CAD0DA8325B4FABC5D |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 1 | 2,216 字节 | |
| RT_GROUP_ICON | 1 | 20 字节 | |
| RT_VERSION | 1 | 924 字节 | |
| RT_MANIFEST | 1 | 346 字节 |
| 主题 |
Symantec Time Stamping Services CA - G2 Symantec Corporation US |
| 颁发者 | Thawte Timestamping CA |
| 序列号 | 168250781398245547403531165097821404219 |
| 主题 |
Symantec Time Stamping Services Signer - G4 Symantec Corporation US |
| 颁发者 | Symantec Time Stamping Services CA - G2 |
| 序列号 | 19688950797630895426199952712430983760 |
| 主题 |
GAS INFORMATICA LTDA GAS INFORMATICA LTDA BR |
| 颁发者 | VeriSign Class 3 Code Signing 2010 CA |
| 序列号 | 64278746113979638716529943560060036794 |
| 主题 |
VeriSign Class 3 Code Signing 2010 CA VeriSign, Inc. US |
| 颁发者 | VeriSign Class 3 Public Primary Certification Authority - G5 |
| 序列号 | 109001353806506068745144901449045193671 |
OK
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断：
下载反恶意软件此文件看起来是干净的，但定期的安全维护很重要
