| 文件名 | steam_api.dll |
| 文件类型 |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.219.174 |
| 数据库版本 | 2025-06-27 02:00:21 UTC |
恶意软件家族: GameHack
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
8dffb5d21d36837bdc649948345d2e85
|
|
| SHA1 |
95e811d7e9505683c7c4ec32f3d9de016de85282
|
|
| SHA256 |
b18031981e2d0ae0d8ce9e3ef619231ebcedc14164238d666f89535b9e3b6633
|
|
| SHA512 |
91459cbeca4e71bccab196dd559e32aeaa5cd1f55321dd74ee43ea3f2c358872902e30f0c54940ddddf08331e42731f841e2073f133a536b50a2c2436bdf0d5a
|
|
| ImpHash |
42cec6d0d0ad86f69e03f9284673b86b
|
| 映像基址 | 0x10000000 |
| 入口点 | 0x105d77bc |
| 编译时间 | 2020-02-11 16:45:46 |
| 校验和 | 0x00529348 (实际: 0x00529348) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| 数字签名 | Chain verification from CN=OnlineFix, OU=OnlineFix, O=OnlineFix, L=OnlineFix, ST=OnlineFix, [email protected], C=US (serial:215554013148541718805945690916878909483074271651, sha1:365391d020518b1624c848522ddee7eb2c91dd93) failed: Unable to build a validation path for the certificate "Common Name: OnlineFix, Organizational Unit: OnlineFix, Organization: OnlineFix, Locality: OnlineFix, State/Province: OnlineFix, Email Address: [email protected], Country: US" - no issuer matching "Common Name: Ascertia Root CA 2, Organization: Ascertia, Country: GB" was found |
| 导入 |
7 库
KERNEL32, USER32, SHELL32, WS2_32, WLDAP32, ADVAPI32, WTSAPI32 |
| 导出 | 856 函数 |
| 资源 | 1 资源 |
| 节 | 7 节 |
| CompanyName | Online-Fix |
| FileDescription | Steam Wrapper |
| FileVersion | 1.1.1.0 |
| InternalName | steam_api.dll |
| LegalCopyright | Copyright (C) 2020, iArtorias |
| ProductName | Steam Wrapper |
| ProductVersion | 1.1.1.0 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
1,776,934 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x001b3000 |
542,258 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x00238000 |
77,676 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.of0 |
0x0024b000 |
2,597,601 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.of1 |
0x004c6000 |
5,368,208 bytes | 5,368,320 bytes | 7.94 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
999150F662B8146DA884180B2BE3CCC9 |
.reloc |
0x009e5000 |
1,500 bytes | 1,536 bytes | 4.27 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
6745D1305552F08E7FC0CEDCCF3D2530 |
.rsrc |
0x009e6000 |
748 bytes | 1,024 bytes | 2.54 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
5EE65AE3203605B2EA92CD859E90C3C9 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 660 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
Chain verification from CN=OnlineFix, OU=OnlineFix, O=OnlineFix, L=OnlineFix, ST=OnlineFix, [email protected], C=US (serial:215554013148541718805945690916878909483074271651, sha1:365391d020518b1624c848522ddee7eb2c91dd93) failed: Unable to build a validation path for the certificate "Common Name: OnlineFix, Organizational Unit: OnlineFix, Organization: OnlineFix, Locality: OnlineFix, State/Province: OnlineFix, Email Address: [email protected], Country: US" - no issuer matching "Common Name: Ascertia Root CA 2, Organization: Ascertia, Country: GB" was found
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
