| 文件名 | AndroidEmulatorEn.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.212.174 |
| 数据库版本 | 2025-04-05 12:00:47 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
ef1159cb9f26fd7308533a423c65ede3
|
|
| SHA1 |
ed002d46a58ed58ef8bbb8b1b4b453ba37524d79
|
|
| SHA256 |
b72325fe4c00e3fc530c95f45192f3d9659fe69c1f408453279e9c6f2d79e288
|
|
| SHA512 |
35645f28dbada62e60c47835439a302c8e38797f1a872f830f82d51139322af98c891692a441608ef906919fa12b8baee2dabcc32fefc31abbb11c55b0973b2c
|
|
| ImpHash |
91e264b7752a402e20bbbd5b425cc0ad
|
| 图标 |
哈希: ee362821f8db9bb96bbf8ed5d59b2822
模糊: 4b037942d6ce64ffee862f3b5322bb41 dHash: e0cc8e0f0fa6f8f0 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x007c0d55 |
| 编译时间 | 2021-10-01 07:10:58 |
| 校验和 | 0x0066fe55 (实际: 0x00676bc7) |
| 操作系统版本 | 5.1 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| PDB 路径 | E:\workp |
| 数字签名 | The expected hash does not match the digest in SpcInfo |
| 导入 |
3 库
ntdll, KERNEL32, WS2_32 |
| 导出 | 0 函数 |
| 资源 | 11 资源 |
| 节 | 13 节 |
| CompanyName | Tencent |
| FileDescription | Gameloop |
| FileVersion | 3.21.4638.80 |
| InternalName | AndroidEmulator |
| LegalCopyright | Copyright © 2020 Tencent. All Rights Reserved. |
| OriginalFilename | AndroidEmulator.exe |
| ProductName | Gameloop |
| ProductVersion | 3,21,4638,80 |
| Translation | 0x0409 0x04e4 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
1,912,267 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x001d4000 |
685,564 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x0027c000 |
143,164 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.gfids |
0x0029f000 |
92 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.tls |
0x002a0000 |
9 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rsrc |
0x002a1000 |
412,664 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.tvm0 |
0x00306000 |
196,608 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rsrc |
0x00336000 |
412,664 bytes | 412,672 bytes | 5.25 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
AE4D032626143F9D10A698168670ED63 |
.ace0 |
0x0039b000 |
670,811 bytes | 671,232 bytes | 7.31 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
67F8B22456BA522C6252185E04AF58AC |
.ace1 |
0x0043f000 |
250,824 bytes | 250,880 bytes | 5.57 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
C24F79EDC7C0225C1545115FB7CF7092 |
.ace2 |
0x0047d000 |
3,211,264 bytes | 3,208,704 bytes | 7.41 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
17C2AF228D64F62EB66C8E395C1925B4 |
.ace3 |
0x0078d000 |
2,165,302 bytes | 2,165,760 bytes | 7.13 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
CB61696A05FEB7CA8AB74DA5F59B5E48 |
.reloc |
0x0099e000 |
16,536 bytes | 16,896 bytes | 6.22 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
7C459FBCA350047B4A3EA43AB3E2BA6C |
3 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 8 | 410,464 字节 | |
| RT_GROUP_ICON | 1 | 118 字节 | |
| RT_VERSION | 1 | 780 字节 | |
| RT_MANIFEST | 1 | 651 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The expected hash does not match the digest in SpcInfo
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
