文件名 | AUTORUN.exe |
文件类型 |
Win32 EXE
|
魔术字节 | PE32 executable (GUI) Intel 80386, for MS Windows |
SSDEEP 哈希 |
49152:rJGrKyAHkzmlESIu27CYpC3Rx0ekKT5G9t:rJG51VUhx0ekdt
|
扫描器版本 | 1.0.217.174 |
数据库版本 | 2025-05-31 15:00:18 UTC |
被 25 个安全引擎检测到 - 需要谨慎
哈希类型 | 值 | 操作 |
---|---|---|
MD5 |
475720f3fba862871bdd45693fdeaef9
|
|
SHA1 |
a1c7289e4e9c652767ef645d4486d78a5d99f3b4
|
|
SHA256 |
894021e624c62ec0da957f09469f86110ffd277e6dfc0375a086d2da54b1b868
|
|
SHA512 |
83fbd3676330bb39bb636afa21acaae29604a55a83e275311c21fcae9dedd1aabeb3029013215de54f62845aae971e4c1c2ee88839a83c650b419f69c5b2c25e
|
|
ImpHash |
6035262af4df8445cf01dd4e4bac4223
|
图标 |
哈希: d51b664fa758203d93401facc8dfa839
模糊: d2c36c72200045223d255ff5a168242c dHash: d4f0b298b698b2b2 |
映像基址 | 0x00400000 |
入口点 | 0x00622d58 |
编译时间 | 2024-10-14 22:16:29 |
校验和 | 0x00000000 (实际: 0x0044c852) |
操作系统版本 | 6.0 |
PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
数字签名 | No valid SignedData structure was found. |
导入 | 12 库 |
导出 | 3 函数 |
资源 | 148 资源 |
节 | 11 节 |
CompanyName | repack.ddns.net |
FileVersion | 1.0.0.0 |
LegalCopyright | KpoJIuK |
ProductVersion | 1.0.0.0 |
ProgramID | com.embarcadero.AUTORUN |
FileDescription | Adobe Installer Autorun |
ProductName | Adobe Installer Autorun |
Translation | 0x0409 0x04e4 |
名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
2,225,492 bytes | 2,225,664 bytes | 6.51 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
C91975C77E6131181264AAA48A4BAA9F |
.itext |
0x00221000 |
7,620 bytes | 7,680 bytes | 6.37 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
801912EDE568223B4C314EACA3075B25 |
.data |
0x00223000 |
37,304 bytes | 37,376 bytes | 6.14 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
B0B571487C3096EE13AFAF5512A8C655 |
.bss |
0x0022d000 |
28,916 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.idata |
0x00235000 |
12,930 bytes | 13,312 bytes | 4.99 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
DDDBE48EA9864525C4327FBED4A94700 |
.didata |
0x00239000 |
3,168 bytes | 3,584 bytes | 4.05 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
0EE18D5DC48B1281BAF80A6AC7138A58 |
.edata |
0x0023a000 |
153 bytes | 512 bytes | 1.91 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D465B5658187864D6CCF37AAEBE8DF71 |
.tls |
0x0023b000 |
84 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x0023c000 |
93 bytes | 512 bytes | 1.38 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
E9BDC4CCB8BFF4B9E0A21CB8C9C0421B |
.reloc |
0x0023d000 |
195,320 bytes | 195,584 bytes | 6.71 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
68AB16ACE4EC4A29E4509EE52CA8669F |
.rsrc |
0x0026d000 |
1,962,496 bytes | 1,962,496 bytes | 4.94 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F737663127F7B1A7D44CD25456CFB6FC |
2 检测到较高熵(≥6.5)的节 - 可能存在压缩
资源类型 | 数量 | 总大小 | 百分比 |
---|---|---|---|
RT_CURSOR | 7 | 2,156 字节 | |
RT_BITMAP | 42 | 1,586,024 字节 | |
RT_ICON | 5 | 96,975 字节 | |
RT_STRING | 28 | 25,984 字节 | |
RT_RCDATA | 56 | 237,857 字节 | |
RT_GROUP_CURSOR | 7 | 140 字节 | |
RT_GROUP_ICON | 1 | 76 字节 | |
RT_VERSION | 1 | 680 字节 | |
RT_MANIFEST | 1 | 1,812 字节 |
产品 | Adobe Installer Autorun |
描述 | Adobe Installer Autorun |
文件版本 | 1.0.0.0 |
版权 | KpoJIuK |
✓ 此文件已进行数字签名,证书链已验证。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断:
下载反恶意软件此文件看起来是干净的,但定期的安全维护很重要