| 文件名 | FCore.dll |
| 文件类型 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.215.174 |
| 数据库版本 | 2025-04-23 01:03:30 UTC |
恶意软件家族: Packed
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
8b6803ac827c7af69130f3379a669ca2
|
|
| SHA1 |
87807510e0b74480cb5ccec5252f3874d211d428
|
|
| SHA256 |
9f02ede530a9abc779599937510921c4e43de7569080dc0570079203a1dc3b09
|
|
| SHA512 |
642d50f0aee4a160be8279a1027d8f427776f760200ccd5f37dccd94cf09932b0e3a4ece721b03332519a6d8c67736e910c5374250d9fb522bbeddaa77a81c04
|
|
| ImpHash |
9ab1dbb59ca6a54c53955dfb6bff9aa0
|
| 图标 |
哈希: a4c09c4859e5ebf0c25d5741e4dcf096
模糊: f3a8cd694b22d7e9f267a395d00d9ba9 dHash: c69a727219ccb2b2 |
| 映像基址 | 0x180000000 |
| 入口点 | 0x1807f30b0 |
| 编译时间 | 2023-12-20 11:03:10 |
| 校验和 | 0x004f5d5d (实际: 0x004f5d5d) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 | 24 库 |
| 导出 | 1268 函数 |
| 资源 | 12 资源 |
| 节 | 13 节 |
| CompanyName | Wondershare |
| FileDescription | FCore |
| FileVersion | 13, 0, 60, 5095 |
| InternalName | FCore |
| LegalCopyright | Copyright (c) 2020-2023 Wondershare. All rights reserved. |
| OriginalFilename | FCore |
| ProductName | FCore |
| ProductVersion | 13.0.60.5095 |
| Translation | 0x0804 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
|
0x00001000 |
1,159,182 bytes | 375,808 bytes | 7.98 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
202006BA65CAEF55B29F562877A9E948 |
|
0x0011d000 |
630,852 bytes | 175,104 bytes | 7.92 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
14F2509819F2B9A9B3BBD47FF0B9DA86 |
|
0x001b8000 |
31,936 bytes | 6,144 bytes | 7.88 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D79B2CB7A8415A01F3D7E31D17DFA758 |
|
0x001c0000 |
71,520 bytes | 45,056 bytes | 7.69 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
BDA485A3C382A4BA61A940E9415928EC |
|
0x001d2000 |
196,320 bytes | 54,784 bytes | 7.96 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3CAF42143CBD1D691835E166A0A101CD |
|
0x00202000 |
5,476 bytes | 2,560 bytes | 7.60 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
30F249E3DE7B86EF7E332710CDA3BDF4 |
.edata |
0x00204000 |
75,776 bytes | 75,776 bytes | 5.83 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
530E173865A8FA47B0DE20D4356F862E |
.idata |
0x00217000 |
4,096 bytes | 2,560 bytes | 3.89 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BD9357908913265065051AB461629767 |
.tls |
0x00218000 |
4,096 bytes | 512 bytes | 0.26 (正常) |
IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
C0A4FE2EC2FD0A2D2AD76AA659DEB1D5 |
.rsrc |
0x00219000 |
196,608 bytes | 196,608 bytes | 5.95 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F8FA3C8CCD3607C14630E352F2B3200F |
.themida |
0x00249000 |
5,939,200 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.boot |
0x007f3000 |
4,212,224 bytes | 4,212,224 bytes | 7.94 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
DC49ACF975F52D0860DB5307A7AA38B0 |
.reloc |
0x00bf8000 |
4,096 bytes | 16 bytes | 2.47 (正常) |
IMAGE_SCN_MEM_READ
|
236057039C7649461EFDC007D12D5192 |
7 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 9 | 194,325 字节 | |
| RT_GROUP_ICON | 1 | 132 字节 | |
| RT_VERSION | 1 | 748 字节 | |
| RT_MANIFEST | 1 | 381 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
