| 文件名 | node.dll |
| 文件类型 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.150.174 |
| 数据库版本 | 2023-11-30 15:01:14 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
7d1a861b6aa1f95df03ada1ae4d1eff5
|
|
| SHA1 |
4f08069fce4a95fb2752b61e1520320b77851044
|
|
| SHA256 |
86652089c198d821011a8efb5e8d2c38a0c937cf7a14aed5dcf745707318ab93
|
|
| SHA512 |
e35eb9bdbbb06b6e27e8963843abcc255ae2f2c1d3c79b0ffd1c7768b3a6813b398b32a37de9180ab5725cb554ddb4d9bac3a3ec23a5803dc279997bbd1ccca1
|
|
| ImpHash |
173ca90a4419091bb4ab45726543430c
|
| 映像基址 | 0x180000000 |
| 入口点 | 0x18075e144 |
| 编译时间 | 2023-01-11 18:49:39 |
| 校验和 | 0x00000000 (实际: 0x01013e58) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| PDB 路径 | E:\nw72_sdk_win64\node-webkit\src\outst\Release_x64\node.dll.pdb |
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 | 12 库 |
| 导出 | 5021 函数 |
| 资源 | 2 资源 |
| 节 | 12 节 |
| CompanyName | The NW.js Community |
| FileDescription | Node.js build for NW.js |
| FileVersion | 0.68.0 |
| InternalName | node_dll |
| LegalCopyright | Copyright 2018, The NW.js community and The Chromium Authors. All rights reserved. |
| OriginalFilename | node.dll |
| ProductName | nwjs |
| ProductVersion | 0.68.0 |
| CompanyShortName | nwjs.io |
| ProductShortName | nwjs |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
8,309,478 bytes | 8,309,760 bytes | 6.44 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
2D7949E0C40E44E0CE975A5E8691ED5F |
.rdata |
0x007ee000 |
8,026,572 bytes | 8,026,624 bytes | 5.59 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3358A737DD2115FEDA634072B955C64D |
.data |
0x00f96000 |
2,743,536 bytes | 47,104 bytes | 3.77 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
13CFC8C361CB89C7072851A1AE98A4E2 |
.pdata |
0x01234000 |
270,516 bytes | 270,848 bytes | 6.48 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
48D1512B8A5170ACB24AB218A709DD8F |
.00cfg |
0x01277000 |
40 bytes | 512 bytes | 0.43 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
6FF1771BED222AADF4F7995D04AD297D |
.gxfg |
0x01278000 |
61,008 bytes | 61,440 bytes | 5.30 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
578C15EAA18D86A7102852D4ACC142D7 |
.retplne |
0x01287000 |
92 bytes | 512 bytes | 0.85 (正常) |
0x00000000
|
8BA86516D84CEF220ECD4FF8550B6DF0 |
.tls |
0x01288000 |
25 bytes | 512 bytes | 0.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
B30464E69ECC4F2C756FA8FF158A38F1 |
.voltbl |
0x01289000 |
136 bytes | 512 bytes | 2.10 (正常) |
0x00000000
|
19E18ABB6EBB35F9E74D9EA32D9C5064 |
_RDATA |
0x0128a000 |
244 bytes | 512 bytes | 2.45 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
1E8B6D378F972965459D97E3A78C6362 |
.rsrc |
0x0128b000 |
1,496 bytes | 1,536 bytes | 4.05 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
726C04F63F79AA70E1C77628A36AF4BE |
.reloc |
0x0128c000 |
90,348 bytes | 90,624 bytes | 5.47 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
C018B8F3E7C76E533FADD1C178EA05D9 |
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 948 字节 | |
| RT_MANIFEST | 1 | 383 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
