| 文件名 | 95dc77fc3ee184cdc7c1409fbee8bdf41e2c21e6e720362d3dea6540a7f39d41.exe |
| 文件类型 |
PE32+ executable (console) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.213.174 |
| 数据库版本 | 2025-04-11 07:00:22 UTC |
我们的扫描器未检测到威胁
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
f9c1638268410b83174177f49fd7a807
|
|
| SHA1 |
430328c8887ebaca13fa9473fea5c7fac02fed94
|
|
| SHA256 |
95dc77fc3ee184cdc7c1409fbee8bdf41e2c21e6e720362d3dea6540a7f39d41
|
|
| SHA512 |
a5cfc70d30fd927464c125431bac13e189e03ed2733e05a92f7f48170f36ed46c551b87f783d585cace0e832dddc862e8c2d4fdd56381aa050aaa6adaae3b8cd
|
|
| ImpHash |
4f2f006e2ecf7172ad368f8289dc96c1
|
| 映像基址 | 0x00400000 |
| 入口点 | 0x00467e40 |
| 编译时间 | 1970-01-01 00:00:00 |
| 校验和 | 0x00000000 (实际: 0x006b35cb) |
| 操作系统版本 | 6.1 |
| PEiD 签名 |
PE32+ executable (console) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 |
1 库
kernel32 |
| 导出 | 0 函数 |
| 资源 | 0 资源 |
| 节 | 15 节 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
2,221,220 bytes | 2,221,568 bytes | 6.21 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
B170CE67E0A780E72AFA59FDC8D38A6E |
.rdata |
0x00220000 |
2,333,064 bytes | 2,333,184 bytes | 5.68 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BA11D56E83CC1E4136D66AE3C99A754C |
.data |
0x0045a000 |
579,632 bytes | 203,264 bytes | 5.36 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
13086C8BD972AB8E989B549143E7A948 |
.pdata |
0x004e8000 |
51,000 bytes | 51,200 bytes | 5.47 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
6F4BDC8E12E4A3E01D524EA853359B4E |
.xdata |
0x004f5000 |
168 bytes | 512 bytes | 1.63 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
2A5152FFC3A52CA1D276ACD572C41B9A |
/4 |
0x004f6000 |
297 bytes | 512 bytes | 5.08 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
17F62672C8506464AE13ECCC2EB6CB94 |
/19 |
0x004f7000 |
395,445 bytes | 395,776 bytes | 7.99 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
CDE7B09D0D511E151A35ED2ABCD5245A |
/32 |
0x00558000 |
83,511 bytes | 83,968 bytes | 7.94 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
8ACDD0D7D41201FE2AB9D24C55B294FB |
/46 |
0x0056d000 |
67 bytes | 512 bytes | 1.12 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
3B5767EB1671F98E5756A4879606EEAE |
/65 |
0x0056e000 |
696,418 bytes | 696,832 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
CCF6091D39D98820B47B2844CE0EB9A2 |
/78 |
0x00619000 |
516,112 bytes | 516,608 bytes | 7.99 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
C7BB1D92864095174E670FFF93D60506 |
/90 |
0x00698000 |
146,428 bytes | 146,432 bytes | 7.81 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_1BYTES
|
F50DD6DF9796E42FA98D94EA80B8C5F7 |
.idata |
0x006bc000 |
1,302 bytes | 1,536 bytes | 3.91 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
3D6241A175779A148101F9C3926D6F62 |
.reloc |
0x006bd000 |
39,638 bytes | 39,936 bytes | 5.43 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
9A9F20FD2C2B45693F8ADB6C5104E0D7 |
.symtab |
0x006c7000 |
310,622 bytes | 310,784 bytes | 5.26 (正常) |
IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
8BB83075B4103B2BF7A547FC7F11C84C |
5 检测到高熵（≥7.5）的节 - 可能存在打包/加密
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断：
下载反恶意软件此文件看起来是干净的，但定期的安全维护很重要
