PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Icon: Icon
Size: 355,50 KB
SHA-256 Hash: 5B64A29312160AE71569BB1722EC910FB3A49C028AD1033E44158C4E82039E9A
SHA-1 Hash: 7292943A3A5CE8127049838E3EED9431D027853A
MD5 Hash: 0A92AF8B408E192EB3A227D2CBA132AE
Imphash: D4B7EC1A8978A3B887633CE028535593
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): 1000
SizeOfHeaders: 400
SizeOfImage: DA000
ImageBase: 400000
Architecture: x86
ImportTable: CC8F4
Characteristics: 818E
TimeDateStamp: 56C4F4C6
Date: 17/02/2016 22:31:34
File Type: EXE
Number Of Sections: 12
ASLR: Disabled
Section Names (Optional Header): *unnamed*, *unnamed*, *unnamed*, *unnamed*, *unnamed*, *unnamed*, *unnamed*, *unnamed*, *unnamed*, .rsrc, .data, .data
Number Of Executable Sections: 0
Subsystem: Windows GUI
[Incomplete Binary or Compressor Packer - 516,50 KB Missing]
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 400 39800 1000 9B000
7.999
327.65
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 39C00 600 9C000 1000
7.585
3343.67
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 3A200 7800 9D000 D000
7.9917
361.23
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 41A00 0 AA000 6000
N/A
N/A
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 41A00 400 B0000 3000
6.4797
17023
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 41E00 200 B3000 1000
0
130560
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 42000 0 B4000 1000
N/A
N/A
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 42000 200 B5000 1000
0.2108
124998
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 42200 0 B6000 C000
N/A
N/A
.rsrc
0xC0000040
Initialized Data
Readable
Writeable
 42200 9E00 C2000 A000
4.8331
1523762.37
.data
0xC0000040
Initialized Data
Readable
Writeable
 4C000 CE00 CC000 D000
7.774
48583.5
.data
0xC0000040
Initialized Data
Readable
Writeable
 58E00 0 D9000 1000
N/A
N/A
Entry Point
The section number (9) have the Entry Point
Information -> EntryPoint (calculated) - 400
Code -> 6801C04C00C3AA8034C7EDDDFD24D90D0DD8106421166948211016460A10844D248421EFB2427A10F5A292301102C9BB20A8
Assembler
|PUSH 0X4CC001
|RET
|STOSB BYTE PTR ES:[EDI], AL
|XOR BYTE PTR [EDI + EAX*8], 0XED
Signatures
Certificate - Digital Signature Not Found:
• The file is not signed
Duplicate Sections
Section *unnamed* duplicate 9 times
Section .data duplicate 2 times
Packer/Compiler
Detect It Easy (die)
• PE: protector: ASProtect(1.2)[-]
• PE: compiler: Embarcadero Delphi(2009-2010)[-]
• PE: linker: Turbo Linker(2.25*,Delphi)[-]
• Entropy: 7.82122
Suspicious Functions
Library Function Description
KERNEL32.DLL GetModuleHandleA Retrieves a handle to the specified module.
KERNEL32.DLL LoadLibraryA Loads the specified module into the address space of the calling process.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
ADVAPI32.DLL RegSetValueExA Sets the data and type of a specified value under a registry key.
File Access
keygen.dll
comdlg32.dll
comctl32.dll
oleaut32.dll
ole32.dll
advapi32.dll
mpr.dll
version.dll
gdi32.dll
user32.dll
kernel32.dll
.dat
TSaveDialogSaveDialog1FilterIni File|*.Ini
TOpenDialogOpenDialog1FilterIni File|*.Ini
File Access (UNICODE)
Temp
Interest's Words
PassWord
exec
start
Interest's Words (UNICODE)
start
hostname
expand
replace
route
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Unicode WinAPI Sockets (bind)
Text Unicode WinAPI Sockets (connect)
Text Unicode WinAPI Sockets (send)
Text Ascii Registry (RegSetValueEx)
Text Ascii Encryption (Blowfish)
Text Ascii Encryption (Rijndael)
Text Ascii Encryption (Twofish)
Text Unicode Keyboard Key (Alt+)
Text Ascii Technique used to capture communications between systems (Intercept)
Entry Point Hex Pattern ASProtect v1.2
Resources
Path DataRVA Size FileOffset CodeText
\CURSOR\1\1033 C2CE8 134 42EE8 070001002800000020000000400000000100010000000000000200000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\CURSOR\2\1033 C2E1C 134 4301C 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF....(... ...@.....................................
\CURSOR\3\1033 C2F50 134 43150 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF....(... ...@.....................................
\CURSOR\4\1033 C3084 134 43284 0E000C002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF....(... ...@.....................................
\CURSOR\5\1033 C31B8 134 433B8 10000E002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\CURSOR\6\1033 C32EC 134 434EC 000000002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\CURSOR\7\1033 C3420 134 43620 020002002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\BITMAP\BBABORT\1033 C3554 1D0 43754 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\BBALL\1033 C3724 1E4 43924 28000000240000001300000001000400000000007C0100000000000000000000100000000000000000000000000080000080(...$...............|.............................
\BITMAP\BBCANCEL\1033 C3908 1D0 43B08 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\BBCLOSE\1033 C3AD8 1D0 43CD8 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\BBHELP\1033 C3CA8 1D0 43EA8 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\BBIGNORE\1033 C3E78 1D0 44078 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\BBNO\1033 C4048 1D0 44248 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\BBOK\1033 C4218 1D0 44418 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\BBRETRY\1033 C43E8 1D0 445E8 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\BBYES\1033 C45B8 1D0 447B8 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080(...$...............h.............................
\BITMAP\PREVIEWGLYPH\1033 C4788 E8 44988 2800000010000000100000000100040000000000800000000000000000000000000000000000000000000000000080000080(.................................................
\ICON\1\3073 C4870 128 44A70 2800000010000000200000000100040000000000C00000000000000000000000100000000000000000000000000080000080(....... .........................................
\ICON\2\3073 C4998 568 44B98 2800000010000000200000000100080000000000400100000000000000000000000100000000000000000000000080000080(....... ...........@.............................
\ICON\3\3073 C4F00 2E8 45100 2800000020000000400000000100040000000000800200000000000000000000100000000000000000000000000080000080(... ...@.........................................
\ICON\4\3073 C51E8 8A8 453E8 2800000020000000400000000100080000000000800400000000000000000000000100000000000000000000000080000080(... ...@.........................................
\DIALOG\DLGTEMPLATE\0 C5A90 52 45C90 44040054000000000100000000003C014C0000000000000008004D0053002000530061006E00730020005300650072006900660000000000000002400000000000000000CC004C005F04FFFF820000000000D..T..........<.L.........M.S. .S.a.n.s. .S.e.r.i.f........@..........L._.........
\DIALOG\TEXTFILEDLG\0 C5AE4 52 45CE4 44040054000000000100000000003C014C0000000000000008004D0053002000530061006E007300200053006500720069006600000000000000024000000000000000003C0137005F04FFFF820000000000D..T..........<.L.........M.S. .S.a.n.s. .S.e.r.i.f........@........<.7._.........
\STRING\4075\0 C5B38 15C 45D38 1E005400720061006E00730070006100720065006E0074002000700072006F00780079002000630061006E006E006F007400..T.r.a.n.s.p.a.r.e.n.t. .p.r.o.x.y. .c.a.n.n.o.t.
\STRING\4076\0 C5C94 2DC 45E94 130043006F006E006E0065006300740069006F006E00200072006500660075007300650064002E000C00540054004C002000..C.o.n.n.e.c.t.i.o.n. .r.e.f.u.s.e.d.....T.T.L. .
\STRING\4077\0 C5F70 458 46170 3A005400680065002000720065007100750065007300740065006400200049005000560065007200730069006F006E002000:.T.h.e. .r.e.q.u.e.s.t.e.d. .I.P.V.e.r.s.i.o.n. .
\STRING\4078\0 C63C8 394 465C8 1300460069006C00650020006E0061006D006500200074006F006F0020006C006F006E0067002E000D0048006F0073007400..F.i.l.e. .n.a.m.e. .t.o.o. .l.o.n.g.....H.o.s.t.
\STRING\4079\0 C675C 3C4 4695C 300041006400640072006500730073002000660061006D0069006C00790020006E006F007400200073007500700070006F000.A.d.d.r.e.s.s. .f.a.m.i.l.y. .n.o.t. .s.u.p.p.o.
\STRING\4080\0 C6B20 320 46D20 0E004100630063006500730073002000640065006E006900650064002E000D00420075006600660065007200200066006100..A.c.c.e.s.s. .d.e.n.i.e.d.....B.u.f.f.e.r. .f.a.
\STRING\4081\0 C6E40 398 47040 22004600610069006C0065006400200074006F00200073006500740020007400610062002000220025007300220020006100".F.a.i.l.e.d. .t.o. .s.e.t. .t.a.b. .".%.s.". .a.
\STRING\4082\0 C71D8 340 473D8 25004500720072006F0072002000720065006D006F00760069006E006700200063006F006E00740072006F006C0020006600%.E.r.r.o.r. .r.e.m.o.v.i.n.g. .c.o.n.t.r.o.l. .f.
\STRING\4083\0 C7518 1DC 47718 040048006F006D00650004004C00650066007400020055007000050052006900670068007400040044006F0077006E000300..H.o.m.e...L.e.f.t...U.p...R.i.g.h.t...D.o.w.n...
\STRING\4084\0 C76F4 CC 478F4 0600430061006E00630065006C0005002600480065006C00700006002600410062006F007200740006002600520065007400..C.a.n.c.e.l...&.H.e.l.p...&.A.b.o.r.t...&.R.e.t.
\STRING\4085\0 C77C0 188 479C0 0500410062006F00720074000400260041006C006C001200430061006E006E006F0074002000640072006100670020006100..A.b.o.r.t...&.A.l.l...C.a.n.n.o.t. .d.r.a.g. .a.
\STRING\4086\0 C7948 294 47B48 1800250073002000700072006F007000650072007400790020006F007500740020006F0066002000720061006E0067006500..%.s. .p.r.o.p.e.r.t.y. .o.u.t. .o.f. .r.a.n.g.e.
\STRING\4087\0 C7BDC 3FC 47DDC 17004F007500740020006F0066002000730079007300740065006D0020007200650073006F00750072006300650073001D00..O.u.t. .o.f. .s.y.s.t.e.m. .r.e.s.o.u.r.c.e.s...
\STRING\4088\0 C7FD8 3C4 481D8 1A00500072006F0070006500720074007900200025007300200064006F006500730020006E006F0074002000650078006900..P.r.o.p.e.r.t.y. .%.s. .d.o.e.s. .n.o.t. .e.x.i.
\STRING\4089\0 C839C 384 4859C 150049006E00760061006C00690064002000700072006F007000650072007400790020007000610074006800160049006E00..I.n.v.a.l.i.d. .p.r.o.p.e.r.t.y. .p.a.t.h...I.n.
\STRING\4090\0 C8720 404 48920 1B0041006E0063006500730074006F007200200066006F0072002000270025007300270020006E006F007400200066006F00..A.n.c.e.s.t.o.r. .f.o.r. .'.%.s.'. .n.o.t. .f.o.
\STRING\4091\0 C8B24 D0 48D24 08004E006F00760065006D00620065007200080044006500630065006D006200650072000300530075006E0003004D006F00..N.o.v.e.m.b.e.r...D.e.c.e.m.b.e.r...S.u.n...M.o.
\STRING\4092\0 C8BF4 B8 48DF4 03004A0075006C000300410075006700030053006500700003004F006300740003004E006F00760003004400650063000700..J.u.l...A.u.g...S.e.p...O.c.t...N.o.v...D.e.c...
\STRING\4093\0 C8CAC 254 48EAC 180055006E00650078007000650063007400650064002000760061007200690061006E00740020006500720072006F007200..U.n.e.x.p.e.c.t.e.d. .v.a.r.i.a.n.t. .e.r.r.o.r.
\STRING\4094\0 C8F00 3B8 49100 1B004E006F00200061007200670075006D0065006E007400200066006F007200200066006F0072006D006100740020002700..N.o. .a.r.g.u.m.e.n.t. .f.o.r. .f.o.r.m.a.t. .'.
\STRING\4095\0 C92B8 354 494B8 1100520061006E0067006500200063006800650063006B0020006500720072006F007200100049006E007400650067006500..R.a.n.g.e. .c.h.e.c.k. .e.r.r.o.r...I.n.t.e.g.e.
\STRING\4096\0 C960C 2D4 4980C 2100270025007300270020006900730020006E006F007400200061002000760061006C0069006400200069006E0074006500!.'.%.s.'. .i.s. .n.o.t. .a. .v.a.l.i.d. .i.n.t.e.
\RCDATA\DVCLAL\0 C98E0 10 49AE0 A28CDF987B3C3A7926713F090F2A2517....{<:y&q?..*%.
\RCDATA\PACKAGEINFO\0 C98F0 588 49AF0 000010CC000000007C00000001E2526567697374657200100B4964494F48616E646C6572537461636B001002537973557469........|.....Register...IdIOHandlerStack...SysUti
\RCDATA\TFORM1\0 C9E78 1983 4A078 545046300654466F726D3105466F726D31044C656674025403546F70039B0008426944694D6F6465070D6264526967687454TPF0.TForm1.Form1.Left.T.Top....BiDiMode..bdRightT
\GROUP_CURSOR\32761\1033 CB7FC 14 4B9FC 0000020001002000400001000100340100000100...... .@.....4.....
\GROUP_CURSOR\32762\1033 CB810 14 4BA10 0000020001002000400001000100340100000200...... .@.....4.....
\GROUP_CURSOR\32763\1033 CB824 14 4BA24 0000020001002000400001000100340100000300...... .@.....4.....
\GROUP_CURSOR\32764\1033 CB838 14 4BA38 0000020001002000400001000100340100000400...... .@.....4.....
\GROUP_CURSOR\32765\1033 CB84C 14 4BA4C 0000020001002000400001000100340100000500...... .@.....4.....
\GROUP_CURSOR\32766\1033 CB860 14 4BA60 0000020001002000400001000100340100000600...... .@.....4.....
\GROUP_CURSOR\32767\1033 CB874 14 4BA74 0000020001002000400001000100340100000700...... .@.....4.....
\GROUP_ICON\MAINICON\3073 CB888 3E 4BA88 000001000400101010000100040028010000010010100000010008006805000002002020100001000400E802000003002020000001000800A80800000400..............(.............h..... ............ ............
\24\1\3073 CB8C8 351 4BAC8 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279<?xml version="1.0" encoding="UTF-8" standalone="y
Intelligent String
• kernel32.dll
Flow Anomalies
Offset RVA Section Description
1FFA 5E4FB9D8 *unnamed* CALL [static] | Indirect call to absolute memory address
D178 344F65A8 *unnamed* CALL [static] | Indirect call to absolute memory address
E1CE 7BE87BF *unnamed* JMP [static] | Indirect jump to absolute memory address
23ED9 7BE87BF *unnamed* JMP [static] | Indirect jump to absolute memory address
2706F 7BE87BF *unnamed* JMP [static] | Indirect jump to absolute memory address
2A909 7F319D49 *unnamed* JMP [static] | Indirect jump to absolute memory address
39E75 7C4478B9 *unnamed* CALL [static] | Indirect call to absolute memory address
4DA80 7C4478B9 .data CALL [static] | Indirect call to absolute memory address
4ECB7 1B921856 .data JMP [static] | Indirect jump to absolute memory address
4F1AA 73E5D685 .data CALL [static] | Indirect call to absolute memory address
534BC 73E5D685 .data CALL [static] | Indirect call to absolute memory address
53714 73E5D685 .data JMP [static] | Indirect jump to absolute memory address
Extra Analysis
Metric Value Percentage
Ascii Code 241309 66,2879%
Null Byte Code 21912 6,0193%
© 2026 All rights reserved.