| 文件名 | fc63db22c5376b6487fce373898982132169882b5b937c3ed77c092efa59869f.exe |
| 文件类型 |
Win32 DLL
|
| 魔术字节 | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| SSDEEP 哈希 |
98304:XiE8VVS1XMt1j0ttgJZ1EKMzPU+/PQEDfi+Hw2:XiE8VRt1j0ttgJZ1EKYEF
|
| 扫描器版本 | 1.0.215.174 |
| 数据库版本 | 2025-04-23 20:00:16 UTC |
被 7 个安全引擎检测到 - 需要谨慎
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
599a2afd49bf7431320eb76e0244a6d5
|
|
| SHA1 |
540a3bfb6f8ee434b310abc35e699d6c4c5cd361
|
|
| SHA256 |
fc63db22c5376b6487fce373898982132169882b5b937c3ed77c092efa59869f
|
|
| SHA512 |
82f9eaea54fa54313f8b7cbae8ebc52ea3fddd783baf7d8c367aa55a0f9d24b2d5945b0cf7b3b8d499895e9728b8d5cd03d2eed80d1f66bd8bba166da2dd2e45
|
|
| ImpHash |
7b129274c21907d208ab4207edbe5464
|
| 映像基址 | 0x180000000 |
| 入口点 | 0x180072480 |
| 编译时间 | 2025-04-23 13:13:19 |
| 校验和 | 0x00000000 (实际: 0x007ac7c9) |
| 操作系统版本 | 6.0 |
| PEiD 签名 |
PE32+ executable (DLL) (GUI) x86-64, for MS Windows
|
| 数字签名 | No valid SignedData structure was found. |
| 导入 |
10 库
ADVAPI32, bcrypt, KERNEL32, ole32, USER32, api-ms-win-crt-heap-l1-1-0, api-ms-win-crt-math-l1-1-0, api-ms-win-crt-string-l1-1-0, api-ms-win-crt-runtime-l1-1-0, api-ms-win-crt-stdio-l1-1-0 |
| 导出 | 194 函数 |
| 资源 | 1 资源 |
| 节 | 8 节 |
| Translation | 0x0000 0x04b0 |
| Comments | Moshi Kifurushi cha Takwimu kwa uchakataji bora wa taarifa nyingi |
| CompanyName | Ufumbuzi wa Dijitali Serengeti |
| FileDescription | Dodoma |
| FileVersion | 215.204.3579.4680 |
| InternalName | Dodoma.dll |
| LegalCopyright | |
| OriginalFilename | Dodoma.dll |
| ProductName | Moshi Kifurushi cha Takwimu |
| ProductVersion | 1.0.0 |
| Assembly Version | 215.204.3579.4680 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
494,328 bytes | 494,592 bytes | 6.62 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
F79D359BD605CA3D3C5204586D11FA84 |
.managed |
0x0007a000 |
2,889,368 bytes | 2,889,728 bytes | 6.41 (正常) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
03B9C0AFAF0E2762CD1CC01654646090 |
.rdata |
0x0033c000 |
3,853,226 bytes | 3,853,312 bytes | 6.19 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
DDF9818F87E346352312D458499AC016 |
.data |
0x006e9000 |
431,832 bytes | 311,808 bytes | 3.83 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
A8F5D360CCDC9566C476C67FC48C6620 |
.pdata |
0x00753000 |
250,416 bytes | 250,880 bytes | 6.44 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
E207E491B1F7354A2698A003E039DAF0 |
_RDATA |
0x00791000 |
348 bytes | 512 bytes | 3.34 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
6A91D1B1FEB6C39442FD9505E5F1E69D |
.rsrc |
0x00792000 |
1,064 bytes | 1,536 bytes | 2.52 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
6E8C35B82143E1E112B9E1C0472761A1 |
.reloc |
0x00793000 |
233,352 bytes | 233,472 bytes | 5.45 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ
|
FD34644389C8B48CA440A595283BECCC |
1 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| RT_VERSION | 1 | 968 字节 |
| 产品 | Moshi Kifurushi cha Takwimu |
| 描述 | Dodoma |
| 文件版本 | 215.204.3579.4680 |
| 原始名称 | Dodoma.dll |
| 内部名称 | Dodoma.dll |
✓ 此文件已进行数字签名，证书链已验证。
No valid SignedData structure was found.
建议: 验证文件来源并确保它来自可信的发布者.
Gridinsoft Anti-Malware 拥有更强大的病毒扫描引擎。我们建议使用它来更准确地诊断受感染的系统。这个简短的指南将帮助您安装我们的旗舰产品以进行更准确的诊断：
下载反恶意软件此文件看起来是干净的，但定期的安全维护很重要
