| 文件名 | idafree77_windows.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
| 扫描器版本 | 1.0.217.174 |
| 数据库版本 | 2025-06-04 02:00:21 UTC |
我们的扫描器未检测到威胁
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
490d394cd6b5321e3275e6270b6f6615
|
|
| SHA1 |
1f815be20a119cc835e7678a32032ab130834d49
|
|
| SHA256 |
d0a3599b4fc7519973f023e63f732d0364c4f3316ba50af4bc6829dc1dd5d46c
|
|
| SHA512 |
f1f7220e31ca1b593092ade4121f469067e4a8fa57c8f161cf2a37bbcb9220592410c31be5cd451662ae4b8ed04e4bde4aac6fea726092a120e8f77b41ca36c5
|
|
| ImpHash |
f3de104ab04ca2d874306d1847be46db
|
| 图标 |
哈希: 48f015211f3eedcc20feb43a452c6b62
模糊: d0e7b0ad79aedb90e75318690bd64914 dHash: 87193d7cf8393332 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x004012a0 |
| 编译时间 | 2020-08-13 16:54:32 |
| 校验和 | 0x05988087 (实际: 0x05988087) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
|
| 数字签名 | Chain verification from CN=Hex-Rays SA, O=Hex-Rays SA, STREET=Rue Rennequin Sualem 34, L=Liège, 2.5.4.17=4000, C=BE (serial:2871503591114420024490367019365928228, sha1:f391128ee03f4b51a8442ab507d5744b8cf09e50) failed: The path could not be validated because the end-entity certificate expired 2023-11-03 23:59:59Z |
| 导入 | 12 库 |
| 导出 | 2 函数 |
| 资源 | 163 资源 |
| 节 | 11 节 |
| FileDescription | |
| OriginalFilename | setup.exe |
| CompanyName | Hex-Rays SA |
| LegalCopyright | Copyright Hex-Rays SA |
| FileVersion | 1.0.0.0 |
| ProductName | IDA Freeware and Hex-Rays Decompilers (x64) 7.7 |
| ProductVersion | 7.7 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
1,973,252 bytes | 1,973,760 bytes | 6.15 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_16BYTES
|
34052A9C5BB9175BA4D312F2B28EFCD5 |
.data |
0x001e3000 |
83,852 bytes | 83,968 bytes | 3.62 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES
|
0492010CB18BF5BAFA3CE13FF6AD1848 |
.rdata |
0x001f8000 |
273,152 bytes | 273,408 bytes | 5.84 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_32BYTES
|
E24261D4CFFB73A0D3CC3A1B3694488C |
.eh_fram |
0x0023b000 |
323,992 bytes | 324,096 bytes | 5.06 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
6C615AF355BEC853D9701CE4A60DA66D |
.bss |
0x0028b000 |
7,112 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_32BYTES
|
D41D8CD98F00B204E9800998ECF8427E |
.edata |
0x0028d000 |
110 bytes | 512 bytes | 1.35 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
3E86108DC16870FA1448524FE6777585 |
.idata |
0x0028e000 |
15,468 bytes | 15,872 bytes | 5.57 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
C9610AA7B4A923EAD87944AC3FBC3AF6 |
.CRT |
0x00292000 |
24 bytes | 512 bytes | 0.11 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
8F4EE44F67E940E06D9ABAA0E9ADCDE1 |
.tls |
0x00293000 |
32 bytes | 512 bytes | 0.23 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
8672D88A3CF8BBFEE7A7A9E0D9F19175 |
.rsrc |
0x00294000 |
174,736 bytes | 175,104 bytes | 1.10 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE|IMAGE_SCN_ALIGN_4BYTES
|
BC137D402527C501CF064C2BB45F7D60 |
.reloc |
0x002bf000 |
80,320 bytes | 80,384 bytes | 6.62 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ|IMAGE_SCN_ALIGN_4BYTES
|
F10B72BAD977D5E6441EDEE7A7440279 |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_CURSOR | 78 | 24,024 字节 | |
| RT_BITMAP | 1 | 832 字节 | |
| RT_ICON | 2 | 1,040 字节 | |
| RT_DIALOG | 1 | 570 字节 | |
| RT_GROUP_CURSOR | 78 | 1,560 字节 | |
| RT_GROUP_ICON | 1 | 34 字节 | |
| RT_VERSION | 1 | 680 字节 | |
| RT_MANIFEST | 1 | 1,904 字节 |
| 产品 | IDA Freeware and Hex-Rays Decompilers (x64) 7.7 |
| 文件版本 | 1.0.0.0 |
| 原始名称 | setup.exe |
| 验证状态 | A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file. |
| 签名者 | Hex-Rays SA; Sectigo RSA Code Signing CA; USERTrust RSA Certification Authority; Sectigo (AAA) |
| 版权 | Copyright Hex-Rays SA |
33 00 00 01 DF 6B F0 2E 92 A7 4A B4 D0 00 00 00 00 01 DF61 0E 90 D2 00 00 00 00 00 0333 00 00 01 49 80 08 4A BB 09 A0 33 0B 00 00 00 00 01 4961 09 81 2A 00 00 00 00 00 0233 00 00 01 E2 F1 7D 92 02 0E 49 F8 7F 00 00 00 00 01 E202 29 08 0E C1 76 3E A2 D7 63 1E 84 B8 BF 8D 240139 72 44 3A F9 22 B7 51 D7 D3 6C 10 DD 31 35 951D A2 48 30 6F 9B 26 18 D0 82 E0 96 7D 33 D3 6A✓ 此文件已进行数字签名，证书链已验证。
Chain verification from CN=Hex-Rays SA, O=Hex-Rays SA, STREET=Rue Rennequin Sualem 34, L=Liège, 2.5.4.17=4000, C=BE (serial:2871503591114420024490367019365928228, sha1:f391128ee03f4b51a8442ab507d5744b8cf09e50) failed: The path could not be validated because the end-entity certificate expired 2023-11-03 23:59:59Z
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断：
下载反恶意软件此文件看起来是干净的，但定期的安全维护很重要
