| 文件名 | OnlineFix64.dll |
| 文件类型 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.176.174 |
| 数据库版本 | 2024-05-18 11:00:32 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
67c8fbc9c267afd2ba460cf5482e51b2
|
|
| SHA1 |
85c0f9efe69db40f152b670afefb523b21d3c36c
|
|
| SHA256 |
ea109868e604bf8c2fdae73b773a1a19703995cbfc0c46623523352dba19e954
|
|
| SHA512 |
eabe4a019ee54a5529d8334a4b07945b335170a91d9a6f7fd2bae02713723118cd4cd68fdf0db01dc9af746f0f7c7cfc21d52c9a49ba88fa9a2d4611daa280dd
|
|
| ImpHash |
d5a72dd360f011c5680f80d46c42ce00
|
| 映像基址 | 0x180000000 |
| 入口点 | 0x180aaad9e |
| 编译时间 | 2023-06-05 10:35:41 |
| 校验和 | 0x00000000 (实际: 0x00b33a6f) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 |
6 库
KERNEL32, USER32, SHELL32, WS2_32, WLDAP32, ADVAPI32 |
| 导出 | 60 函数 |
| 资源 | 1 资源 |
| 节 | 10 节 |
| CompanyName | Online-Fix.Me |
| FileDescription | Online-Fix Steamclient |
| FileVersion | 1.3.1.0 |
| LegalCopyright | Copyright (C) 2021-2023, 0xdeadc0de |
| ProductVersion | 1.3.1.0 |
| Translation | 0x0007 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
1,768,368 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x001b1000 |
613,266 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x00247000 |
320,816 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.pdata |
0x00296000 |
87,744 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
_RDATA |
0x002ac000 |
348 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.of0 |
0x002ad000 |
5,913,540 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.of1 |
0x00851000 |
2,496 bytes | 2,560 bytes | 0.17 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
057F457F6811E63727DDAD2B68B44350 |
.of2 |
0x00852000 |
11,678,948 bytes | 11,679,232 bytes | 7.78 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
DB701F4DB2DD6BC9AD7218F5795D0FEB |
.reloc |
0x01376000 |
56 bytes | 512 bytes | 0.70 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
D64CF9780A12CD9BAB8F5F765E19B264 |
.rsrc |
0x01377000 |
664 bytes | 1,024 bytes | 2.30 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F670183E24BB98C3CABFEC1BB0863D1F |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 576 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
