| 文件名 | WeatherZero.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.222.174 |
| 数据库版本 | 2025-08-03 12:00:49 UTC |
恶意软件家族: Wacatac
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
9b9dcdc20109ab88b80fc94d15efb636
|
|
| SHA1 |
fbb772787cae0ad52540d3a0f7847be6432a7a2c
|
|
| SHA256 |
f66863c2345452a58ba5380f393471836e66a8d8247ce320ce241cdb84808f7d
|
|
| SHA512 |
2df42f5a3cbcb3adc33838e72d3c0dd381372a92aa3af2c221a6c3c6b536cadfd12d594523338d78aa5120869b62a5e1607c015c1a7676c0efbb84b929fa9ff0
|
|
| ImpHash |
4419e484e276ee1537b37e2081fdee7a
|
| 图标 |
哈希: 2fc83c69cf24f196fd7341bf0d1936f8
模糊: 08ff99ce15e012a18d4bf76aef327a9e dHash: 2351313cd8584123 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x0085a6fa |
| 编译时间 | 2022-05-25 12:51:31 |
| 校验和 | 0x005e623b (实际: 0x005e623b) |
| 操作系统版本 | 5.1 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 数字签名 | Chain verification from CN=Stream Synergy Inc., O=Stream Synergy Inc., L=Markham, ST=Ontario, C=CA, 2.5.4.5=1300793-6, 1.3.6.1.4.1.311.60.2.1.3=CA, 2.5.4.15=Private Organization (serial:17740561339204704137440454187752085813, sha1:53675561cf0f4557a4641203edcb4e08d691c40a) failed: The path could not be validated because the end-entity certificate expired 2022-06-02 23:59:59Z |
| 导入 |
7 库
kernel32, ADVAPI32, SHELL32, ole32, COMCTL32, USER32, GDI32 |
| 导出 | 0 函数 |
| 资源 | 14 资源 |
| 节 | 8 节 |
| CompanyName | |
| FileDescription | WeatherZero |
| FileVersion | 3.0.1.5 |
| LegalCopyright | WeatherZero |
| ProductName | WeatherZero |
| Translation | 0x0409 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
|
0x00001000 |
28,187 bytes | 18,944 bytes | 7.97 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
6D115957834AA407383AFA5EB454C474 |
|
0x00008000 |
6,152 bytes | 1,536 bytes | 7.32 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
69E57A5D1C343EA1A31C7DA053E37F93 |
|
0x0000a000 |
130,816 bytes | 512 bytes | 6.51 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
C916C21709353C253B2F641A2A569ADB |
.ndata |
0x0002a000 |
249,856 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
|
0x00067000 |
3,732,184 bytes | 3,732,480 bytes | 7.99 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
926E6E769F5DCF68FCAE643315CC445F |
.idata |
0x003f7000 |
4,096 bytes | 512 bytes | 3.14 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
CF7BF553387EA2ADFAC908ECEC56AD7F |
.rsrc |
0x003f8000 |
148,480 bytes | 148,480 bytes | 6.29 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
9B15B3C03A9B21AE15460C91D9CF2EE2 |
.themida |
0x0041d000 |
2,252,800 bytes | 2,252,800 bytes | 6.33 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
7BEB2EC80BEF0A43272FA4C9274B2271 |
2 检测到高熵（≥7.5）的节 - 可能存在打包/加密
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 11 | 146,040 字节 | |
| RT_GROUP_ICON | 1 | 160 字节 | |
| RT_VERSION | 1 | 484 字节 | |
| RT_MANIFEST | 1 | 998 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
Chain verification from CN=Stream Synergy Inc., O=Stream Synergy Inc., L=Markham, ST=Ontario, C=CA, 2.5.4.5=1300793-6, 1.3.6.1.4.1.311.60.2.1.3=CA, 2.5.4.15=Private Organization (serial:17740561339204704137440454187752085813, sha1:53675561cf0f4557a4641203edcb4e08d691c40a) failed: The path could not be validated because the end-entity certificate expired 2022-06-02 23:59:59Z
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
