| 文件名 | ijl15.dll |
| 文件类型 |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.172.174 |
| 数据库版本 | 2024-04-22 13:00:29 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
3461b060712a955755396859dfc05dc7
|
|
| SHA1 |
94512d2ceacde6a8635f4a46aef199e49137322c
|
|
| SHA256 |
972a32f4c1dae40bac47090433fc21f1bcfdbc00cb65630933be268edaf15104
|
|
| SHA512 |
0cfb4b117f7c9071f9ea28d9122b4a49c596921b60d7b9013e0e6538be420b75669de34d7d5772a083ea40f4882a19c595514d98be2c5567cc68cfaea7f715ce
|
|
| ImpHash |
b0daf0844af98808e42ac16c648a6220
|
| 映像基址 | 0x10000000 |
| 入口点 | 0x12145627 |
| 编译时间 | 2024-04-11 13:36:32 |
| 校验和 | 0x01257d8f (实际: 0x01257d8f) |
| 操作系统版本 | 5.1 |
| PEiD 签名 |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| 数字签名 | OK |
| 导入 | 14 库 |
| 导出 | 6 函数 |
| 资源 | 2 资源 |
| 节 | 13 节 |
| CompanyName | YutoShield |
| FileDescription | 為買方客製化軟體，請勿用於非法用途，若有法律責任一律與賣方無關 |
| FileVersion | 6.6.6.6 |
| InternalName | ijl15.dll |
| LegalCopyright | YutoShield |
| OriginalFilename | ijl15.dll |
| ProductName | YutoShield 客製化軟體 |
| ProductVersion | 6.6.6.6 |
| Translation | 0x0404 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
8,715,340 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x00851000 |
7,940,506 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x00fe4000 |
191,336 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.qtmetad |
0x01013000 |
2,868 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data1 |
0x01014000 |
2,272 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.detourc |
0x01015000 |
4,496 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.detourd |
0x01017000 |
12 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
_RDATA |
0x01018000 |
548 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.C:Y |
0x01019000 |
8,858,652 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.;X] |
0x0188c000 |
3,024 bytes | 3,072 bytes | 0.33 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BD3B75888D64D170770E754EE3CE1F3F |
.%'$ |
0x0188d000 |
19,166,976 bytes | 19,167,232 bytes | 7.99 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
F42742D24D27249A4A2E6D9DB19108E3 |
.reloc |
0x02ad5000 |
1,472 bytes | 1,536 bytes | 4.56 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
FBDF75355674C11C559C520F6A753909 |
.rsrc |
0x02ad6000 |
1,261 bytes | 1,536 bytes | 3.97 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
6A118504BD1D4A287F736AC6D66E86A2 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 720 字节 | |
| RT_MANIFEST | 1 | 381 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
OK
按照以下步骤完全从系统中移除威胁
