文件名 | secretlove_chs.exe |
文件类型 |
Win32 EXE
|
魔术字节 | PE32 executable (GUI) Intel 80386, for MS Windows |
SSDEEP 哈希 |
49152:SOEbmBpQWxIDLRLHAl+uKZMhwSCCO0tyuGY:TEbm4WxIDLRLHn8QR0T
|
扫描器版本 | 1.0.215.174 |
数据库版本 | 2025-04-27 22:00:21 UTC |
被 39 个安全引擎检测到 - 需要谨慎
哈希类型 | 值 | 操作 |
---|---|---|
MD5 |
f422094b733bb924276e9ebf5040de53
|
|
SHA1 |
88b22cee3c2c75b335dff2ecde395b56b4e326b8
|
|
SHA256 |
d747d538d60f5e3876f6210c5883218e3c02397567b369b68f608e1fb3dbb40e
|
|
SHA512 |
c67b060cbdd5b741ef47a8e27ef88c868dd56c7f167b4e02938528eca7aa13a8464c9bd8311ae53b121c49e37128095e8f40ad679afdecbacf06e332f0b15ee6
|
|
ImpHash |
b462095fea3219e285e54ac0547eead6
|
图标 |
哈希: 6b4fa3cb70247f967e9d6afbfee79320
模糊: 0979c9e87b2815fdbcb68d28b105c7ee dHash: f2f6e6fa7b2939b2 |
映像基址 | 0x00400000 |
入口点 | 0x00427d32 |
编译时间 | 2024-03-26 02:29:29 |
校验和 | 0x00000000 (实际: 0x001ef379) |
操作系统版本 | 6.0 |
PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
数字签名 | No valid SignedData structure was found. |
导入 |
8 库
kernel32, user32, advapi32, oleaut32, ole32, ntdll, SHFolder, shlwapi |
导出 | 2 函数 |
资源 | 33 资源 |
节 | 9 节 |
Comments | BURIKO General Interpreter uses the OggVorbis libraries. The OggVorbis libraries are Copyright (C) 1994-2002 by the Xiph.Org Foundation. < http://www.xiph.org/ > |
CompanyName | BURIKO Co.,Ltd. |
FileDescription | Ethornell - BURIKO General Interpreter |
FileVersion | Version : 1.680 - Compatibility : 1.72 |
InternalName | Ethornell |
LegalCopyright | Copyright (C) 2007-2024 BURIKO Co.,Ltd. |
LegalTrademarks | BURIKO General Interpreter |
OriginalFilename | BGI.exe |
ProductVersion | 1.0.0.0 |
Translation | 0x0411 0x04b0 |
名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
1,133,556 bytes | 1,133,568 bytes | 6.56 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
1758347B883C0B4190BD5197C188E342 |
.rdata |
0x00116000 |
245,252 bytes | 245,760 bytes | 5.72 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
90F43A93D39DAD6E43B5594E644D8A28 |
.data |
0x00152000 |
425,928 bytes | 14,336 bytes | 3.71 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
51551BC4FF664720D194A64568E960CA |
_RDATA |
0x001ba000 |
1,504 bytes | 1,536 bytes | 4.68 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
3572694B6B2205862BDE5F60EAE95671 |
.rsrc |
0x001bb000 |
137,501 bytes | 137,728 bytes | 7.71 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
4D2524000957262FDAA307C1761EC29C |
.reloc |
0x001dd000 |
50,096 bytes | 50,176 bytes | 6.65 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
F495CFB75268E679B298CEF81E514FF8 |
.detour |
0x001ea000 |
11,480 bytes | 11,776 bytes | 5.11 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
E92EAD51C40BFB90DDCB6061F1C25EDD |
.enigma1 |
0x001ed000 |
4,096 bytes | 118,784 bytes | 7.88 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
A092A6A6A0AE9074BE1498812B782AAC |
.enigma2 |
0x001ee000 |
278,528 bytes | 278,528 bytes | 6.02 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
3B3AF4C233168A5F90CB7E62BA769673 |
2 检测到高熵(≥7.5)的节 - 可能存在打包/加密
2 检测到较高熵(≥6.5)的节 - 可能存在压缩
资源类型 | 数量 | 总大小 | 百分比 |
---|---|---|---|
AFX_DIALOG_LAYOUT | 3 | 6 字节 | |
SHADER | 1 | 2,174 字节 | |
TEXT | 1 | 1,489 字节 | |
RT_CURSOR | 1 | 2,220 字节 | |
RT_ICON | 5 | 118,945 字节 | |
RT_DIALOG | 17 | 7,160 字节 | |
RT_GROUP_CURSOR | 1 | 20 字节 | |
RT_GROUP_ICON | 1 | 76 字节 | |
RT_VERSION | 1 | 1,236 字节 | |
RT_MANIFEST | 1 | 1,759 字节 | |
None | 1 | 457 字节 |
描述 | Ethornell - BURIKO General Interpreter |
文件版本 | Version : 1.680 - Compatibility : 1.72 |
原始名称 | BGI.exe |
内部名称 | Ethornell |
版权 | Copyright (C) 2007-2024 BURIKO Co.,Ltd. |
✓ 此文件已进行数字签名,证书链已验证。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断:
下载反恶意软件此文件看起来是干净的,但定期的安全维护很重要