PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 667,50 KB SHA-256 Hash: F013CDD1EE45D8D9B0653B16EC080313F434F81A56DDEE9195C01574A90AE11A SHA-1 Hash: 3676D4869AD6111F0B1D868EA0E296729E63EB54 MD5 Hash: 1D467F02DDF6F8FE2FB1570B3B22E561 Imphash: E9C2A537FA8497CB92A03A90B833AE4F MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 5A9FC SizeOfHeaders: 400 SizeOfImage: AD000 ImageBase: 10000000 Architecture: x86 ExportTable: 9E090 ImportTable: 9E14C IAT: 86000 Characteristics: 2102 TimeDateStamp: 6AD79EC5 Date: 20/10/2026 17:03:01 File Type: DLL Number Of Sections: 6 ASLR: Enabled Section Names: .text, .rdata, .data, .fptable, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 84400 | 1000 | 842FC |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
84800 | 19800 | 86000 | 197CE |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
9E000 | 2E00 | A0000 | 42FC |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
A0E00 | 200 | A5000 | 80 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
A1000 | 400 | A6000 | 2F0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
A1400 | 5A00 | A7000 | 587C |
|
|
| Description |
| OriginalFilename: s1ag.ocx CompanyName: Fokjfjp Jseobv ProductName: Fokjfjp Jseobv FileVersion: 39.0.0.5985 FileDescription: Fokjfjp Jseobv Control ProductVersion: 39.0.0.5985 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 59DFC Code -> 558BEC837D0C017505E838070000FF7510FF750CFF7508E8ABFEFFFF83C40C5DC20C008B4DF464890D00000000595F5F5E5B Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X1005AA0A |CALL 0X1005B142 |PUSH DWORD PTR [EBP + 0X10] |PUSH DWORD PTR [EBP + 0XC] |PUSH DWORD PTR [EBP + 8] |CALL 0X1005A8C3 |ADD ESP, 0XC |POP EBP |RET 0XC |MOV ECX, DWORD PTR [EBP - 0XC] |MOV DWORD PTR FS:[0], ECX |POP ECX |POP EDI |POP EDI |POP ESI |POP EBX |
| Signatures |
| Rich Signature Analyzer: Code -> A2F0D139E691BF6AE691BF6AE691BF6A9210BC6BEA91BF6A6118BC6BFF91BF6A6118BB6BE991BF6A6118BA6BA891BF6AEFE92C6AE291BF6A9210B86BE791BF6A9210B96BE791BF6A9210BA6B5691BF6A9210BB6BFB91BF6A9210BE6BF191BF6AE691BE6AF290BF6A7718BA6BF491BF6A7718BF6BE791BF6A7718406AE791BF6A7718BD6BE791BF6A52696368E691BF6A Footprint md5 Hash -> A4351F75DFACD097DF97BC6D71BB73F4 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: linker: Microsoft Linker(14.44**)[-] • Entropy: 6.5647 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegDeleteValueA | Removes a named value from the specified registry key. Note that value names are not case sensitive. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| ET Functions (carving) |
| deskpilot.ocx DllCanUnloadNow DllGetClassObject DllInstall DllRegisterServer DllUnregisterServer |
| Windows REG |
| Software\Microsoft\Windows\CurrentVersion\Run SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Software\Microsoft\Windows\CurrentVersion\RunOnce SOFTWARE\Microsoft\Windows NT\CurrentVersion System\CentralProcessor\0 Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| File Access |
| sihost.exe KERNEL32.dll WTSAPI32.dll api-ms-win-core-winrt-string-l1-1-0.dll api-ms-win-core-winrt-l1-1-0.dll bcrypt.dll MFPlat.DLL WS2_32.dll SHELL32.dll ADVAPI32.dll GDI32.dll USER32.dll OLEAUT32.dll ole32.dll .dll .ps1 .bat run.bat .dat \qz8.dat @.dat 2 OR TargetInstance.Log AND (TargetInstance.Log klog.txt .vbs .zip Temp |
| File Access (UNICODE) |
| mscoree.dll kernel32.dll Temp |
| SQL Queries |
| SELECT * FROM __InstanceCreationEvent WITHIN 15 WHERE TargetInstance ISA Win32_LogonSession AND (TargetInstance.LogonType = 2 OR TargetInstance.LogonType = 10) SELECT * FROM __TimerEvent WHERE TimerID = " SELECT * FROM __EventFilter SELECT * FROM __IntervalTimerInstruction SELECT Caption,Version FROM Win32_OperatingSystem SELECT Name,Workgroup,Domain FROM Win32_ComputerSystem SELECT Version,SMBIOSBIOSVersion,SerialNumber FROM Win32_BIOS SELECT Name,MaxClockSpeed FROM Win32_Processor SELECT Name,AdapterRAM,CurrentHorizontalResolution,CurrentVerticalResolution FROM Win32_VideoController SELECT Capacity,BankLabel,DeviceLocator FROM Win32_PhysicalMemory SELECT Model,Size FROM Win32_DiskDrive SELECT DeviceID,VolumeName,Size,FreeSpace,FileSystem,DriveType FROM Win32_LogicalDisk SELECT Name FROM Win32_SoundDevice SELECT Name FROM Win32_NetworkAdapter WHERE PhysicalAdapter=TRUE SELECT IPAddress FROM Win32_NetworkAdapterConfiguration WHERE IPEnabled=TRUE |
| Interest's Words |
| exec attrib start sdelete ping expand |
| Interest's Words (UNICODE) |
| start |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Hex | Hex Pattern | PEB AntiDebug (Flag BeingDebugged) |
| Text | Unicode | Privileges (SeAssignPrimaryTokenPrivilege) |
| Text | Unicode | Privileges (SeIncreaseQuotaPrivilege) |
| Text | Unicode | Privileges (SeTcbPrivilege) |
| Text | Ascii | Keyboard Key ([LEFT]) |
| Text | Ascii | Keyboard Key ([RIGHT]) |
| Text | Ascii | Keyboard Key ([UP]) |
| Text | Ascii | Keyboard Key ([DOWN]) |
| Text | Ascii | Keyboard Key ([DEL]) |
| Text | Ascii | Keyboard Key ([F1]) |
| Text | Ascii | Keyboard Key ([F2]) |
| Text | Ascii | Keyboard Key ([F3]) |
| Text | Ascii | Keyboard Key ([F4]) |
| Text | Ascii | Keyboard Key ([F5]) |
| Text | Ascii | Keyboard Key ([F6]) |
| Text | Ascii | Keyboard Key ([F7]) |
| Text | Ascii | Keyboard Key ([F8]) |
| Text | Ascii | Keyboard Key ([F9]) |
| Text | Ascii | Keyboard Key ([F10]) |
| Text | Ascii | Keyboard Key ([F11]) |
| Text | Ascii | Keyboard Key ([F12]) |
| Text | Ascii | Keyboard Key ([INS]) |
| Text | Ascii | Keyboard Key ([PGUP]) |
| Text | Ascii | Keyboard Key (PageDown) |
| Text | Ascii | Keyboard Key (PageUp) |
| Text | Ascii | Keyboard Key (Backspace) |
| Text | Unicode | WMI execution (ROOT\CIMV2) |
| Entry Point | Hex Pattern | fasm - Tomasz Grysztar |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\1033 | A6060 | 290 | A1060 | 900234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • ".zip • img_%04d%02d%02d_%02d%02d%02d.jpg • agent.ocx • klog.txt • \qz8.dat • lastgood.ocx • .new • .bak • \nAu4hI.cmd\restore_update.cmd\apply_update.cmd • ","ok":.ocx • .ps1 • -NoProfile -WindowStyle Hidden -File ".bat • .cmd • .vbs • //B //Nologo "\ComOld.ocx\old.ocx • ","runAs":","runPath":" • {"ok":true,"text":"","folders":.dll • sihost.exe • mscoree.dll • .tls • .bss • USER32.dll • WS2_32.dll • WindowsDeleteStringapi-ms-win-core-winrt-l1-1-0.dll • s1ag.ocx |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 17FC | 1008618C | .text | CALL [static] | Indirect call to absolute memory address |
| 1838 | 1008618C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A8D | 100862F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1ABB | 10086308 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AD8 | 1008616C | .text | CALL [static] | Indirect call to absolute memory address |
| 1AE0 | 10086300 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C04 | 10086190 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C40 | 10086304 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C48 | 1008616C | .text | CALL [static] | Indirect call to absolute memory address |
| 1C6B | 10086310 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C7B | 10086300 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C9F | 10086310 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F26 | 100862F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F37 | 10086174 | .text | CALL [static] | Indirect call to absolute memory address |
| 3031 | 10086164 | .text | CALL [static] | Indirect call to absolute memory address |
| 34E7 | 100862F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 3516 | 100862FC | .text | CALL [static] | Indirect call to absolute memory address |
| 356C | 10086170 | .text | CALL [static] | Indirect call to absolute memory address |
| 38A2 | 1008630C | .text | CALL [static] | Indirect call to absolute memory address |
| 38C5 | 100862E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 38F7 | 10086180 | .text | CALL [static] | Indirect call to absolute memory address |
| 391A | 1008618C | .text | CALL [static] | Indirect call to absolute memory address |
| 3AA0 | 1008618C | .text | CALL [static] | Indirect call to absolute memory address |
| 3AA9 | 1008617C | .text | CALL [static] | Indirect call to absolute memory address |
| 3AAF | 1008631C | .text | CALL [static] | Indirect call to absolute memory address |
| 3B37 | 100862EC | .text | CALL [static] | Indirect call to absolute memory address |
| 3B59 | 10086188 | .text | CALL [static] | Indirect call to absolute memory address |
| 3B6B | 10086178 | .text | CALL [static] | Indirect call to absolute memory address |
| 3B78 | 10086180 | .text | CALL [static] | Indirect call to absolute memory address |
| 3B83 | 10086184 | .text | CALL [static] | Indirect call to absolute memory address |
| 3B8C | 1008631C | .text | JMP [static] | Indirect jump to absolute memory address |
| 3BA6 | 10086188 | .text | CALL [static] | Indirect call to absolute memory address |
| 3BAD | 1008617C | .text | CALL [static] | Indirect call to absolute memory address |
| 3BB6 | 10086318 | .text | CALL [static] | Indirect call to absolute memory address |
| 3BBF | 1008631C | .text | JMP [static] | Indirect jump to absolute memory address |
| 3BC8 | 1008631C | .text | JMP [static] | Indirect jump to absolute memory address |
| 3D8D | 10086168 | .text | CALL [static] | Indirect call to absolute memory address |
| 41D1 | 100862F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 41F9 | 100862F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4221 | 10086314 | .text | CALL [static] | Indirect call to absolute memory address |
| 4249 | 10086314 | .text | CALL [static] | Indirect call to absolute memory address |
| 42B6 | 1008618C | .text | CALL [static] | Indirect call to absolute memory address |
| 438C | 1008618C | .text | CALL [static] | Indirect call to absolute memory address |
| 43F4 | 1008618C | .text | CALL [static] | Indirect call to absolute memory address |
| 4672 | 10086194 | .text | CALL [static] | Indirect call to absolute memory address |
| 4688 | 10086164 | .text | CALL [static] | Indirect call to absolute memory address |
| 4C42 | 100863CC | .text | CALL [static] | Indirect call to absolute memory address |
| 4CE3 | 100862B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5275 | 100863EC | .text | CALL [static] | Indirect call to absolute memory address |
| 5774 | 1008619C | .text | CALL [static] | Indirect call to absolute memory address |
| 595D | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 599A | 10086034 | .text | CALL [static] | Indirect call to absolute memory address |
| 59A4 | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 5B07 | 10086198 | .text | CALL [static] | Indirect call to absolute memory address |
| 5DA7 | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 5DD8 | 10086034 | .text | CALL [static] | Indirect call to absolute memory address |
| 5DE2 | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 5EC5 | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 5EF8 | 10086034 | .text | CALL [static] | Indirect call to absolute memory address |
| 5F02 | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 6081 | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 60BA | 10086034 | .text | CALL [static] | Indirect call to absolute memory address |
| 60C4 | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 61E6 | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 6218 | 10086034 | .text | CALL [static] | Indirect call to absolute memory address |
| 6222 | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 637D | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 63BA | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 6506 | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 6525 | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 6669 | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 6688 | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 67CC | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 67EB | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 694F | 10086038 | .text | CALL [static] | Indirect call to absolute memory address |
| 6980 | 10086034 | .text | CALL [static] | Indirect call to absolute memory address |
| 698A | 1008603C | .text | CALL [static] | Indirect call to absolute memory address |
| 6FF6 | 10086030 | .text | CALL [static] | Indirect call to absolute memory address |
| 70E0 | 10086030 | .text | CALL [static] | Indirect call to absolute memory address |
| 7177 | 10086030 | .text | CALL [static] | Indirect call to absolute memory address |
| BD4A | 10086188 | .text | CALL [static] | Indirect call to absolute memory address |
| BE79 | 10086188 | .text | CALL [static] | Indirect call to absolute memory address |
| D15C | 100861A0 | .text | CALL [static] | Indirect call to absolute memory address |
| D2A6 | 100862CC | .text | CALL [static] | Indirect call to absolute memory address |
| E2C9 | 100861A0 | .text | CALL [static] | Indirect call to absolute memory address |
| E394 | 100862CC | .text | CALL [static] | Indirect call to absolute memory address |
| E72E | 100862CC | .text | JMP [static] | Indirect jump to absolute memory address |
| ECBF | 100861A4 | .text | CALL [static] | Indirect call to absolute memory address |
| ECC7 | 10086194 | .text | CALL [static] | Indirect call to absolute memory address |
| EDFB | 100861A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 11BF7 | 10086188 | .text | CALL [static] | Indirect call to absolute memory address |
| 11C30 | 10086188 | .text | CALL [static] | Indirect call to absolute memory address |
| 128AB | 5589643F | .text | JMP [static] | Indirect jump to absolute memory address |
| 14583 | 10086188 | .text | CALL [static] | Indirect call to absolute memory address |
| 145BD | 10086188 | .text | CALL [static] | Indirect call to absolute memory address |
| 145CF | 100861B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 14696 | 100861AC | .text | CALL [static] | Indirect call to absolute memory address |
| 177CE | 100861D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 181E3 | 100861D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 183F1 | 1008602C | .text | CALL [static] | Indirect call to absolute memory address |
| 541A5-541CF | N/A | .text | Unusual BP Cave, count: 43 |
| 551D2-551EF | N/A | .text | Unusual BP Cave, count: 30 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 393281 | 57,5376% |
| Null Byte Code | 96997 | 14,1908% |
© 2026 All rights reserved.