| 文件名 | Eternal.exe |
| 文件类型 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| 扫描器版本 | 1.0.221.174 |
| 数据库版本 | 2025-07-19 19:00:24 UTC |
恶意软件家族: Heuristic
| 哈希类型 | 值 | 操作 |
|---|---|---|
| MD5 |
d4326ad4b99a03775aba538c5195fff0
|
|
| SHA1 |
aa776f63cb560358ac2f0d1c790d2498790462e1
|
|
| SHA256 |
fc9a08b35b86ba4a3db52565454a63280ad68dde41893bb0b9847a61446fc52c
|
|
| SHA512 |
a537ddb305a5ae19a649c942f7eedc21c9d1896b68ca3c0487b16d2fcd534c853ef9f8093a2a25d9dbc3511679308150dd7f3bfa400f26ff2934e1a099ecd734
|
|
| ImpHash |
b7fc31b6422013c5f943a1da91692ed3
|
| 图标 |
哈希: 9b90ae610d68f3bb641277f80e0b8c50
模糊: eb3c36717545591026da9160551c831b dHash: f8fc4c6c69288ae0 |
| 映像基址 | 0x00400000 |
| 入口点 | 0x00401000 |
| 编译时间 | 2010-06-25 06:55:58 |
| 校验和 | 0x00762696 (实际: 0x007610c4) |
| 操作系统版本 | 4.0 |
| PEiD 签名 |
PE32 executable (GUI) Intel 80386, for MS Windows
|
| PDB 路径 | d:\BuildServer\WoW\1\work\WoW-code\branches\wow-patch-3_3_5_A-BNet\WoW\Bin\Wow.pdb |
| 数字签名 | The expected hash does not match the digest in SpcInfo |
| 导入 | 17 库 |
| 导出 | 1 函数 |
| 资源 | 29 资源 |
| 节 | 6 节 |
| Comments | |
| CompanyName | Blizzard Entertainment |
| FileDescription | World of Warcraft Retail |
| FileVersion | 3, 3, 5, 12340 |
| InternalName | World of Warcraft |
| LegalCopyright | Copyright © 2004 |
| LegalTrademarks | |
| OriginalFilename | WoW.exe |
| PrivateBuild | |
| ProductName | World of Warcraft |
| ProductVersion | Version 3.3 |
| SpecialBuild | |
| Translation | 0x0000 0x04b0 |
| 名称 | 虚拟地址 | 虚拟大小 | 原始大小 | 熵 | 特征 | MD5 |
|---|---|---|---|---|---|---|
.text |
0x00001000 |
6,149,043 bytes | 6,149,120 bytes | 6.69 (压缩) |
IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ
|
DBBB324FF6EB82CB49983CD2C13E685F |
.rdata |
0x005df000 |
878,201 bytes | 878,592 bytes | 5.93 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
AE02DA553EE17CC7903E5796456F7C31 |
.data |
0x006b6000 |
3,253,512 bytes | 495,104 bytes | 4.78 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
1FCA65A45C4E2F9ED8349D6D68E1691B |
.zdata |
0x009d1000 |
4,096 bytes | 4,096 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
620F0B67A91F7F74151BC5BE745B7110 |
.tls |
0x009d2000 |
25 bytes | 512 bytes | 0.00 (正常) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE
|
BF619EAC0CDF3F68D496EA9344137E8B |
.rsrc |
0x009d3000 |
170,704 bytes | 171,008 bytes | 7.23 (压缩) |
IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ
|
6FBBB45AAF830B355C3F5E0E879588C6 |
2 检测到较高熵（≥6.5）的节 - 可能存在压缩
| 资源类型 | 数量 | 总大小 | 百分比 |
|---|---|---|---|
| BLIZZARDCOMPONENT | 1 | 200 字节 | |
| DATA | 12 | 131,858 字节 | |
| RT_CURSOR | 1 | 308 字节 | |
| RT_BITMAP | 1 | 620 字节 | |
| RT_ICON | 8 | 34,944 字节 | |
| RT_GROUP_CURSOR | 1 | 20 字节 | |
| RT_GROUP_ICON | 2 | 124 字节 | |
| RT_VERSION | 1 | 908 字节 | |
| RT_MANIFEST | 1 | 86 字节 | |
| None | 1 | 84 字节 |
此文件未进行数字签名。
⚠ 此文件缺少数字签名或证书链无法验证。
执行来自未知来源的未签名文件时请谨慎。
The expected hash does not match the digest in SpcInfo
建议: 验证文件来源并确保它来自可信的发布者.
按照以下步骤完全从系统中移除威胁
