PREMIUM PESCAN.IO - Analysis Report

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 5,86 MB
SHA-256 Hash: E331AE8720B8959B16A84492E8B9916A72A0181A7B25B4267A9727A251B8E134
SHA-1 Hash: 498BA39562DA4A8003CF1E56975D628C1DBDAA48
MD5 Hash: 3AC2C7ECEC0DE5229725B7FAA4940B80
Imphash: D4B45184672816EB7E23441F846A3E1C
MajorOSVersion: 5
MinorOSVersion: 0
CheckSum: 005DE76D
EntryPoint (rva): 36D304
SizeOfHeaders: 400
SizeOfImage: 564000
ImageBase: 70F00000
Architecture: x86
ExportTable: E9000
ImportTable: 42391C
IAT: 35D000
Characteristics: 230E
TimeDateStamp: 6A3FBD26
Date: 27/06/2026 12:08:06
File Type: DLL
Number Of Sections: 12
ASLR: Enabled
Section Names (Optional Header): .text, .data, .rdata, .bss, .edata, .idata, .CRT, .tls, *unnamed*, *unnamed*, *unnamed*, .reloc
Number Of Executable Sections: 1
Subsystem: Windows GUI
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60600060
Code
Initialized Data
Executable
Readable
 400 50200 1000 50124
0.8879
71453614.53
.data
0xC0600040
Initialized Data
Readable
Writeable
 50600 94800 52000 947E4
5.0587
37279734.78
.rdata
0x40600040
Initialized Data
Readable
 E4E00 800 E7000 758
5.2146
39012.5
.bss
0xC0600080
Uninitialized Data
Readable
Writeable
 0 0 E8000 A30
N/A
N/A
.edata
0x40300040
Initialized Data
Readable
 E5600 200 E9000 44
0.7505
110460
.idata
0xC0300040
Initialized Data
Readable
Writeable
 E5800 600 EA000 528
6.579
22706.33
.CRT
0xC0300040
Initialized Data
Readable
Writeable
 E5E00 200 EB000 2C
0.1866
125500
.tls
0xC0300040
Initialized Data
Readable
Writeable
 E6000 200 EC000 8
0
130560
*unnamed*
0x60000020
Code
Executable
Readable
 E6200 270000 ED000 26FFAC
7.954
264627.31
*unnamed*
0xC0000040
Initialized Data
Readable
Writeable
 356200 200 35D000 34
0.2444
124494
*unnamed*
0x60000020
Code
Executable
Readable
 356400 203E00 35E000 203CFA
7.981
68020.32
.reloc
0x42300040
Initialized Data
GP-Relative
Readable
 55A200 1800 562000 1684
5.9689
92351.83
Binder/Joiner/Crypter
Dropper code detected (EOF) - 481,00 KB
Entry Point
The section number (11) have the Entry Point
Information -> EntryPoint (calculated) - 365704
Code -> E8E77F0E00CE9CB5BB1DBA1825E63E87496FB9BA96B424ED3B0D9A181C0E865FD98F0092F6A490995FD2ABCF41197B8CBBAB
EP changed to another address -> (Address Of EntryPoint > Base Of Data)
Assembler
|CALL 0X713552F0
|INTO
|PUSHFD
|MOV CH, 0XBB
|SBB EAX, 0XE62518BA
|XCHG DWORD PTR DS:[ECX + 0X6F], ECX
|MOV ECX, 0X24B496BA
|IN EAX, DX
|CMP ECX, DWORD PTR [0XE1C189A]
|XCHG BYTE PTR [EDI - 0X27], BL
|POP DWORD PTR [EAX]
|XCHG EAX, EDX
|MUL BYTE PTR [EAX + EDX*4 - 0X542DA067]
|IRETD
|INC ECX
|SBB DWORD PTR [EBX - 0X74], EDI
Signatures
CheckSum Integrity Problem:
• Header: 6154093
• Calculated: 6148541
Certificate - Digital Signature Not Found:
• The file is not signed
Duplicate Sections
Section *unnamed* duplicate 3 times
Packer/Compiler
Compiler: Microsoft Visual C ++
Detect It Easy (die)
• Entropy: 7.20391
ET Functions (carving)
Original Name -> payload.dll
faSER
Windows REG (UNICODE)
SOFTWARE\Classes
Software\Classes\
File Access
USER32.dll
KERNEL32.dll
msvcrt.dll
USER32.DLL
payload.dll
.dat
Temp
File Access (UNICODE)
CorExitProcessmscoree.dll
KERNEL32.DLL
msvcrt.dll
Intelligent String
• @@.bss
• .CRT
• .tls
• msvcrt.dll
• KERNEL32.DLL
• mscoree.dll
• m28mn
• .vsz
Flow Anomalies
Offset FlowVA Section Description
457 70FEA13C .text CALL [static] | Indirect call to absolute memory address
49C60 70FEA120 .text CALL [static] | Indirect call to absolute memory address
49F7C 70FEA134 .text CALL [static] | Indirect call to absolute memory address
49FF0 70FEA134 .text CALL [static] | Indirect call to absolute memory address
4A077 70FEA134 .text CALL [static] | Indirect call to absolute memory address
4A5BC 70FEA13C .text JMP [static] | Indirect jump to absolute memory address
4EB18 70FEA134 .text CALL [static] | Indirect call to absolute memory address
4EBD7 70FEA134 .text CALL [static] | Indirect call to absolute memory address
4ED5D 70FEA134 .text CALL [static] | Indirect call to absolute memory address
4F021 70FEA134 .text CALL [static] | Indirect call to absolute memory address
4F0B9 70FEA134 .text CALL [static] | Indirect call to absolute memory address
4FFBE 70FEA134 .text CALL [static] | Indirect call to absolute memory address
500E0 70F5204C .text JMP [static] | Indirect jump to absolute memory address
50445 70FEA13C .text CALL [static] | Indirect call to absolute memory address
50491 70F5203C .text CALL [static] | Indirect call to absolute memory address
504CD 70FEA13C .text CALL [static] | Indirect call to absolute memory address
9F4D1 70FEA13C .data JMP [static] | Indirect jump to absolute memory address
9FFD6 70FEA13C .data CALL [static] | Indirect call to absolute memory address
AD9C7 70FEA13C .data CALL [static] | Indirect call to absolute memory address
BF4A6 70FEA13C .data JMP [static] | Indirect jump to absolute memory address
BF529 70FEA13C .data CALL [static] | Indirect call to absolute memory address
C3099 70FEA13C .data JMP [static] | Indirect jump to absolute memory address
CA63F 288C6513 .data JMP [static] | Indirect jump to absolute memory address
DE70F 288C6513 .data CALL [static] | Indirect call to absolute memory address
ECE7B 156239E1 *unnamed* JMP [static] | Indirect jump to absolute memory address
F6AF9 21FE36EE *unnamed* JMP [static] | Indirect jump to absolute memory address
F97B7 71013084 *unnamed* CALL [static] | Indirect call to absolute memory address
F97EF 71013084 *unnamed* CALL [static] | Indirect call to absolute memory address
F9CA6 71013084 *unnamed* CALL [static] | Indirect call to absolute memory address
F9CE0 71013084 *unnamed* CALL [static] | Indirect call to absolute memory address
FD00C 71013084 *unnamed* JMP [static] | Indirect jump to absolute memory address
101A44 71013074 *unnamed* CALL [static] | Indirect call to absolute memory address
102571 710130F0 *unnamed* CALL [static] | Indirect call to absolute memory address
102592 710130F8 *unnamed* CALL [static] | Indirect call to absolute memory address
1025C7 710130FC *unnamed* CALL [static] | Indirect call to absolute memory address
1028E8 710130F8 *unnamed* CALL [static] | Indirect call to absolute memory address
103C3A 710147BC *unnamed* CALL [static] | Indirect call to absolute memory address
10420B 710147BC *unnamed* CALL [static] | Indirect call to absolute memory address
105A10 7101E030 *unnamed* CALL [static] | Indirect call to absolute memory address
105A6B 7101E034 *unnamed* CALL [static] | Indirect call to absolute memory address
106ABC 71013074 *unnamed* CALL [static] | Indirect call to absolute memory address
106B79 71013070 *unnamed* CALL [static] | Indirect call to absolute memory address
106BAA 71013074 *unnamed* CALL [static] | Indirect call to absolute memory address
108356 71013074 *unnamed* CALL [static] | Indirect call to absolute memory address
109807 71013084 *unnamed* CALL [static] | Indirect call to absolute memory address
109875 71013084 *unnamed* CALL [static] | Indirect call to absolute memory address
10999B 71013070 *unnamed* CALL [static] | Indirect call to absolute memory address
109AD8 71013070 *unnamed* CALL [static] | Indirect call to absolute memory address
119A45 66460C19 *unnamed* JMP [static] | Indirect jump to absolute memory address
11D661 66460C19 *unnamed* CALL [static] | Indirect call to absolute memory address
120E79 66460C19 *unnamed* CALL [static] | Indirect call to absolute memory address
12784B 66460C19 *unnamed* JMP [static] | Indirect jump to absolute memory address
127C44 64F012E7 *unnamed* JMP [static] | Indirect jump to absolute memory address
12897B 64F012E7 *unnamed* CALL [static] | Indirect call to absolute memory address
12BC36 64F012E7 *unnamed* JMP [static] | Indirect jump to absolute memory address
13F7FD 364CC77C *unnamed* JMP [static] | Indirect jump to absolute memory address
142F65 4CD0466A *unnamed* CALL [static] | Indirect call to absolute memory address
149142 62F8C319 *unnamed* CALL [static] | Indirect call to absolute memory address
14CD52 62F8C319 *unnamed* CALL [static] | Indirect call to absolute memory address
14F9F3 62F8C319 *unnamed* JMP [static] | Indirect jump to absolute memory address
152948 62F8C319 *unnamed* JMP [static] | Indirect jump to absolute memory address
152968 595AFFFF *unnamed* JMP [static] | Indirect jump to absolute memory address
15537D 595AFFFF *unnamed* CALL [static] | Indirect call to absolute memory address
161798 59DF7554 *unnamed* CALL [static] | Indirect call to absolute memory address
163237 33EE877 *unnamed* JMP [static] | Indirect jump to absolute memory address
163BDE 33EE877 *unnamed* CALL [static] | Indirect call to absolute memory address
180407 500017FC *unnamed* JMP [static] | Indirect jump to absolute memory address
18EB55 500017FC *unnamed* JMP [static] | Indirect jump to absolute memory address
1906A9 500017FC *unnamed* JMP [static] | Indirect jump to absolute memory address
197C16 500017FC *unnamed* JMP [static] | Indirect jump to absolute memory address
19C892 500017FC *unnamed* CALL [static] | Indirect call to absolute memory address
1A4485 1717D5B *unnamed* CALL [static] | Indirect call to absolute memory address
1AC218 2424B97E *unnamed* JMP [static] | Indirect jump to absolute memory address
1B4A2C 2424B97E *unnamed* CALL [static] | Indirect call to absolute memory address
1B5117 2424B97E *unnamed* JMP [static] | Indirect jump to absolute memory address
1C32FA 586FEBD8 *unnamed* JMP [static] | Indirect jump to absolute memory address
1D7704 586FEBD8 *unnamed* CALL [static] | Indirect call to absolute memory address
1DEA6F 586FEBD8 *unnamed* CALL [static] | Indirect call to absolute memory address
2061CB 754F44AD *unnamed* JMP [static] | Indirect jump to absolute memory address
206567 465A02C3 *unnamed* CALL [static] | Indirect call to absolute memory address
213578 428B2E89 *unnamed* JMP [static] | Indirect jump to absolute memory address
213CAE 428B2E89 *unnamed* JMP [static] | Indirect jump to absolute memory address
214043 428B2E89 *unnamed* JMP [static] | Indirect jump to absolute memory address
218B4A F8FFFF3 *unnamed* JMP [static] | Indirect jump to absolute memory address
21E2E0 1BFD148D *unnamed* JMP [static] | Indirect jump to absolute memory address
21E79D 1BFD148D *unnamed* CALL [static] | Indirect call to absolute memory address
220A38 1BFD148D *unnamed* CALL [static] | Indirect call to absolute memory address
24CC30 1BFD148D *unnamed* CALL [static] | Indirect call to absolute memory address
2556DA 1BFD148D *unnamed* JMP [static] | Indirect jump to absolute memory address
25E028 FF *unnamed* JMP [static] | Indirect jump to absolute memory address
26705F 1D3E9215 *unnamed* JMP [static] | Indirect jump to absolute memory address
2701BB 7DAF8B12 *unnamed* JMP [static] | Indirect jump to absolute memory address
281042 61B8192 *unnamed* JMP [static] | Indirect jump to absolute memory address
290E3A 6080F218 *unnamed* CALL [static] | Indirect call to absolute memory address
291397 6080F218 *unnamed* JMP [static] | Indirect jump to absolute memory address
2A660B 6080F218 *unnamed* CALL [static] | Indirect call to absolute memory address
2A78ED 6080F218 *unnamed* CALL [static] | Indirect call to absolute memory address
2BC576 82444C7 *unnamed* JMP [static] | Indirect jump to absolute memory address
2BCAC0 82444C7 *unnamed* CALL [static] | Indirect call to absolute memory address
2BF0D8 82444C7 *unnamed* JMP [static] | Indirect jump to absolute memory address
E8C41-E8C5F N/A *unnamed* Unusual BP Cave, count: 31
E9DC5-E9F5F N/A *unnamed* Unusual BP Cave, count: 411
EC685-EC6AF N/A *unnamed* Unusual BP Cave, count: 43
F25F8-F262F N/A *unnamed* Unusual BP Cave, count: 56
F4A30-F4E7F N/A *unnamed* Unusual BP Cave, count: 1104
4489DC 7131909E *unnamed* TLS Callback | Pointer to 41909E - 0x41149E *unnamed*
4489E0 70F4A650 *unnamed* TLS Callback | Pointer to 4A650 - 0x49A50 .text
4489E4 70F4A600 *unnamed* TLS Callback | Pointer to 4A600 - 0x49A00 .text
E6200-3561FF ED000 *unnamed* Executable section anomaly, first bytes: 558BEC538B5D0856
55BA00 N/A *Overlay* 4100007900000000000027000000000000000000 | A..y......’.........
Extra Analysis
Metric Value Percentage
Ascii Code 3447970 56,11%
Null Byte Code 1124685 18,3024%
NOP Cave Found 0x9090909090 Block Count: 39 | Total: 0,0016%
© 2026 All rights reserved.