| 文件名 | Copy.txt |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.220.174 |
| 数据库版本 | 2025-07-13 06:00:17 UTC |
恶意软件家族: Gen
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
67b89b3727baa7ffbb742dd8eaad82c3
|
|
| SHA1 |
68d91b2fbaf3558173337685ff98f53a0f0e86b8
|
|
| SHA256 |
d926f5a9e54ee7d2f27ead8c60a9fbb88a5765a58a5edf1eaf729dad5faed41c
|
|
| SHA512 |
d84c0a087291a2fbd87330df62ef1fe04e126a9802014915542854ae3de515e87410ce654697d16bcd19f6d28ad7b99192a105ed10f01f95777eee13c05466c8
|
|
| ImpHash |
adad8b2901614d832753023e56b5b0b7
|
| 图标 |
哈希: bad915e520cb2238f7c4fc0b25602d01
模糊: d637814e7277b5178418f0bc7fa64018 dHash: cccccccc942b2b00 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x005ac38a |
| 编译时间 | 2006-12-29 00:47:30 |
| 校验和 | 0x000bdea5 (实际: 0x000b2bb7) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 | 11 库 |
| 导出 | 0 函数 |
| 资源 | 260 资源 |
| 节 | 3 节 |
| Comments | Download GenoPro at http://www.genopro.com |
| CompanyName | GenoPro |
| FileDescription | GenoPro 2007 - Picture Your Family Tree! |
| FileVersion | 2.00 |
| InternalName | GenoPro |
| LegalCopyright | Copyright (C) 1998 - 2006. All Rights Reserved. |
| LegalTrademarks | GenoPro® and the GenoPro Logo are registered trademarks. |
| OriginalFilename | GenoPro.exe |
| ProductName | GenoPro 2007 |
| ProductVersion | 2.00 |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
|
0x00001000 |
1,748,992 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_SHARED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.reloc |
0x001ac000 |
504,824 bytes | 500,224 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
5B8280FC555AF98210879220C84C2D62 |
.rsrc |
0x00228000 |
218,960 bytes | 219,199 bytes | 7.52 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
0015E067F7095A17076603DD8A85E8F4 |
2 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| J | 1 | 12,229 字节 | |
| S | 5 | 153,101 字节 | |
| TYPELIB | 1 | 31,524 字节 | |
| RT_CURSOR | 25 | 7,700 字节 | |
| RT_BITMAP | 14 | 83,152 字节 | |
| RT_ICON | 7 | 15,448 字节 | |
| RT_MENU | 7 | 14,456 字节 | |
| RT_DIALOG | 87 | 98,046 字节 | |
| RT_STRING | 69 | 48,514 字节 | |
| RT_ACCELERATOR | 5 | 1,240 字节 | |
| RT_GROUP_CURSOR | 25 | 500 字节 | |
| RT_GROUP_ICON | 3 | 116 字节 | |
| RT_VERSION | 1 | 1,060 字节 | |
| None | 10 | 736 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
