| 文件名 | SLIC_ToolKit_V3.2.EXE |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
|
| 扫描器版本 | 1.0.168.174 |
| 数据库版本 | 2024-03-11 19:00:37 UTC |
恶意软件家族: Agent
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
589748fa6623657f542d91c6fdd7211d
|
|
| SHA1 |
22a1d81b6dee6d1cd2fe13124a8da0dc5598384c
|
|
| SHA256 |
f94c163d21bb8c5318832fb629b0362bdef6a8327349fa1f8ae4e0234ba47230
|
|
| SHA512 |
40fcd87352fe655655ab7be85893c4774ea2d6c3b48aae0dcb89629ed6f87bf4553ce255e2dac4d3782d5cd1003a5b0f36e740e2d13e6ffe40f0f9a71d51d69e
|
|
| ImpHash |
49daac29b77706b771a3b1618cc70166
|
| 图标 |
哈希: e9aea03b37100216df6482d9b5a45eed
模糊: 06728b01fad53d3153e7c60e99ac3aeb dHash: b66994b292d86996 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x00506e70 |
| 编译时间 | 2010-02-13 05:30:41 |
| 校验和 | 0x00000000 (实际: 0x00061736) |
| 操作系统版本 | 5.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
|
| 数字签名 | The PE file does not contain a certificate table. |
| 导入 | 12 库 |
| 导出 | 0 函数 |
| 资源 | 69 资源 |
| 节 | 3 节 |
| FileVersion | 3.2.0.0 |
| FileDescription | SLIC ToolKit |
| ProductName | SLIC ToolKit |
| ProductVersion | 3.2.0.0 |
| CompanyName | DavidXXW Workgroup |
| LegalCopyright | It's a Free Toolkit , DavidXXW . |
| Comments | This tool only for technological research and validating vulnerabilities in the test environment. Does not involve the any copyrighted content, only for research and technological exchanges. Please delete within 24 hours, or for all the consequences arising from your own! |
| Translation | 0x0804 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
UPX0 |
0x00001000 |
741,376 bytes | 0 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D41D8CD98F00B204E9800998ECF8427E |
UPX1 |
0x000b6000 |
335,872 bytes | 334,848 bytes | 8.00 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
AB8D5626FF99CF3D637C00B106036FE3 |
.rsrc |
0x00108000 |
8,192 bytes | 8,192 bytes | 3.91 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
6CD69C991DC84DA0847B2885A28DBA14 |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| TEXTINCLUDE | 3 | 370 字节 | |
| RT_CURSOR | 4 | 1,104 字节 | |
| RT_BITMAP | 25 | 52,118 字节 | |
| RT_ICON | 4 | 2,080 字节 | |
| RT_MENU | 2 | 656 字节 | |
| RT_DIALOG | 12 | 4,662 字节 | |
| RT_STRING | 11 | 2,268 字节 | |
| RT_GROUP_CURSOR | 3 | 74 字节 | |
| RT_GROUP_ICON | 3 | 74 字节 | |
| RT_VERSION | 1 | 1,196 字节 | |
| RT_MANIFEST | 1 | 666 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The PE file does not contain a certificate table.
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
