文件名 | wireguard-installer.exe |
文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
扫描器版本 | 1.0.216.174 |
数据库版本 | 2025-05-22 15:00:31 UTC |
恶意软件家族: Quasar
哈希类型 | 值 | 操作 |
---|---|---|
MD5 |
1cf9257c07936d7fbf508dc113e9b6d5
|
|
SHA1 |
324f8a1f0779fe42baabc544bc7f6814a3d150ca
|
|
SHA256 |
eeee2b0a6ad1c7e4614fed4dfbe58b63776f6a3a6758267b5a976b4dc4315f48
|
|
SHA512 |
081fa75e73138fb403aa01cb09f3051b7ee6954ab0a15366016cabe873d7a64f8374c85d9bcdf068fa019930419c818d102063983a5547ae5107773fe25e5c12
|
|
ImpHash |
5c900c91f80fa7e4541847a2f04d55bd
|
图标 |
哈希: 7d276439d9810323502f89b8e46d1edd
模糊: 89745e05fcc1193c9e6f7bd2da24eeea dHash: f0f261edec6c98f0 |
映像基址 | 0x00400000 |
入口点 | 0x00401110 |
编译时间 | 2022-01-06 16:16:06 |
校验和 | 0x0002368b (实际: 0x0002368b) |
操作系统版本 | 6.1 |
PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
数字签名 | OK |
导入 |
3 库
KERNEL32, ntdll, msvcrt |
导出 | 0 函数 |
资源 | 6 资源 |
节 | 6 节 |
CompanyName | WireGuard LLC |
FileDescription | WireGuard Installer: Fast, Modern, Secure VPN Tunnel |
FileVersion | 1.0 |
InternalName | wireguard-installer |
LegalCopyright | Copyright © 2015-2022 Jason A. Donenfeld <[email protected]>. All Rights Reserved. |
OriginalFilename | wireguard-installer.exe |
ProductName | WireGuard |
ProductVersion | 1.0 |
Comments | https://www.wireguard.com/ |
Translation | 0x0409 0x04b0 |
名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
---|---|---|---|---|---|---|
.text |
0x00001000 |
37,002 bytes | 37,376 bytes | 6.35 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
EA03A25A29A9A835AE3B79C8BD6C8E53 |
.rdata |
0x0000b000 |
7,002 bytes | 7,168 bytes | 5.68 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
8EA340AE1985338508E101B4750D7130 |
.data |
0x0000d000 |
17,704 bytes | 512 bytes | 2.14 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
FBED440F2BE0D95CD06B86B838B6F022 |
.tls |
0x00012000 |
8 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x00013000 |
25,536 bytes | 25,600 bytes | 5.58 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
0A204F9B335CC1FB8F5BC1E4695DFC52 |
.reloc |
0x0001a000 |
1,580 bytes | 2,048 bytes | 5.69 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
BA58008E0872561DF08DB7B816FB44C8 |
资源类型 | 数量 | 总大小 | 百分比 |
---|---|---|---|
RT_ICON | 3 | 22,328 字节 | |
RT_GROUP_ICON | 1 | 48 字节 | |
RT_VERSION | 1 | 1,004 字节 | |
RT_MANIFEST | 1 | 1,745 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
OK
按照以下步骤完全从系统中移除威胁