The 圣诞树给你，放桌面上哦 exe File Malware Analysis

Technical Analysis

File Name	圣诞树给你，放桌面上哦.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.231.174
Database Version	2025-12-28 12:00:37 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	fa5736226d0ab879975d4d1a84eb9e12
SHA1	69ea6fb0bf6a3181bc9122456058b6840012a9f1
SHA256	05de2d8d50facd5b686a680c7445f9218726cc1e61a74ceb625fd469acc525b3
SHA512	54bd26dec0f55634edb899cd2204209d05f1d921040a0602129ae57c92f3d40f35d5966b6ea515bd94c409ed8c98d851ba13b9e78d4a48275ff9aaf42866f671
ImpHash	7a84276b96c31a84abae28b74ab371aa

PE Analysis

Basic Information

▼

Icon	Hash: 326289df9d11241e4533a1200cb5040a Fuzzy: b542c49a705dda0f18e1f44687375fe5 dHash: 707079c8d4d8e896
Image Base	`0x00400000`
Entry Point	`0x0047a794`
Compilation Time	1992-06-19 22:22:17
Checksum	0x00000000 (Actual: 0x0011fa87)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	8 libraries kernel32, user32, advapi32, oleaut32, version, gdi32, comctl32, shell32
Exports	0 functions
Resources	57 Resources
Sections	8 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`CODE`	`0x00001000`	497,628 bytes	497,664 bytes	6.59 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`4BF8B6FBC22EF2D5400757AA7BABECEC`
`DATA`	`0x0007b000`	13,244 bytes	13,312 bytes	4.97 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8C891444488D566CBDA966D37BDB2499`
`BSS`	`0x0007f000`	10,089 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00082000`	8,826 bytes	9,216 bytes	4.90 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`684A1F313024339C12F1FB87DD757264`
`.tls`	`0x00085000`	16 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00086000`	24 bytes	512 bytes	0.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`3E998512C627696570DC3D85B1130270`
`.reloc`	`0x00087000`	28,444 bytes	28,672 bytes	6.67 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`2707162DB346E94F925A1C756E3BF1CB`
`.rsrc`	`0x0008e000`	620,032 bytes	620,032 bytes	7.93 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`AA2360AFC56C1E64313BD240DC6BA617`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 57 (616,294 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	9	2,772 bytes	0.4%
RT_BITMAP	11	4,892 bytes	0.8%
RT_ICON	1	9,640 bytes	1.6%
RT_DIALOG	1	82 bytes	0%
RT_STRING	21	14,906 bytes	2.4%
RT_RCDATA	4	583,802 bytes	94.7%
RT_GROUP_CURSOR	9	180 bytes	0%
RT_GROUP_ICON	1	20 bytes	0%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The 圣诞树给你，放桌面上哦.exe File Analysis

Technical Analysis

Clean File