The IP切换精灵 exe File Malware Analysis

Technical Analysis

File Name	IP切换精灵.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.217.174
Database Version	2025-06-07 12:00:29 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	a8044d57c8349567cf7f1c1aa1629022
SHA1	6d39514972f5d673732969b820f9976cf0dd39f3
SHA256	7664c2d19478983614cd552b1ff6ff50d972373d68574223a5c9c1e5f0588830
SHA512	b6c949bbbae626fbf73576251a291df8a5c88faaf9338145d44a296368e0669762603d813ab77024bb2a907054fdb59c5925893226d0557283e91820e342ce33
ImpHash	f0f48b76129be1f9560a459b3ad134a6

PE Analysis

Basic Information

▼

Icon	Hash: 520a16303c2a47b67009000294ce9bbf Fuzzy: 1dbf594cc1b29d0a5c1f160633afd1c3 dHash: 9ca48c9cccded2e2
Image Base	`0x00400000`
Entry Point	`0x0045c6d8`
Compilation Time	1992-06-19 22:22:17
Checksum	0x00000000 (Actual: 0x0007ccaa)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	7 libraries kernel32, user32, advapi32, oleaut32, version, gdi32, comctl32
Exports	0 functions
Resources	72 Resources
Sections	8 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`CODE`	`0x00001000`	374,596 bytes	374,784 bytes	6.52 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`4C5D24BE49CBD56BF9C84FCC0D06719A`
`DATA`	`0x0005d000`	5,844 bytes	6,144 bytes	3.93 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`73E207E71B04456D1F8157F6381C1C3E`
`BSS`	`0x0005f000`	3,189 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x00060000`	8,406 bytes	8,704 bytes	4.94 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`98F1EBB88F9A1D5F3C0172AD318D063F`
`.tls`	`0x00063000`	16 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x00064000`	24 bytes	512 bytes	0.21 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`710ED322AF38CC3CAFBB0B107BE04212`
`.reloc`	`0x00065000`	27,124 bytes	27,136 bytes	6.66 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`2AE3651F85291DAFE0A2E80916ACE810`
`.rsrc`	`0x0006c000`	73,728 bytes	73,728 bytes	4.98 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`9AE6069015C4595A8B095841C17721F9`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 72 (69,029 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	8	2,464 bytes	3.6%
RT_BITMAP	26	26,692 bytes	38.7%
RT_ICON	3	15,032 bytes	21.8%
RT_DIALOG	1	82 bytes	0.1%
RT_STRING	21	11,572 bytes	16.8%
RT_RCDATA	4	12,979 bytes	18.8%
RT_GROUP_CURSOR	8	160 bytes	0.2%
RT_GROUP_ICON	1	48 bytes	0.1%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The IP切换精灵.exe File Analysis