| 文件名 | Setup.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.153.174 |
| 数据库版本 | 2024-01-05 10:02:13 UTC |
恶意软件家族: Gen
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
e9b21f1cad040a2b17e1c3d2b9f63629
|
|
| SHA1 |
29309163c70e8c950f57e2460e6313e171b03f98
|
|
| SHA256 |
78163b15cd8a173f3edb0ffcf12487be2856134b771b06547e9c39e0b796e1b5
|
|
| SHA512 |
f9f54322d4d1adf95c979137cab615d6b4341af4b90371b9ced4bd415fcb9b61c34bd337cb56afb78882dc9cd2f34edae2f9005be209daed6bf911a1c3d2490a
|
|
| ImpHash |
a0d4c63b03cd414e1b0345f8f28d0d82
|
| 图标 |
哈希: 52af34b99496814ac3878c0114fa0f53
模糊: 1cccd0a4599f8afccf9c65a9b53bce0b dHash: 61ccccf4d4cce869 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x004772c4 |
| 编译时间 | 2020-08-26 12:52:19 |
| 校验和 | 0x00116784 (实际: 0x00116784) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| PDB 路径 | D:\Mes Documents\Visual Studio 2019\Projects\SetupAQ\Win32\Release\SetupAQ.pdb |
| 数字签名 | OK |
| 导入 | 14 库 |
| 导出 | 23 函数 |
| 资源 | 24 资源 |
| 节 | 5 节 |
| VeriSign Class 3 Public Primary Certification Authority - G5 | Symantec Corporation (US) |
| Symantec Class 3 Extended Validation Code Signing CA - G2 | AVANQUEST SOFTWARE S.A.S (FR) |
| Comments | Expert PDF |
| CompanyName | Avanquest Software |
| FileDescription | Expert PDF |
| FileVersion | 1.0.0.4 |
| InternalName | DemoTrial |
| LegalCopyright | Copyright (C) Avanquest Software 2020 |
| OriginalFilename | Setup.exe |
| ProductName | Expert PDF |
| ProductVersion | 14, 0, 0, 0 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
802,226 bytes | 802,304 bytes | 6.59 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
7E41DAC9AA94793852FECA8B77C6EF02 |
.rdata |
0x000c5000 |
216,116 bytes | 216,576 bytes | 5.75 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
317F780D78ECA12E055F7BB1F0D6D9A2 |
.data |
0x000fa000 |
147,816 bytes | 8,192 bytes | 4.27 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
FB2A4D8AFFE3585FAB3433EEFCADAE7D |
.rsrc |
0x0011f000 |
34,519 bytes | 34,816 bytes | 2.89 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
EB5845F91BEE385A496B23C68CF799A4 |
.reloc |
0x00128000 |
35,556 bytes | 35,840 bytes | 6.73 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
1FC1A21B8BA209DDA2DA897730EE6073 |
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 9 | 25,064 字节 | |
| RT_DIALOG | 8 | 4,500 字节 | |
| RT_STRING | 4 | 1,248 字节 | |
| RT_GROUP_ICON | 1 | 132 字节 | |
| RT_VERSION | 1 | 792 字节 | |
| RT_MANIFEST | 1 | 1,467 字节 |
| 主题 |
Symantec Class 3 Extended Validation Code Signing CA - G2 Symantec Corporation US |
| 颁发者 | VeriSign Class 3 Public Primary Certification Authority - G5 |
| 序列号 | 33366729853141030383580131297301004105 |
| 主题 |
AVANQUEST SOFTWARE S.A.S AVANQUEST SOFTWARE S.A.S FR |
| 颁发者 | Symantec Class 3 Extended Validation Code Signing CA - G2 |
| 序列号 | 26133044852551606802531802670043882233 |
OK
按照以下步骤完全从系统中移除威胁
