| 文件名 | libZov.dll |
| 文件类型 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.222.174 |
| 数据库版本 | 2025-08-01 06:00:19 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
ef14fc2201596e1a0f97421ae31c306f
|
|
| SHA1 |
8daf27003416437c74eda4a9d6a27fbc84b774db
|
|
| SHA256 |
90c5f8d27d0b49780013fc236229833ad4772bd69d6d602ef4d5fddf3c49a794
|
|
| SHA512 |
89a809e709c497ab0fc9a6ccef694e90b04c164f8db303ae10ef73bd369f8ffee7ef182a7676ba7486a63fccf7f06b1607c4c8d0c1c909d357ec5cd9a1837e4f
|
|
| ImpHash |
52a64e5c864db62830509d2d8a33c234
|
| 映像基址 | 0x180000000 |
| 入口点 | 0x180292c78 |
| 编译时间 | 2025-07-31 20:03:11 |
| 校验和 | 0x0045361f (实际: 0x0045361f) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 数字签名 | An error occurred while validating the countersignature: Chain verification from [email protected], CN=viper, O=take2games, L=San Francisco, ST=California, C=US (serial:1000, sha1:20ae9df7716c2b66800d978aa57219f2db429ae7) failed: The X.509 certificate provided is self-signed - "Email Address: [email protected], Common Name: viper, Organization: take2games, Locality: San Francisco, State/Province: California, Country: US" |
| 导入 | 14 库 |
| 导出 | 6 函数 |
| 资源 | 1 资源 |
| 节 | 7 节 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
3,055,084 bytes | 3,055,104 bytes | 6.46 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
7EC135B28AAD656E8B84C626908BEAAC |
.rdata |
0x002eb000 |
1,234,784 bytes | 1,234,944 bytes | 6.51 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
ECAE480754E296B95968D26CE1483AE6 |
.data |
0x00419000 |
79,428 bytes | 52,736 bytes | 4.85 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
3D78C9386B155E9019FB5D7ABC511D96 |
.pdata |
0x0042d000 |
130,416 bytes | 130,560 bytes | 6.33 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BEDA04C1AA0E9E0050407F8EA020BC82 |
.fptable |
0x0044d000 |
256 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x0044e000 |
480 bytes | 512 bytes | 4.72 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
49D329334EA941CBAB98110B315924B9 |
.reloc |
0x0044f000 |
19,768 bytes | 19,968 bytes | 5.45 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
7C39B0F071F6697F1548C6110FCB4D04 |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_MANIFEST | 1 | 381 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
An error occurred while validating the countersignature: Chain verification from [email protected], CN=viper, O=take2games, L=San Francisco, ST=California, C=US (serial:1000, sha1:20ae9df7716c2b66800d978aa57219f2db429ae7) failed: The X.509 certificate provided is self-signed - "Email Address: [email protected], Common Name: viper, Organization: take2games, Locality: San Francisco, State/Province: California, Country: US"
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
