PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 326,00 KB SHA-256 Hash: 958CF7E879FF5A52E365859B81D2AC1F4B198E05E873B438F147DD5975ED77E1 SHA-1 Hash: C8EAA68324CF39D681AF0FB60E0DC92D310C2F80 MD5 Hash: 1B8128CA311379EFF8A70C9E3CF8E766 Imphash: E39DDFD958BA9A668DFAF494CB1AFB53 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 166E4 SizeOfHeaders: 400 SizeOfImage: 58000 ImageBase: 10000000 Architecture: x86 ExportTable: 47B50 ImportTable: 47B98 Characteristics: 2102 TimeDateStamp: 6A7BD241 Date: 12/08/2026 1:54:09 File Type: DLL Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .fptable, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 37600 | 1000 | 38000 |
|
|
| .rdata | 0xC0000040 Initialized Data Readable Writeable |
37A00 | 10600 | 39000 | 11000 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
48000 | 6800 | 4A000 | A000 |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
4E800 | 0 | 54000 | 1000 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
4E800 | 3000 | 55000 | 3000 |
|
|
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 15AE4 Code -> 558BEC837D0C017505E8A0060000FF7510FF750CFF7508E8ABFEFFFF83C40C5DC20C008B4DF464890D00000000595F5F5E5B Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X100166F2 |CALL 0X10016D92 |PUSH DWORD PTR [EBP + 0X10] |PUSH DWORD PTR [EBP + 0XC] |PUSH DWORD PTR [EBP + 8] |CALL 0X100165AB |ADD ESP, 0XC |POP EBP |RET 0XC |MOV ECX, DWORD PTR [EBP - 0XC] |MOV DWORD PTR FS:[0], ECX |POP ECX |POP EDI |POP EDI |POP ESI |POP EBX |
| Signatures |
| Rich Signature Analyzer: Code -> 50FB9A35149AF466149AF466149AF4666D1BF767189AF4666D1BF167BB9AF4666D1BF267159AF4667BEC5F66159AF4661DE26766169AF4661DE27766159AF466C6C86866169AF4666D1BF367159AF4669313F767039AF4669313F067059AF4669313F167459AF4666D1BF0670E9AF4666D1BF567039AF466149AF566549BF4669A13FD67079AF4669A13F467159AF4669A13F667159AF46652696368149AF466 Footprint md5 Hash -> B38E59FECDF3B991AFA9B7FBF08DF6CC • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: linker: Microsoft Linker(14.44**)[-] • Entropy: 6.36321 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | CreateRemoteThread | Creates a thread in the address space of another process. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | GetThreadContext | Retrieves a thread execution context. |
| KERNEL32.DLL | SetThreadContext | Modifies a thread execution context. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | IsBadReadPtr | Checks whether memory is readable. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| KERNEL32.DLL | WinExec | Launches a specified application. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| KERNEL32.DLL | VirtualAllocEx | Allocates memory within the virtual address space of another process. |
| KERNEL32.DLL | VirtualProtectEx | Changes the protection on a region of memory in another process. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| WININET.DLL | InternetOpenW | Initializes an application’s use of the WinINet functions. |
| WININET.DLL | InternetReadFile | Reads data from an Internet resource. |
| ET Functions (carving) |
| Original Name -> .dll run |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall SOFTWARE\Microsoft\Windows NT\CurrentVersion |
| File Access |
| Windows\System32\svchost.exe Windows\SysWOW64\svchost.exe dxgi.dll gdiplus.dll WINMM.dll bcrypt.dll WS2_32.dll OLEAUT32.dll ole32.dll ADVAPI32.dll GDI32.dll USER32.dll KERNEL32.dll .dll NtDll.dll .dat |
| File Access (UNICODE) |
| ExitProcessWinExecWaitForSingleObject%swininet.dll ntdll.dll 9kernel32.dll mscoree.dll |
| SQL Queries |
| SELECT displayName FROM AntiVirusProduct |
| Interest's Words |
| lockbit exec attrib start shutdown systeminfo expand |
| Interest's Words (UNICODE) |
| Virus start shutdown |
| Anti-VM/Sandbox/Debug Tricks (UNICODE) |
| LabTools - wireshark |
| AV Services (UNICODE) |
| securitycenter2.exe - (SecurityCenter2) |
| IP Addresses |
| 103.199.102.27 127.0.0.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Hex | Hex Pattern | PEB AntiDebug (Flag BeingDebugged) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Unicode | Keyboard Key ([F1]) |
| Text | Unicode | Keyboard Key ([F2]) |
| Text | Unicode | Keyboard Key ([F3]) |
| Text | Unicode | Keyboard Key ([F4]) |
| Text | Unicode | Keyboard Key ([F5]) |
| Text | Unicode | Keyboard Key ([F6]) |
| Text | Unicode | Keyboard Key ([F7]) |
| Text | Unicode | Keyboard Key ([F8]) |
| Text | Unicode | Keyboard Key ([F9]) |
| Text | Unicode | Keyboard Key ([F10]) |
| Text | Unicode | Keyboard Key ([F11]) |
| Text | Unicode | Keyboard Key ([F12]) |
| Entry Point | Hex Pattern | fasm - Tomasz Grysztar |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Intelligent String |
| • mscoree.dll • 9kernel32.dll • ntdll.dll • Windows\SysWOW64\svchost.exe • Windows\System32\svchost.exe • OpenProcessKernel32.dll • wininet.dll • Global\MyUniqueApp_SingleInstance • .tls • .bss • bcrypt.dll • gdiplus.dll • 103.199.102.27 • 127.0.0.1 |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 41E | 100393C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 460 | 10039168 | .text | CALL [static] | Indirect call to absolute memory address |
| 755 | 10039284 | .text | CALL [static] | Indirect call to absolute memory address |
| 75F | 1003927C | .text | CALL [static] | Indirect call to absolute memory address |
| 78B | 10039274 | .text | CALL [static] | Indirect call to absolute memory address |
| 7B0 | 10039264 | .text | CALL [static] | Indirect call to absolute memory address |
| 7EF | 10039278 | .text | CALL [static] | Indirect call to absolute memory address |
| 80B | 10039280 | .text | CALL [static] | Indirect call to absolute memory address |
| 83A | 1003926C | .text | CALL [static] | Indirect call to absolute memory address |
| 893 | 10039260 | .text | CALL [static] | Indirect call to absolute memory address |
| A9B | 10039254 | .text | CALL [static] | Indirect call to absolute memory address |
| AD5 | 10039254 | .text | CALL [static] | Indirect call to absolute memory address |
| C1B | 10039258 | .text | CALL [static] | Indirect call to absolute memory address |
| C4D | 1003925C | .text | CALL [static] | Indirect call to absolute memory address |
| CE6 | 10039258 | .text | CALL [static] | Indirect call to absolute memory address |
| D16 | 1003925C | .text | CALL [static] | Indirect call to absolute memory address |
| D51 | 10039268 | .text | CALL [static] | Indirect call to absolute memory address |
| EE7 | 10039264 | .text | CALL [static] | Indirect call to absolute memory address |
| F32 | 1003926C | .text | CALL [static] | Indirect call to absolute memory address |
| F41 | 10039250 | .text | CALL [static] | Indirect call to absolute memory address |
| FD2 | 10039244 | .text | CALL [static] | Indirect call to absolute memory address |
| 10B6 | 10039274 | .text | CALL [static] | Indirect call to absolute memory address |
| 11B5 | 10039264 | .text | CALL [static] | Indirect call to absolute memory address |
| 26D9 | 10039234 | .text | CALL [static] | Indirect call to absolute memory address |
| 27F6 | 100393C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2804 | 10039214 | .text | CALL [static] | Indirect call to absolute memory address |
| 287B | 10039378 | .text | CALL [static] | Indirect call to absolute memory address |
| 2884 | 1003921C | .text | CALL [static] | Indirect call to absolute memory address |
| 2891 | 100393BC | .text | CALL [static] | Indirect call to absolute memory address |
| 289A | 10039238 | .text | CALL [static] | Indirect call to absolute memory address |
| 28D1 | 10039210 | .text | CALL [static] | Indirect call to absolute memory address |
| 28DE | 10039370 | .text | CALL [static] | Indirect call to absolute memory address |
| 28FC | 100393D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2917 | 10039218 | .text | CALL [static] | Indirect call to absolute memory address |
| 2944 | 10039218 | .text | CALL [static] | Indirect call to absolute memory address |
| 2959 | 100393C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2980 | 1003937C | .text | CALL [static] | Indirect call to absolute memory address |
| 29A0 | 10039384 | .text | CALL [static] | Indirect call to absolute memory address |
| 2A53 | 100393B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B63 | 10039380 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C25 | 10039370 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C6B | 10039310 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D94 | 10039310 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DE6 | 1003923C | .text | CALL [static] | Indirect call to absolute memory address |
| 2E10 | 1003923C | .text | CALL [static] | Indirect call to absolute memory address |
| 2EC1 | 10039370 | .text | CALL [static] | Indirect call to absolute memory address |
| 2FDF | 10039200 | .text | CALL [static] | Indirect call to absolute memory address |
| 30C4 | 10039210 | .text | CALL [static] | Indirect call to absolute memory address |
| 30EC | 10039224 | .text | CALL [static] | Indirect call to absolute memory address |
| 30F8 | 100393B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3106 | 10039224 | .text | CALL [static] | Indirect call to absolute memory address |
| 3128 | 1003927C | .text | CALL [static] | Indirect call to absolute memory address |
| 3138 | 10039224 | .text | CALL [static] | Indirect call to absolute memory address |
| 3174 | 100393D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 31A5 | 100393B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 31D5 | 10039398 | .text | CALL [static] | Indirect call to absolute memory address |
| 31E7 | 10039218 | .text | CALL [static] | Indirect call to absolute memory address |
| 3214 | 10039218 | .text | CALL [static] | Indirect call to absolute memory address |
| 3229 | 100393C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 324C | 1003937C | .text | CALL [static] | Indirect call to absolute memory address |
| 326B | 100393A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 327F | 10039384 | .text | CALL [static] | Indirect call to absolute memory address |
| 328E | 100393B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 32E3 | 10039310 | .text | CALL [static] | Indirect call to absolute memory address |
| 331A | 10039204 | .text | CALL [static] | Indirect call to absolute memory address |
| 337E | 100393A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 3421 | 10039224 | .text | CALL [static] | Indirect call to absolute memory address |
| 3427 | 1003927C | .text | CALL [static] | Indirect call to absolute memory address |
| 3445 | 100393B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3476 | 10039310 | .text | CALL [static] | Indirect call to absolute memory address |
| 34C4 | 100393AC | .text | CALL [static] | Indirect call to absolute memory address |
| 350D | 100393A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 357F | 100393A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 35A8 | 10039370 | .text | CALL [static] | Indirect call to absolute memory address |
| 35E8 | 10039370 | .text | CALL [static] | Indirect call to absolute memory address |
| 3619 | 100393CC | .text | CALL [static] | Indirect call to absolute memory address |
| 3702 | 10039380 | .text | CALL [static] | Indirect call to absolute memory address |
| 3757 | 10039224 | .text | CALL [static] | Indirect call to absolute memory address |
| 3781 | 1003927C | .text | CALL [static] | Indirect call to absolute memory address |
| 37B8 | 100393B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 380D | 1003924C | .text | CALL [static] | Indirect call to absolute memory address |
| 3864 | 10039244 | .text | CALL [static] | Indirect call to absolute memory address |
| 3887 | 100393CC | .text | CALL [static] | Indirect call to absolute memory address |
| 38AE | 10039244 | .text | CALL [static] | Indirect call to absolute memory address |
| 38DB | 100393B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3929 | 10039244 | .text | CALL [static] | Indirect call to absolute memory address |
| 397A | 10039310 | .text | CALL [static] | Indirect call to absolute memory address |
| 39B8 | 10039224 | .text | CALL [static] | Indirect call to absolute memory address |
| 3A1F | 10039360 | .text | CALL [static] | Indirect call to absolute memory address |
| 3A4A | 10039364 | .text | CALL [static] | Indirect call to absolute memory address |
| 3A8A | 10039234 | .text | CALL [static] | Indirect call to absolute memory address |
| 3AB7 | 100393CC | .text | CALL [static] | Indirect call to absolute memory address |
| 3ADE | 10039394 | .text | CALL [static] | Indirect call to absolute memory address |
| 3AF6 | 10039390 | .text | CALL [static] | Indirect call to absolute memory address |
| 3AFF | 100393BC | .text | CALL [static] | Indirect call to absolute memory address |
| 3B1E | 1003924C | .text | CALL [static] | Indirect call to absolute memory address |
| 3BBC | 10039238 | .text | CALL [static] | Indirect call to absolute memory address |
| 3BC3 | 10039244 | .text | CALL [static] | Indirect call to absolute memory address |
| 3BE6 | 10039224 | .text | CALL [static] | Indirect call to absolute memory address |
| 3C1E | 1003924C | .text | CALL [static] | Indirect call to absolute memory address |
| 163AE-163CF | N/A | .text | Unusual BP Cave, count: 34 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 182715 | 54,7339% |
| Null Byte Code | 68186 | 20,4257% |
© 2026 All rights reserved.