| 文件名 | jianpian_4.2.3.48_0828_Full.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.150.174 |
| 数据库版本 | 2023-12-01 19:01:21 UTC |
恶意软件家族: Wacatac
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
43d6b723ba37edeef1bcb596acef2ed7
|
|
| SHA1 |
58bf25cc73bcf728f0165951afb246ea307586a8
|
|
| SHA256 |
fbcf00172a02cfd0bdadca286bfecf1fdf6e7652c81568ff67b2d89da7395664
|
|
| SHA512 |
79b0afc77e8acdd7772756e8652a4b5af3c56c2877ef2d171e7e8e8ccb1cc465c11a532415400d3efd7086f4811fcfc3c39ab2d783f0cd94714ea8fa501f9c38
|
|
| ImpHash |
d221b1dc8c3a08622f6512e7876527c8
|
| 图标 |
哈希: db8e1d5fcf65d544d3b8a66d0e9a32d3
模糊: cefad0db8fee904d20e212dcbd12619b dHash: cc96b296ccc4f010 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x00401d20 |
| 编译时间 | 2011-01-31 17:44:13 |
| 校验和 | 0x0168cd8b (实际: 0x0168cd8b) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 数字签名 | OK |
| 导入 |
3 库
KERNEL32, USER32, MSVCRT |
| 导出 | 0 函数 |
| 资源 | 32 资源 |
| 节 | 5 节 |
| DigiCert Trusted Root G4 | DigiCert Inc (US) |
| DigiCert High Assurance EV Root CA | DigiCert Inc (US) |
| DigiCert Trusted Root G4 | DigiCert, Inc. (US) |
| DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 | Chengdu Nuoxin Times Technology Co., Ltd. (CN) |
| Comments | |
| CompanyName | 荐片高清影音软件公司 |
| FileDescription | jianpiansetup Setup |
| FileVersion | 4.2.3.48 |
| InternalName | setup |
| LegalCopyright | Copyright ?2022 荐片高清影音软件公司 |
| LegalTrademarks | |
| OriginalFilename | setup.exe |
| PrivateBuild | |
| ProductName | jianpiansetup |
| ProductVersion | 4.2.3.48 |
| SpecialBuild | |
| Translation | 0x0409 0x01b5 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
3,756 bytes | 4,096 bytes | 5.94 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
9CE5929599C65C95975BF6E171805391 |
.rdata |
0x00002000 |
1,160 bytes | 4,096 bytes | 1.74 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
015DD3C04D84F61F565E42966779DEFF |
.data |
0x00003000 |
1,376 bytes | 4,096 bytes | 1.01 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
D4A8A270215B2FEC747CAABFD58D8F7B |
.gentee |
0x00004000 |
71,720 bytes | 73,728 bytes | 7.94 (打包/加密) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
F3D56FAD870AC776A293A5EAB833471B |
.rsrc |
0x00016000 |
612,220 bytes | 614,400 bytes | 3.98 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
DBEB1895F7EE29B2B9B0124090369B1D |
1 检测到高熵（≥7.5）的节 - 可能存在打包/加密
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_ICON | 20 | 586,816 字节 | |
| RT_DIALOG | 8 | 3,014 字节 | |
| RT_RCDATA | 1 | 18,106 字节 | |
| RT_GROUP_ICON | 1 | 286 字节 | |
| RT_VERSION | 1 | 848 字节 | |
| RT_MANIFEST | 1 | 1,221 字节 |
| 主题 |
DigiCert Trusted Root G4 DigiCert Inc US |
| 颁发者 | DigiCert Trusted Root G4 |
| 序列号 | 7451500558977370777930084869016614236 |
| 主题 |
DigiCert Trusted Root G4 DigiCert Inc US |
| 颁发者 | DigiCert High Assurance EV Root CA |
| 序列号 | 21027418832470288962299581843631674929 |
| 主题 |
DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 DigiCert, Inc. US |
| 颁发者 | DigiCert Trusted Root G4 |
| 序列号 | 11533403529598586876501374841704918745 |
| 主题 |
Chengdu Nuoxin Times Technology Co., Ltd. Chengdu Nuoxin Times Technology Co., Ltd. CN |
| 颁发者 | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| 序列号 | 13643670673736241152473941466292135099 |
OK
按照以下步骤完全从系统中移除威胁
