PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 236,50 KB SHA-256 Hash: C806290DB9B11E7F25D6EDDB9A47C8BAADFD190F1D7CF48DDD8D31B4CD76BC14 SHA-1 Hash: D903D09C594E5C0A85550C19945D6E40336D8B11 MD5 Hash: 089537B55937883887885657E414735A Imphash: 521059E78ED9F18F51FD1CF507D0DF65 MajorOSVersion: 5 MinorOSVersion: 1 CheckSum: 0004A75E EntryPoint (rva): 15832 SizeOfHeaders: 400 SizeOfImage: 43000 ImageBase: 10000000 Architecture: x86 ExportTable: 322D0 ImportTable: 30CE4 Characteristics: 2102 TimeDateStamp: 69283DDD Date: 27/11/2025 12:02:37 File Type: DLL Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 28E00 | 1000 | 29000 |
|
|
| .rdata | 0xC0000040 Initialized Data Readable Writeable |
29200 | 8400 | 2A000 | 9000 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
31600 | 7200 | 33000 | B000 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
38800 | 400 | 3E000 | 1000 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
38C00 | 2600 | 3F000 | 4000 |
|
|
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 14C32 Code -> 8BFF558BEC837D0C017505E86D820000FF75088B4D108B550CE8ECFEFFFF595DC20C008BFF558BEC83EC208B450856576A08 Assembler |MOV EDI, EDI |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X10015842 |CALL 0X1001DAAF |PUSH DWORD PTR [EBP + 8] |MOV ECX, DWORD PTR [EBP + 0X10] |MOV EDX, DWORD PTR [EBP + 0XC] |CALL 0X1001573C |POP ECX |POP EBP |RET 0XC |MOV EDI, EDI |PUSH EBP |MOV EBP, ESP |SUB ESP, 0X20 |MOV EAX, DWORD PTR [EBP + 8] |PUSH ESI |PUSH EDI |PUSH 8 |
| Signatures |
| CheckSum Integrity Problem: • Header: 304990 • Calculated: 279223 Rich Signature Analyzer: Code -> F04E6C29B42F027AB42F027AB42F027ADB599C7AAD2F027ADB59A87A202F027ADB59A97A8B2F027ABD57817AB02F027ABD57917AAF2F027AB42F037AB52E027ADB59AD7AA62F027ADB59997AB52F027ADB599F7AB52F027A52696368B42F027A Footprint md5 Hash -> 8D42FAC1D8D2A722981D2227085D3601 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: EP:Microsoft Visual C/C++(2008-2010)[DLL32] • PE: compiler: Microsoft Visual C/C++(2010)[libcmt] • PE: linker: Microsoft Linker(10.0)[-] • Entropy: 6.30613 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | IsBadReadPtr | Checks whether memory is readable. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| WININET.DLL | InternetOpenW | Initializes an application’s use of the WinINet functions. |
| WININET.DLL | InternetReadFile | Reads data from an Internet resource. |
| ET Functions (carving) |
| Original Name -> .dll run |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\Windows NT\CurrentVersion Software\Tencent\Plugin\VAS |
| File Access |
| .dll DINPUT8.dll PSAPI.DLL dxgi.dll gdiplus.dll WINMM.dll WS2_32.dll OLEAUT32.dll ole32.dll SHELL32.dll ADVAPI32.dll GDI32.dll USER32.dll KERNEL32.dll kernel32.dll NtDll.dll .dat Temp |
| File Access (UNICODE) |
| X360Safe.exe 360Tray.exe 360tray.exe ZhuDongFangYu.exe k360sd.exe kxetray.exe KSafeTray.exe kscan.exe kwsprotect64.exe kxescore.exe QQPCRTP.exe QMDL.exe QMPersonalCenter.exe QQPCPatch.exe QQPCRealTimeSpeedup.exe QQPCTray.exe QQRepair.exe HipsTray.exe HipsMain.exe HipsDaemon.exe BaiduSd.exe baiduSafeTray.exe KvMonXP.exe RavMonD.exe QUHLPSVC.EXE mssecess.exe cfp.exe SPIDer.exe acs.exe V3Svc.exe avgwdsvc.exe f-secure.exe avp.exe avpui.exe TaUMcshield.exe egui.exe knsdtray.exe TMBMSRV.exe \~Oavcenter.exe hQashDisp.exe rtvscan.exe remupd.exe vsserv.exe PSafeSysTray.exe ad-watch.exe K7TSecurity.exe UnThreat.exe LenovoTray.exe msmpeng.exe MsMpEng.exe Telegram.exe WeChat.exe WXWork.exe DingTalk.exe QQ.exe wininet.dll GetNativeSystemInfontdll.dll kernel32.dll GetLastActivePopupGetActiveWindowMessageBoxWUSER32.DLL KERNEL32.DLL exppowCorExitProcessmscoree.dll \DisplaySessionContainers.log Temp |
| Interest's Words |
| lockbit PADDINGX exec attrib start shutdown systeminfo expand |
| Interest's Words (UNICODE) |
| shutdown at.exe |
| Anti-VM/Sandbox/Debug Tricks (UNICODE) |
| LabTools - wireshark |
| AV Services (UNICODE) |
| avp.exe - (Kaspersky AntiVirus) vsserv.exe - (BitDefender) avgwdsvc.exe - (AVG Watchdog) egui.exe - (ESET) ad-watch.exe - (Ad-Aware) avcenter.exe - (Avira) msmpeng.exe - (Defender) ashdisp.exe - (Avast) tmbmsrv.exe - (Trend Micro) 360safe.exe 360tray.exe 360sd.exe zhudongfangyu.exe qqpcrtp.exe baidusd.exe ravmond.exe kvmonxp.exe kxetray.exe |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | Antivirus Software (BitDefender) |
| Text | Unicode | Antivirus Software (F-Secure AV) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Unicode | Keyboard Key ([F1]) |
| Text | Unicode | Keyboard Key ([F2]) |
| Text | Unicode | Keyboard Key ([F3]) |
| Text | Unicode | Keyboard Key ([F4]) |
| Text | Unicode | Keyboard Key ([F5]) |
| Text | Unicode | Keyboard Key ([F6]) |
| Text | Unicode | Keyboard Key ([F7]) |
| Text | Unicode | Keyboard Key ([F8]) |
| Text | Unicode | Keyboard Key ([F9]) |
| Text | Unicode | Keyboard Key ([F10]) |
| Text | Unicode | Keyboard Key ([F11]) |
| Text | Unicode | Keyboard Key ([F12]) |
| Text | Ascii | Threat focused on obtaining CVV codes to conduct unauthorized transactions (CVV) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 3E058 | 15A | 38858 | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122 | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" |
| Intelligent String |
| • kernel32.dll • mscoree.dll • KERNEL32.DLL • QQ.exe • DingTalk.exe • WXWork.exe • WeChat.exe • Telegram.exe • MsMpEng.exe • msmpeng.exe • LenovoTray.exe • UnThreat.exe • K7TSecurity.exe • ad-watch.exe • PSafeSysTray.exe • vsserv.exe • remupd.exe • rtvscan.exe • ashDisp.exe • avcenter.exe • TMBMSRV.exe • knsdtray.exe • egui.exe • Mcshield.exe • avpui.exe • avp.exe • f-secure.exe • avgwdsvc.exe • AYAgent.aye • V3Svc.exe • acs.exe • DR.WEB • SPIDer.exe • cfp.exe • mssecess.exe • QUHLPSVC.EXE • RavMonD.exe • KvMonXP.exe • BaiduSd.exe • HipsDaemon.exe • HipsMain.exe • HipsTray.exe • QQRepair.exe • QQPCTray.exe • QQPCRealTimeSpeedup.exe • QQPCPatch.exe • QMPersonalCenter.exe • QMDL.exe • QQPCRTP.exe • kxescore.exe • kwsprotect64.exe • kscan.exe • KSafeTray.exe • kxetray.exe • 360sd.exe • ZhuDongFangYu.exe • 360tray.exe • 360Tray.exe • 360Safe.exe • wininet.dll • \DisplaySessionContainers.log • USER32.dll • gdiplus.dll • PSAPI.DLL |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 41B | 1002A204 | .text | CALL [static] | Indirect call to absolute memory address |
| 455 | 1002A204 | .text | CALL [static] | Indirect call to absolute memory address |
| 4BF | 1002A298 | .text | CALL [static] | Indirect call to absolute memory address |
| 4F2 | 1002A204 | .text | CALL [static] | Indirect call to absolute memory address |
| 586 | 1002A298 | .text | CALL [static] | Indirect call to absolute memory address |
| 5B5 | 1002A204 | .text | CALL [static] | Indirect call to absolute memory address |
| 601 | 1002A208 | .text | CALL [static] | Indirect call to absolute memory address |
| 6A3 | 1002A214 | .text | CALL [static] | Indirect call to absolute memory address |
| 72B | 1002A230 | .text | CALL [static] | Indirect call to absolute memory address |
| 79D | 1002A224 | .text | CALL [static] | Indirect call to absolute memory address |
| 82D | 1002A220 | .text | CALL [static] | Indirect call to absolute memory address |
| 83B | 1002A220 | .text | CALL [static] | Indirect call to absolute memory address |
| 85B | 1002A220 | .text | CALL [static] | Indirect call to absolute memory address |
| 8CC | 1002A220 | .text | CALL [static] | Indirect call to absolute memory address |
| 8DD | 1002A220 | .text | CALL [static] | Indirect call to absolute memory address |
| 904 | 1002A220 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F1A | 1002A1EC | .text | CALL [static] | Indirect call to absolute memory address |
| 1F8A | 1002A1E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 200A | 1002A330 | .text | CALL [static] | Indirect call to absolute memory address |
| 2015 | 1002A1C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2023 | 1002A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 207C | 1002A33C | .text | CALL [static] | Indirect call to absolute memory address |
| 2086 | 1002A1C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 208F | 1002A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2099 | 1002A34C | .text | CALL [static] | Indirect call to absolute memory address |
| 20A3 | 1002A1FC | .text | CALL [static] | Indirect call to absolute memory address |
| 20DB | 1002A1CC | .text | CALL [static] | Indirect call to absolute memory address |
| 20E7 | 1002A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 20ED | 1002A314 | .text | CALL [static] | Indirect call to absolute memory address |
| 211A | 1002A348 | .text | CALL [static] | Indirect call to absolute memory address |
| 2146 | 1002A1D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2152 | 1002A1D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2171 | 1002A1D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 217D | 1002A1D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 218B | 1002A350 | .text | CALL [static] | Indirect call to absolute memory address |
| 21AD | 1002A338 | .text | CALL [static] | Indirect call to absolute memory address |
| 21CB | 1002A32C | .text | CALL [static] | Indirect call to absolute memory address |
| 228C | 1002A328 | .text | CALL [static] | Indirect call to absolute memory address |
| 2297 | 1002A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2363 | 1002A334 | .text | CALL [static] | Indirect call to absolute memory address |
| 2444 | 1002A314 | .text | CALL [static] | Indirect call to absolute memory address |
| 248F | 1002A15C | .text | CALL [static] | Indirect call to absolute memory address |
| 24A3 | 1002A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 257D | 1002A15C | .text | CALL [static] | Indirect call to absolute memory address |
| 25E1 | 1002A354 | .text | CALL [static] | Indirect call to absolute memory address |
| 261E | 1002A354 | .text | CALL [static] | Indirect call to absolute memory address |
| 2676 | 1002A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2766 | 1002A314 | .text | CALL [static] | Indirect call to absolute memory address |
| 297E | 1002A1CC | .text | CALL [static] | Indirect call to absolute memory address |
| 299D | 1002A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 29C9 | 1002A1F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 29F7 | 1002A1B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AA0 | 1002A348 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AD9 | 1002A328 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B0B | 1002A374 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B1D | 1002A1D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B29 | 1002A1D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B48 | 1002A1D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B54 | 1002A1D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B62 | 1002A350 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B88 | 1002A338 | .text | CALL [static] | Indirect call to absolute memory address |
| 2BA6 | 1002A368 | .text | CALL [static] | Indirect call to absolute memory address |
| 2BBB | 1002A32C | .text | CALL [static] | Indirect call to absolute memory address |
| 2BCA | 1002A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C13 | 1002A15C | .text | CALL [static] | Indirect call to absolute memory address |
| 2C54 | 1002A1BC | .text | CALL [static] | Indirect call to absolute memory address |
| 2CC1 | 1002A324 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CEC | 1002A15C | .text | CALL [static] | Indirect call to absolute memory address |
| 2D84 | 1002A1F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DB2 | 1002A1E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DC9 | 1002A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E18 | 1002A364 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F15 | 1002A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F52 | 1002A320 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F92 | 1002A368 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F9D | 1002A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 2FE8 | 1002A354 | .text | CALL [static] | Indirect call to absolute memory address |
| 2FF3 | 1002A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 304F | 1002A344 | .text | CALL [static] | Indirect call to absolute memory address |
| 308A | 1002A1E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 30D5 | 1002A1F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 310B | 1002A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 3132 | 1002A31C | .text | CALL [static] | Indirect call to absolute memory address |
| 3195 | 1002A20C | .text | CALL [static] | Indirect call to absolute memory address |
| 31E0 | 1002A214 | .text | CALL [static] | Indirect call to absolute memory address |
| 31FE | 1002A354 | .text | CALL [static] | Indirect call to absolute memory address |
| 3211 | 1002A20C | .text | CALL [static] | Indirect call to absolute memory address |
| 3224 | 1002A214 | .text | CALL [static] | Indirect call to absolute memory address |
| 324C | 1002A224 | .text | CALL [static] | Indirect call to absolute memory address |
| 3257 | 1002A360 | .text | CALL [static] | Indirect call to absolute memory address |
| 326B | 1002A20C | .text | CALL [static] | Indirect call to absolute memory address |
| 32A4 | 1002A214 | .text | CALL [static] | Indirect call to absolute memory address |
| 32E1 | 1002A224 | .text | CALL [static] | Indirect call to absolute memory address |
| 32F5 | 1002A15C | .text | CALL [static] | Indirect call to absolute memory address |
| 3357 | 1002A354 | .text | CALL [static] | Indirect call to absolute memory address |
| 337A | 1002A1FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3386 | 1002A1D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3394 | 1002A35C | .text | CALL [static] | Indirect call to absolute memory address |
| 33AC | 1002A36C | .text | CALL [static] | Indirect call to absolute memory address |
| 33B6 | 1002A34C | .text | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 132644 | 54,7717% |
| Null Byte Code | 52246 | 21,5736% |
© 2026 All rights reserved.