| 文件名 | YhDrv.sys |
| 文件类型 |
PE32+ executable (native) x86-64, for MS Windows
|
| 扫描器版本 | 1.0.216.174 |
| 数据库版本 | 2025-05-16 12:00:25 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
989087c4113146c89ba15d4fababa31f
|
|
| SHA1 |
fbcade8eaad154e1abe4bc2c85a0569a740b0b53
|
|
| SHA256 |
f8453ebeb45cb6af19ed1880e50b3ef834898296342f3a212523d425115b80b8
|
|
| SHA512 |
b76d385fee3f611b03c21fb7de0a31aea3da0db9b0bb76fed4ff6fadf3eef979faffcf8e60e4c2efc464e1bb41557fc81c11c98d062ecb8984a66c7c02d87a77
|
|
| ImpHash |
e1cd287d9742b6aeb150f93297650152
|
| 映像基址 | 0x140000000 |
| 入口点 | 0x1410c3b9c |
| 编译时间 | 2025-04-28 03:11:48 |
| 校验和 | 0x00b076f9 (实际: 0x00b076f9) |
| 操作系统版本 | 10.0 |
| PEiD 签名 |
PE32+ executable (native) x86-64, for MS Windows
|
| 数字签名 | Chain verification from CN=Changhua Xie, OU=Individual Developer, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=No Organization Affiliation, L=Guangzhou, ST=Guangdong, C=CN (serial:31289180465370344288683350311340896346, sha1:82aba6ccb6c9835b203fee60f8f55f6b645b20b5) failed: The path could not be validated because intermediate certificate 1 expired 2020-02-07 23:59:59Z |
| 导入 |
2 库
ntoskrnl, HAL |
| 导出 | 0 函数 |
| 资源 | 0 资源 |
| 节 | 11 节 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
272,229 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.rdata |
0x00044000 |
482,904 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.data |
0x000ba000 |
2,260,608 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.pdata |
0x002e2000 |
6,516 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.CRT |
0x002e4000 |
8 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
PAGE |
0x002e5000 |
1,003 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
INIT |
0x002e6000 |
3,002 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
D41D8CD98F00B204E9800998ECF8427E |
.g\D |
0x002e7000 |
7,415,986 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
.M4Z |
0x009fa000 |
176 bytes | 512 bytes | 1.11 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
70E1F2098EC3AF4CB4E929C14086F580 |
.n`8 |
0x009fb000 |
11,539,604 bytes | 11,539,968 bytes | 7.81 (打包/加密) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_NOT_PAGED|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
E3DB2842328C6628879C328B76725179 |
.reloc |
0x014fd000 |
252 bytes | 512 bytes | 2.45 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
D0FFDAF04019FDE491A176FD79474521 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
Chain verification from CN=Changhua Xie, OU=Individual Developer, OU=Digital ID Class 3 - Microsoft Software Validation v2, O=No Organization Affiliation, L=Guangzhou, ST=Guangdong, C=CN (serial:31289180465370344288683350311340896346, sha1:82aba6ccb6c9835b203fee60f8f55f6b645b20b5) failed: The path could not be validated because intermediate certificate 1 expired 2020-02-07 23:59:59Z
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
