| 文件名 | vlrk3spa.dll |
| 文件类型 |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.147.174 |
| 数据库版本 | 2023-11-11 11:00:48 UTC |
恶意软件家族: Gen
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
d77c93ed45038b085d35e7c62ce0eab0
|
|
| SHA1 |
4c32ad29575c7803a95f6b52d1f723bf28e57c2a
|
|
| SHA256 |
e2dfe7a08f609d59ae8279e9e74cf9cb04037b04d4fa84223af9f036fa43245d
|
|
| SHA512 |
27c4795b33a83eb796ff4abe448f8708899750913fc87f27300d3157b4959589bb14003949733ef5f696bf1e03d6944cd4e9a200781beddfbdf46c3eee0f8e32
|
|
| ImpHash |
bd8881e59541c6152359aa19b85c9dec
|
| 映像基址 | 0x10000000 |
| 入口点 | 0x10023bae |
| 编译时间 | 2019-10-13 20:17:16 |
| 校验和 | 0x00057319 (实际: 0x00057319) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
|
| PDB 路径 | D:\C++\Version 16.3.6\ITCA\Release\SmartFlow.pdb |
| 数字签名 | OK |
| 导入 | 12 库 |
| 导出 | 12 函数 |
| 资源 | 1 资源 |
| 节 | 11 节 |
| Thawte Timestamping CA | Symantec Corporation (US) |
| Symantec Time Stamping Services CA - G2 | Symantec Corporation (US) |
| COMODO RSA Extended Validation Code Signing CA | Nuhertz Technologies, LLC (US) |
| COMODO RSA Certification Authority | COMODO CA Limited (GB) |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
jkl.text |
0x00001000 |
120,016 bytes | 120,320 bytes | 6.41 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
4A48FAFD406FA7CA0454DA18AEBA72A0 |
.text |
0x0001f000 |
127,390 bytes | 127,488 bytes | 6.73 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
681A53EC2BDA7B5DFBB42803F6C754D3 |
jkl.bss |
0x0003f000 |
76 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x00040000 |
50,950 bytes | 51,200 bytes | 5.87 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
CC47F26F1165800F5016FA28F8A00E67 |
.data |
0x0004d000 |
8,112 bytes | 3,072 bytes | 2.40 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
DC95DA8C7519E3F820F953B755CBB224 |
jkl.data |
0x0004f000 |
448 bytes | 512 bytes | 2.20 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
F11B53E5BBFE2E0B3D4A46783E79DD2E |
jkl.rdat |
0x00050000 |
10,944 bytes | 11,264 bytes | 6.20 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
C8A0BDDE04424B086E3C6ED250576BE7 |
.gfids |
0x00053000 |
244 bytes | 512 bytes | 2.27 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
8C32F3E848E4E8544E3AB6749D369D4A |
.tls |
0x00054000 |
9 bytes | 512 bytes | 0.02 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
1F354D76203061BFDD5A53DAE48D5435 |
.rsrc |
0x00055000 |
480 bytes | 512 bytes | 4.72 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
E413F289380A3957BBD18AC1B18F2689 |
.reloc |
0x00056000 |
12,804 bytes | 13,312 bytes | 6.60 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
8A460F3EE581FC111DD80530593AB399 |
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_MANIFEST | 1 | 381 字节 |
| 主题 |
Symantec Time Stamping Services CA - G2 Symantec Corporation US |
| 颁发者 | Thawte Timestamping CA |
| 序列号 | 168250781398245547403531165097821404219 |
| 主题 |
Symantec Time Stamping Services Signer - G4 Symantec Corporation US |
| 颁发者 | Symantec Time Stamping Services CA - G2 |
| 序列号 | 19688950797630895426199952712430983760 |
| 主题 |
Nuhertz Technologies, LLC Nuhertz Technologies, LLC US |
| 颁发者 | COMODO RSA Extended Validation Code Signing CA |
| 序列号 | 62609851503100954138433791016213207861 |
| 主题 |
COMODO RSA Extended Validation Code Signing CA COMODO CA Limited GB |
| 颁发者 | COMODO RSA Certification Authority |
| 序列号 | 145988949288707562875132556020702856673 |
OK
按照以下步骤完全从系统中移除威胁
