PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 102,00 KBSHA-256 Hash: 7123E1514B939B165985560057FE3C761440A9FFF9783A3B84E861FD2888D4AB SHA-1 Hash: 56DC080F728D7A276495D6A4371670F9EA71519B MD5 Hash: 0323998E0E85ECA5FD90D9F8ECBBD6C2 Imphash: A9563CA2EE659A9314820BEAD4EC962B MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 0001C1CC EntryPoint (rva): 1140 SizeOfHeaders: 400 SizeOfImage: 1F000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 3568 IAT: 3870 Characteristics: 23 TimeDateStamp: 650907B0 Date: 19/09/2023 2:30:08 File Type: EXE Number Of Sections: 7 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .buildid, .data, .pdata, .tls, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 1E00 | 1000 | 1C86 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
2200 | 1200 | 3000 | 114C |
|
|
| .buildid | 0x40000040 Initialized Data Readable |
3400 | 200 | 5000 | 35 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
3600 | 200 | 6000 | 1BC |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
3800 | 200 | 7000 | 18C |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
3A00 | 200 | 8000 | 10 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
3C00 | 15C00 | 9000 | 15B38 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 540 Code -> 4883EC28488B05D51E0000C70001000000E80A0000009090904883C428C36690415741565657534881EC900000000F57C00F Assembler |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X1ED5] |MOV DWORD PTR [RAX], 1 |CALL 0X140001160 |NOP |NOP |NOP |ADD RSP, 0X28 |RET |NOP |PUSH R15 |PUSH R14 |PUSH RSI |PUSH RDI |PUSH RBX |SUB RSP, 0X90 |XORPS XMM0, XMM0 |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): linker: Microsoft Linker(14.0)[-] • Entropy: 7.48678 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| File Access |
| api-ms-win-crt-time-l1-1-0.dll api-ms-win-crt-environment-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll KERNEL32.dll USER32.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-private-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll @.dat |
| File Access (UNICODE) |
| librenpython.dll |
| Interest's Words |
| start |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 9130 | 11F0C | 3D30 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A8660000FFFF4944415478DAEC7D07605CD595 | .PNG........IHDR.............\r.f....IDATx..}.\.. |
| \ICON\2\1033 | 1B040 | 25A8 | 15C40 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... |
| \ICON\3\1033 | 1D5E8 | 10A8 | 181E8 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\4\1033 | 1E690 | 468 | 19290 | 280000001000000020000000010020000000000000000000000000000000000000000000000000000000000008080911C7D5 | (....... ..... ................................... |
| \GROUP_ICON\0\1033 | 1EAF8 | 3E | 196F8 | 00000100040000000000010020000C1F010001003030000001002000A825000002002020000001002000A810000003001010000001002000680400000400 | ............ .......00.... ..%.... .... ............. .h..... |
| Intelligent String |
| • @.tls • librenpython.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 5AD | N/A | .text | CALL QWORD PTR [RIP+0x282D] |
| 68A | N/A | .text | CALL QWORD PTR [RIP+0x2778] |
| 8FB | N/A | .text | CALL QWORD PTR [RIP+0x2527] |
| 963 | N/A | .text | CALL QWORD PTR [RIP+0x2447] |
| 999 | N/A | .text | CALL QWORD PTR [RIP+0x2461] |
| 9A6 | N/A | .text | CALL QWORD PTR [RIP+0x244C] |
| 9B6 | N/A | .text | CALL QWORD PTR [RIP+0x241C] |
| 10A0 | N/A | .text | CALL QWORD PTR [RIP+0x1D92] |
| 1104 | N/A | .text | CALL QWORD PTR [RIP+0x1D26] |
| 115F | N/A | .text | CALL QWORD PTR [RIP+0x1C6B] |
| 1650 | N/A | .text | CALL QWORD PTR [RIP+0x1772] |
| 166B | N/A | .text | CALL QWORD PTR [RIP+0x177F] |
| 16A8 | N/A | .text | CALL QWORD PTR [RIP+0x171A] |
| 1707 | N/A | .text | CALL QWORD PTR [RIP+0x16E3] |
| 1758 | N/A | .text | CALL QWORD PTR [RIP+0x166A] |
| 17BB | N/A | .text | CALL QWORD PTR [RIP+0x1627] |
| 17EE | N/A | .text | CALL QWORD PTR [RIP+0x15D4] |
| 184E | N/A | .text | CALL QWORD PTR [RIP+0x159C] |
| 189D | N/A | .text | CALL QWORD PTR [RIP+0x151D] |
| 18AC | N/A | .text | CALL QWORD PTR [RIP+0x153E] |
| 1CF0 | N/A | .text | JMP QWORD PTR [RIP+0xF92] |
| 1D00 | N/A | .text | JMP QWORD PTR [RIP+0xF92] |
| 1D10 | N/A | .text | JMP QWORD PTR [RIP+0xF8A] |
| 1D20 | N/A | .text | JMP QWORD PTR [RIP+0xFA2] |
| 1D30 | N/A | .text | JMP QWORD PTR [RIP+0xF9A] |
| 1D40 | N/A | .text | JMP QWORD PTR [RIP+0xFC2] |
| 1D50 | N/A | .text | JMP QWORD PTR [RIP+0xFC2] |
| 1D60 | N/A | .text | JMP QWORD PTR [RIP+0xFC2] |
| 1D70 | N/A | .text | JMP QWORD PTR [RIP+0xFD2] |
| 1D80 | N/A | .text | JMP QWORD PTR [RIP+0xFCA] |
| 1D90 | N/A | .text | JMP QWORD PTR [RIP+0xFD2] |
| 1DA0 | N/A | .text | JMP QWORD PTR [RIP+0xFE2] |
| 1DB0 | N/A | .text | JMP QWORD PTR [RIP+0xFEA] |
| 1DC0 | N/A | .text | JMP QWORD PTR [RIP+0xFEA] |
| 1DD0 | N/A | .text | JMP QWORD PTR [RIP+0x1002] |
| 1DE0 | N/A | .text | JMP QWORD PTR [RIP+0xFFA] |
| 1DF0 | N/A | .text | JMP QWORD PTR [RIP+0x1002] |
| 1E00 | N/A | .text | JMP QWORD PTR [RIP+0xFFA] |
| 1E10 | N/A | .text | JMP QWORD PTR [RIP+0xFF2] |
| 1E20 | N/A | .text | JMP QWORD PTR [RIP+0xFEA] |
| 1E30 | N/A | .text | JMP QWORD PTR [RIP+0xFEA] |
| 1E40 | N/A | .text | JMP QWORD PTR [RIP+0xFE2] |
| 1E50 | N/A | .text | JMP QWORD PTR [RIP+0xEEA] |
| 1E60 | N/A | .text | JMP QWORD PTR [RIP+0xFCA] |
| 1E70 | N/A | .text | JMP QWORD PTR [RIP+0xFC2] |
| 1E80 | N/A | .text | JMP QWORD PTR [RIP+0xF4A] |
| 1E90 | N/A | .text | JMP QWORD PTR [RIP+0xEDA] |
| 1EA0 | N/A | .text | JMP QWORD PTR [RIP+0xE7A] |
| 1EB0 | N/A | .text | JMP QWORD PTR [RIP+0xF92] |
| 1EC0 | N/A | .text | JMP QWORD PTR [RIP+0xE6A] |
| 1ED0 | N/A | .text | JMP QWORD PTR [RIP+0xE3A] |
| 1EE0 | N/A | .text | JMP QWORD PTR [RIP+0xE9A] |
| 1EF0 | N/A | .text | JMP QWORD PTR [RIP+0xE02] |
| 1F00 | N/A | .text | JMP QWORD PTR [RIP+0xDD2] |
| 1F10 | N/A | .text | JMP QWORD PTR [RIP+0xD9A] |
| 1F20 | N/A | .text | JMP QWORD PTR [RIP+0xD92] |
| 1F30 | N/A | .text | JMP QWORD PTR [RIP+0xF22] |
| 1F40 | N/A | .text | JMP QWORD PTR [RIP+0xD2A] |
| 1F50 | N/A | .text | JMP QWORD PTR [RIP+0xDAA] |
| 1F60 | N/A | .text | JMP QWORD PTR [RIP+0xD7A] |
| 1F70 | N/A | .text | JMP QWORD PTR [RIP+0xD4A] |
| 1F80 | N/A | .text | JMP QWORD PTR [RIP+0xEDA] |
| 1F90 | N/A | .text | JMP QWORD PTR [RIP+0xD5A] |
| 1FA0 | N/A | .text | JMP QWORD PTR [RIP+0xD42] |
| 1FB0 | N/A | .text | JMP QWORD PTR [RIP+0xECA] |
| 1FC0 | N/A | .text | JMP QWORD PTR [RIP+0xEB2] |
| 1FD0 | N/A | .text | JMP QWORD PTR [RIP+0xE9A] |
| 1FE0 | N/A | .text | JMP QWORD PTR [RIP+0xD7A] |
| 1FF0 | N/A | .text | JMP QWORD PTR [RIP+0xC82] |
| 2000 | N/A | .text | JMP QWORD PTR [RIP+0xDC2] |
| 2010 | N/A | .text | JMP QWORD PTR [RIP+0xDDA] |
| 2020 | N/A | .text | JMP QWORD PTR [RIP+0xC5A] |
| 2030 | N/A | .text | JMP QWORD PTR [RIP+0xDE2] |
| 2040 | N/A | .text | JMP QWORD PTR [RIP+0xDA2] |
| 2050 | N/A | .text | JMP QWORD PTR [RIP+0xD6A] |
| 2060 | N/A | .text | JMP QWORD PTR [RIP+0xCF2] |
| 2070 | N/A | .text | JMP QWORD PTR [RIP+0xD1A] |
| 2080 | N/A | .text | JMP QWORD PTR [RIP+0xD12] |
| 95A6 | N/A | .rsrc | CALL QWORD PTR [RIP+0x35CFCE91] |
| 1674F | N/A | .rsrc | CALL QWORD PTR [RIP+0x791615] |
| 182F3 | N/A | .rsrc | CALL QWORD PTR [RIP+0x413A34] |
| 2086-21FF | N/A | .text | Unusual BP Cave, count: 378 |
| 2730 | 140001780 | .rdata | TLS Callback | Pointer to 1780 - 0xB80 .text |
| 2738 | 140001800 | .rdata | TLS Callback | Pointer to 1800 - 0xC00 .text |
| 3800 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| 380C | 1400010F0 | .pdata | ExceptionHook | Pointer to 10F0 - 0x4F0 .text + UnwindInfo: .rdata |
| 3818 | 140001140 | .pdata | ExceptionHook | Pointer to 1140 - 0x540 .text + UnwindInfo: .rdata |
| 3824 | 140001160 | .pdata | ExceptionHook | Pointer to 1160 - 0x560 .text + UnwindInfo: .rdata |
| 3830 | 140001430 | .pdata | ExceptionHook | Pointer to 1430 - 0x830 .text + UnwindInfo: .rdata |
| 383C | 140001450 | .pdata | ExceptionHook | Pointer to 1450 - 0x850 .text + UnwindInfo: .rdata |
| 3848 | 140001480 | .pdata | ExceptionHook | Pointer to 1480 - 0x880 .text + UnwindInfo: .rdata |
| 3854 | 1400015E0 | .pdata | ExceptionHook | Pointer to 15E0 - 0x9E0 .text + UnwindInfo: .rdata |
| 3860 | 140001630 | .pdata | ExceptionHook | Pointer to 1630 - 0xA30 .text + UnwindInfo: .rdata |
| 386C | 140001680 | .pdata | ExceptionHook | Pointer to 1680 - 0xA80 .text + UnwindInfo: .rdata |
| 3878 | 1400016F0 | .pdata | ExceptionHook | Pointer to 16F0 - 0xAF0 .text + UnwindInfo: .rdata |
| 3884 | 140001780 | .pdata | ExceptionHook | Pointer to 1780 - 0xB80 .text + UnwindInfo: .rdata |
| 3890 | 140001800 | .pdata | ExceptionHook | Pointer to 1800 - 0xC00 .text + UnwindInfo: .rdata |
| 389C | 140001820 | .pdata | ExceptionHook | Pointer to 1820 - 0xC20 .text + UnwindInfo: .rdata |
| 38A8 | 1400018B0 | .pdata | ExceptionHook | Pointer to 18B0 - 0xCB0 .text + UnwindInfo: .rdata |
| 38B4 | 140001BE0 | .pdata | ExceptionHook | Pointer to 1BE0 - 0xFE0 .text + UnwindInfo: .rdata |
| 38C0 | 140001D80 | .pdata | ExceptionHook | Pointer to 1D80 - 0x1180 .text + UnwindInfo: .rdata |
| 38CC | 140001DF0 | .pdata | ExceptionHook | Pointer to 1DF0 - 0x11F0 .text + UnwindInfo: .rdata |
| 38D8 | 140001E40 | .pdata | ExceptionHook | Pointer to 1E40 - 0x1240 .text + UnwindInfo: .rdata |
| 38E4 | 140001FF0 | .pdata | ExceptionHook | Pointer to 1FF0 - 0x13F0 .text + UnwindInfo: .rdata |
| 38F0 | 140002060 | .pdata | ExceptionHook | Pointer to 2060 - 0x1460 .text + UnwindInfo: .rdata |
| 38FC | 1400020D0 | .pdata | ExceptionHook | Pointer to 20D0 - 0x14D0 .text + UnwindInfo: .rdata |
| 3908 | 140002110 | .pdata | ExceptionHook | Pointer to 2110 - 0x1510 .text + UnwindInfo: .rdata |
| 3914 | 140002150 | .pdata | ExceptionHook | Pointer to 2150 - 0x1550 .text + UnwindInfo: .rdata |
| 3920 | 140002190 | .pdata | ExceptionHook | Pointer to 2190 - 0x1590 .text + UnwindInfo: .rdata |
| 392C | 1400021D0 | .pdata | ExceptionHook | Pointer to 21D0 - 0x15D0 .text + UnwindInfo: .rdata |
| 3938 | 140002210 | .pdata | ExceptionHook | Pointer to 2210 - 0x1610 .text + UnwindInfo: .rdata |
| 3944 | 140002290 | .pdata | ExceptionHook | Pointer to 2290 - 0x1690 .text + UnwindInfo: .rdata |
| 3950 | 140002320 | .pdata | ExceptionHook | Pointer to 2320 - 0x1720 .text + UnwindInfo: .rdata |
| 395C | 1400024E0 | .pdata | ExceptionHook | Pointer to 24E0 - 0x18E0 .text + UnwindInfo: .rdata |
| 3968 | 140002590 | .pdata | ExceptionHook | Pointer to 2590 - 0x1990 .text + UnwindInfo: .rdata |
| 3974 | 140002800 | .pdata | ExceptionHook | Pointer to 2800 - 0x1C00 .text + UnwindInfo: .rdata |
| 3980 | 1400028C0 | .pdata | ExceptionHook | Pointer to 28C0 - 0x1CC0 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 62938 | 60,2577% |
| Null Byte Code | 12597 | 12,0605% |
© 2026 All rights reserved.