PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 58,01 KB SHA-256 Hash: 7B196908EA1003B77ADCF58210E0EA71D6B04724244646E3818E890C14706C13 SHA-1 Hash: 4E5FF1D091ABCAF7A09A031485926C6D20A3C825 MD5 Hash: 067C7AC4B7AE2383DFA913FA8BCCAABA Imphash: DE7BB182FBDFA4909BE44C9A7D4823A7 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 0001030E EntryPoint (rva): 13D0 SizeOfHeaders: 600 SizeOfImage: 13000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 8000 IAT: 82F8 Characteristics: 26 TimeDateStamp: 691CF6C0 Date: 18/11/2025 22:44:16 File Type: DLL Number Of Sections: 16 ASLR: Disabled Section Names (Optional Header): .text, .data, .rdata, .pdata, .xdata, .bss, .idata, .tls, .reloc, /4, /19, /31, /45, /57, /70, /81 Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
600 | 1E00 | 1000 | 1D10 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
2400 | 200 | 3000 | A0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
2600 | 800 | 4000 | 618 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
2E00 | 400 | 5000 | 234 |
|
|
| .xdata | 0x40000040 Initialized Data Readable |
3200 | 200 | 6000 | 1C8 |
|
|
| .bss | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 0 | 7000 | 3E0 |
|
|
| .idata | 0x40000040 Initialized Data Readable |
3400 | C00 | 8000 | AAC |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
4000 | 200 | 9000 | 10 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
4200 | 200 | A000 | 64 |
|
|
| /4 | 0x42000040 Initialized Data GP-Relative Readable |
4400 | 200 | B000 | 50 |
|
|
| /19 | 0x42000040 Initialized Data GP-Relative Readable |
4600 | 1200 | C000 | 11A6 |
|
|
| /31 | 0x42000040 Initialized Data GP-Relative Readable |
5800 | 200 | E000 | B5 |
|
|
| /45 | 0x42000040 Initialized Data GP-Relative Readable |
5A00 | 200 | F000 | A4 |
|
|
| /57 | 0x42000040 Initialized Data GP-Relative Readable |
5C00 | 200 | 10000 | 48 |
|
|
| /70 | 0x42000040 Initialized Data GP-Relative Readable |
5E00 | 200 | 11000 | A3 |
|
|
| /81 | 0x42000040 Initialized Data GP-Relative Readable |
6000 | 200 | 12000 | 1F8 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 9D0 Code -> 4883EC28488B0565300000C70001000000E82AFCFFFF90904883C428C30F1F004883EC28488B0545300000C70000000000E8 Assembler |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X3065] |MOV DWORD PTR [RAX], 1 |CALL 0XC40 |NOP |NOP |ADD RSP, 0X28 |RET |NOP DWORD PTR [RAX] |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X3045] |MOV DWORD PTR [RAX], 0 |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • Entropy: 4.50766 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| File Access |
| ell.exe WS2_32.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-private-l1-1-0.dll api-ms-win-crt-multibyte-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-environment-l1-1-0.dll KERNEL32.dll .dat |
| Interest's Words |
| exec start expand |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (CreateProcessA) |
| Entry Point | Hex Pattern | ARJ Archive |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Intelligent String |
| • .bss • @.bss • @.tls • KERNEL32.dll • api-ms-win-crt-environment-l1-1-0.dll • api-ms-win-crt-heap-l1-1-0.dll • api-ms-win-crt-locale-l1-1-0.dll • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-private-l1-1-0.dll • api-ms-win-crt-runtime-l1-1-0.dll • api-ms-win-crt-string-l1-1-0.dll • WS2_32.dll • C:/buildroot/src/gcc-15.2.0/libgcc/config/i386\cygwin.SC:\buildroot\x86_64-1520-win32-seh-ucrt-rt_v13-rev0\build\gcc-15.2.0\x86_64-w64-mingw32\libgccGNU AS 2.42 • shell.cpp • .tls |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 71A | N/A | .text | CALL QWORD PTR [RIP+0x7228] |
| DF0 | N/A | .text | JMP QWORD PTR [RIP+0x6CFA] |
| DF8 | N/A | .text | JMP QWORD PTR [RIP+0x6CEA] |
| E00 | N/A | .text | JMP QWORD PTR [RIP+0x6CDA] |
| E08 | N/A | .text | JMP QWORD PTR [RIP+0x6CCA] |
| E10 | N/A | .text | JMP QWORD PTR [RIP+0x6CBA] |
| E18 | N/A | .text | JMP QWORD PTR [RIP+0x6CAA] |
| 11CB | N/A | .text | CALL QWORD PTR [RIP+0x6797] |
| 122E | N/A | .text | CALL QWORD PTR [RIP+0x672C] |
| 1238 | N/A | .text | CALL QWORD PTR [RIP+0x66DA] |
| 1854 | N/A | .text | CALL QWORD PTR [RIP+0x60B6] |
| 18AA | N/A | .text | JMP QWORD PTR [RIP+0x6088] |
| 18F7 | N/A | .text | CALL QWORD PTR [RIP+0x6013] |
| 1912 | N/A | .text | CALL QWORD PTR [RIP+0x6020] |
| 195A | N/A | .text | CALL QWORD PTR [RIP+0x5FB0] |
| 19A6 | N/A | .text | CALL QWORD PTR [RIP+0x5F8C] |
| 1A85 | N/A | .text | CALL QWORD PTR [RIP+0x5E7D] |
| 1AB7 | N/A | .text | CALL QWORD PTR [RIP+0x5E73] |
| 2090 | N/A | .text | JMP QWORD PTR [RIP+0x5A12] |
| 2098 | N/A | .text | JMP QWORD PTR [RIP+0x5A12] |
| 20A0 | N/A | .text | JMP QWORD PTR [RIP+0x5A12] |
| 20B0 | N/A | .text | JMP QWORD PTR [RIP+0x59CA] |
| 20B8 | N/A | .text | JMP QWORD PTR [RIP+0x59CA] |
| 20C0 | N/A | .text | JMP QWORD PTR [RIP+0x59CA] |
| 20C8 | N/A | .text | JMP QWORD PTR [RIP+0x59CA] |
| 20D0 | N/A | .text | JMP QWORD PTR [RIP+0x592A] |
| 20D8 | N/A | .text | JMP QWORD PTR [RIP+0x592A] |
| 20E0 | N/A | .text | JMP QWORD PTR [RIP+0x592A] |
| 20E8 | N/A | .text | JMP QWORD PTR [RIP+0x592A] |
| 20F0 | N/A | .text | JMP QWORD PTR [RIP+0x592A] |
| 20F8 | N/A | .text | JMP QWORD PTR [RIP+0x592A] |
| 2100 | N/A | .text | JMP QWORD PTR [RIP+0x5932] |
| 2108 | N/A | .text | JMP QWORD PTR [RIP+0x5932] |
| 2110 | N/A | .text | JMP QWORD PTR [RIP+0x5932] |
| 2118 | N/A | .text | JMP QWORD PTR [RIP+0x5932] |
| 2120 | N/A | .text | JMP QWORD PTR [RIP+0x5932] |
| 2128 | N/A | .text | JMP QWORD PTR [RIP+0x5932] |
| 2130 | N/A | .text | JMP QWORD PTR [RIP+0x593A] |
| 2140 | N/A | .text | JMP QWORD PTR [RIP+0x58A2] |
| 2148 | N/A | .text | JMP QWORD PTR [RIP+0x58A2] |
| 2150 | N/A | .text | JMP QWORD PTR [RIP+0x5882] |
| 2160 | N/A | .text | JMP QWORD PTR [RIP+0x5862] |
| 2170 | N/A | .text | JMP QWORD PTR [RIP+0x5842] |
| 2180 | N/A | .text | JMP QWORD PTR [RIP+0x580A] |
| 2188 | N/A | .text | JMP QWORD PTR [RIP+0x580A] |
| 2190 | N/A | .text | JMP QWORD PTR [RIP+0x580A] |
| 2198 | N/A | .text | JMP QWORD PTR [RIP+0x580A] |
| 21A0 | N/A | .text | JMP QWORD PTR [RIP+0x57DA] |
| 21B0 | N/A | .text | JMP QWORD PTR [RIP+0x57BA] |
| 21B8 | N/A | .text | JMP QWORD PTR [RIP+0x57AA] |
| 21C0 | N/A | .text | JMP QWORD PTR [RIP+0x579A] |
| 21C8 | N/A | .text | JMP QWORD PTR [RIP+0x578A] |
| 21D0 | N/A | .text | JMP QWORD PTR [RIP+0x577A] |
| 21D8 | N/A | .text | JMP QWORD PTR [RIP+0x576A] |
| 21E0 | N/A | .text | JMP QWORD PTR [RIP+0x575A] |
| 21E8 | N/A | .text | JMP QWORD PTR [RIP+0x574A] |
| 21F0 | N/A | .text | JMP QWORD PTR [RIP+0x573A] |
| 21F8 | N/A | .text | JMP QWORD PTR [RIP+0x572A] |
| 2200 | N/A | .text | JMP QWORD PTR [RIP+0x571A] |
| 2208 | N/A | .text | JMP QWORD PTR [RIP+0x570A] |
| 2210 | N/A | .text | JMP QWORD PTR [RIP+0x56FA] |
| 2218 | N/A | .text | JMP QWORD PTR [RIP+0x56EA] |
| 2220 | N/A | .text | JMP QWORD PTR [RIP+0x56DA] |
| 2228 | N/A | .text | JMP QWORD PTR [RIP+0x56CA] |
| 22B5 | N/A | .text | CALL QWORD PTR [RIP+0x5665] |
| 1AC2-1ADF | N/A | .text | Unusual NOPS Space, count: 30 |
| 6200 | N/A | *Overlay* | 2E66696C6500000045000000FEFF000067016372 | .file...E.......g.cr |
| 2BF0 | 1930 | .rdata | TLS Callback | Pointer to 140001930 - 0xF30 .text |
| 2BF8 | 1910 | .rdata | TLS Callback | Pointer to 140001910 - 0xF10 .text |
| 2E00 | 1000 | .pdata | ExceptionHook | Pointer to 1000 - 0x600 .text + UnwindInfo: .xdata |
| 2E0C | 1010 | .pdata | ExceptionHook | Pointer to 1010 - 0x610 .text + UnwindInfo: .xdata |
| 2E18 | 13D0 | .pdata | ExceptionHook | Pointer to 13D0 - 0x9D0 .text + UnwindInfo: .xdata |
| 2E24 | 13F0 | .pdata | ExceptionHook | Pointer to 13F0 - 0x9F0 .text + UnwindInfo: .xdata |
| 2E30 | 1410 | .pdata | ExceptionHook | Pointer to 1410 - 0xA10 .text + UnwindInfo: .xdata |
| 2E3C | 1420 | .pdata | ExceptionHook | Pointer to 1420 - 0xA20 .text + UnwindInfo: .xdata |
| 2E48 | 1430 | .pdata | ExceptionHook | Pointer to 1430 - 0xA30 .text + UnwindInfo: .xdata |
| 2E54 | 1440 | .pdata | ExceptionHook | Pointer to 1440 - 0xA40 .text + UnwindInfo: .xdata |
| 2E60 | 15C5 | .pdata | ExceptionHook | Pointer to 15C5 - 0xBC5 .text + UnwindInfo: .xdata |
| 2E6C | 1820 | .pdata | ExceptionHook | Pointer to 1820 - 0xE20 .text + UnwindInfo: .xdata |
| 2E78 | 1860 | .pdata | ExceptionHook | Pointer to 1860 - 0xE60 .text + UnwindInfo: .xdata |
| 2E84 | 18E0 | .pdata | ExceptionHook | Pointer to 18E0 - 0xEE0 .text + UnwindInfo: .xdata |
| 2E90 | 1900 | .pdata | ExceptionHook | Pointer to 1900 - 0xF00 .text + UnwindInfo: .xdata |
| 2E9C | 1910 | .pdata | ExceptionHook | Pointer to 1910 - 0xF10 .text + UnwindInfo: .xdata |
| 2EA8 | 1930 | .pdata | ExceptionHook | Pointer to 1930 - 0xF30 .text + UnwindInfo: .xdata |
| 2EB4 | 19B0 | .pdata | ExceptionHook | Pointer to 19B0 - 0xFB0 .text + UnwindInfo: .xdata |
| 2EC0 | 19C0 | .pdata | ExceptionHook | Pointer to 19C0 - 0xFC0 .text + UnwindInfo: .xdata |
| 2ECC | 1AC0 | .pdata | ExceptionHook | Pointer to 1AC0 - 0x10C0 .text + UnwindInfo: .xdata |
| 2ED8 | 1B20 | .pdata | ExceptionHook | Pointer to 1B20 - 0x1120 .text + UnwindInfo: .xdata |
| 2EE4 | 1C90 | .pdata | ExceptionHook | Pointer to 1C90 - 0x1290 .text + UnwindInfo: .xdata |
| 2EF0 | 2030 | .pdata | ExceptionHook | Pointer to 2030 - 0x1630 .text + UnwindInfo: .xdata |
| 2EFC | 2070 | .pdata | ExceptionHook | Pointer to 2070 - 0x1670 .text + UnwindInfo: .xdata |
| 2F08 | 2080 | .pdata | ExceptionHook | Pointer to 2080 - 0x1680 .text + UnwindInfo: .xdata |
| 2F14 | 2240 | .pdata | ExceptionHook | Pointer to 2240 - 0x1840 .text + UnwindInfo: .xdata |
| 2F20 | 22B0 | .pdata | ExceptionHook | Pointer to 22B0 - 0x18B0 .text + UnwindInfo: .xdata |
| 2F2C | 2330 | .pdata | ExceptionHook | Pointer to 2330 - 0x1930 .text + UnwindInfo: .xdata |
| 2F38 | 23D0 | .pdata | ExceptionHook | Pointer to 23D0 - 0x19D0 .text + UnwindInfo: .xdata |
| 2F44 | 24E0 | .pdata | ExceptionHook | Pointer to 24E0 - 0x1AE0 .text + UnwindInfo: .xdata |
| 2F50 | 24F0 | .pdata | ExceptionHook | Pointer to 24F0 - 0x1AF0 .text + UnwindInfo: .xdata |
| 2F5C | 2500 | .pdata | ExceptionHook | Pointer to 2500 - 0x1B00 .text + UnwindInfo: .xdata |
| 2F68 | 2510 | .pdata | ExceptionHook | Pointer to 2510 - 0x1B10 .text + UnwindInfo: .xdata |
| 2F74 | 2540 | .pdata | ExceptionHook | Pointer to 2540 - 0x1B40 .text + UnwindInfo: .xdata |
| 2F80 | 2590 | .pdata | ExceptionHook | Pointer to 2590 - 0x1B90 .text + UnwindInfo: .xdata |
| 2F8C | 2620 | .pdata | ExceptionHook | Pointer to 2620 - 0x1C20 .text + UnwindInfo: .xdata |
| 2F98 | 26A0 | .pdata | ExceptionHook | Pointer to 26A0 - 0x1CA0 .text + UnwindInfo: .xdata |
| 2FA4 | 26E0 | .pdata | ExceptionHook | Pointer to 26E0 - 0x1CE0 .text + UnwindInfo: .xdata |
| 2FB0 | 2760 | .pdata | ExceptionHook | Pointer to 2760 - 0x1D60 .text + UnwindInfo: .xdata |
| 2FBC | 27A0 | .pdata | ExceptionHook | Pointer to 27A0 - 0x1DA0 .text + UnwindInfo: .xdata |
| 2FC8 | 2830 | .pdata | ExceptionHook | Pointer to 2830 - 0x1E30 .text + UnwindInfo: .xdata |
| 2FD4 | 2940 | .pdata | ExceptionHook | Pointer to 2940 - 0x1F40 .text + UnwindInfo: .xdata |
| 2FE0 | 2980 | .pdata | ExceptionHook | Pointer to 2980 - 0x1F80 .text + UnwindInfo: .xdata |
| 2FEC | 29D0 | .pdata | ExceptionHook | Pointer to 29D0 - 0x1FD0 .text + UnwindInfo: .xdata |
| 2FF8 | 29E0 | .pdata | ExceptionHook | Pointer to 29E0 - 0x1FE0 .text + UnwindInfo: .xdata |
| 3004 | 29F0 | .pdata | ExceptionHook | Pointer to 29F0 - 0x1FF0 .text + UnwindInfo: .xdata |
| 3010 | 2A30 | .pdata | ExceptionHook | Pointer to 2A30 - 0x2030 .text + UnwindInfo: .xdata |
| 301C | 2C30 | .pdata | ExceptionHook | Pointer to 2C30 - 0x2230 .text + UnwindInfo: .xdata |
| 3028 | 2D00 | .pdata | ExceptionHook | Pointer to 2D00 - 0x2300 .text + UnwindInfo: .xdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 26451 | 44,5296% |
| Null Byte Code | 27204 | 45,7972% |
| NOP Cave Found | 0x9090909090 | Block Count: 40 | Total: 0,1683% |
© 2026 All rights reserved.