| 文件名 | Oppai.Orbs.Enhanced.V1.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
| 扫描器版本 | 1.0.215.174 |
| 数据库版本 | 2025-04-30 21:00:21 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
476e4dfc16a80337f2f3a9dfc40d84be
|
|
| SHA1 |
a9ce8b1a86b9d0c67257b7d11a54123cc30c6a91
|
|
| SHA256 |
94de354c532a76afc67fa2c54b3aff004603077d2ca7cd881b82947ab67f2361
|
|
| SHA512 |
cf8598ca456ed4c31245b022bf85043297a6f33abcb696a5538bc37c6477606444c0093868737133ba50fec4830eb06e833326d745684f8612e6ce77254cecbd
|
|
| ImpHash |
76c0ae1004cf0804ce376943454d57bd
|
| 图标 |
哈希: eff608d908cfe2a89f945036668e9780
模糊: 8de607744ca29013c1df76cfeeb92aeb dHash: f0cca2d492aaccf0 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x004014b0 |
| 编译时间 | 1970-01-01 00:00:00 |
| 校验和 | 0x046e05e3 (实际: 0x0475f09c) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 | 22 库 |
| 导出 | 18 函数 |
| 资源 | 9 资源 |
| 节 | 12 节 |
| CompanyName | inksgirls |
| FileDescription | Godot Engine |
| FileVersion | 4.1.3 |
| ProductName | Oppai Oppai Orbs Enhanced V1 |
| Licence | MIT |
| LegalCopyright | Copyright (c) 2007-2023 Juan Linietsky, Ariel Manzur and contributors |
| Info | https://godotengine.org |
| ProductVersion | 4.1.3.stable.official |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
60,159,172 bytes | 60,159,488 bytes | 6.43 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
26485A0CA92B0DB0C7D5735573EA9D19 |
.data |
0x03961000 |
20,272 bytes | 20,480 bytes | 2.32 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
2A2DC843BBCF7BEC59E9437CAAFF158F |
.rdata |
0x03966000 |
6,434,656 bytes | 6,434,816 bytes | 6.49 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
A14D0F17EAF65F9F5B80793471395704 |
pck |
0x03f89000 |
8 bytes | 641,808 bytes | 7.15 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3C69451D12FF75FF4FE23321F1D7B6B5 |
.eh_fram |
0x03f8a000 |
5,469,324 bytes | 5,469,696 bytes | 5.61 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
502C907D3DB08C5D5DB7DECFE3CC4078 |
.bss |
0x044c2000 |
993,768 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.edata |
0x045b5000 |
1,094 bytes | 1,536 bytes | 4.49 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3F33D43A805065E529AF700EF3C68C9B |
.idata |
0x045b6000 |
14,772 bytes | 14,848 bytes | 5.69 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
FB40AE67C7EC84F9AB236FD59BB18EB5 |
.CRT |
0x045ba000 |
56 bytes | 512 bytes | 0.40 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
65C64ECF6632046E327305CE07922E82 |
.tls |
0x045bb000 |
8 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x045bc000 |
21,868 bytes | 22,016 bytes | 7.79 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
FE830BAC1B6B93B62E9D31F6411EF83E |
.reloc |
0x045c2000 |
2,030,976 bytes | 2,031,104 bytes | 6.80 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
AC510BEE547AF0F669CE65637DC5D399 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 6 | 20,280 字节 | |
| RT_GROUP_ICON | 2 | 180 字节 | |
| RT_VERSION | 1 | 848 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
