PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 4,26 MB
SHA-256 Hash: 8CD038333D33E0A7600B70CD3E69FA351CE5FBD183C4AA801543BEA61B5E4080
SHA-1 Hash: D0EB23184450AEB3C1B1B9793C94792A2B613067
MD5 Hash: 3DAF1AD266AC7275E3F851209FB249F1
Imphash: F34D5F2D4577ED6D9CEEC516C1F5A744
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): 319FFE
SizeOfHeaders: 400
SizeOfImage: 452000
ImageBase: 400000
Architecture: x86
ImportTable: 319FA4
IAT: 2000
Characteristics: 22
TimeDateStamp: 9A83ADE3
Date: 23/02/2052 17:09:55
File Type: EXE
Number Of Sections: 9
ASLR: Disabled
Section Names: .text, 561478BB, BDC22CEC, 29B4D9C2, 44713E5D, 3E34E4F6, .rsrc, .reloc, AD274881
Number Of Executable Sections: 6
Subsystem: Windows Console
UAC Execution Level Manifest: asInvoker
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 400 318200 2000 318004
5.0216
74478904.31
561478BB
0x60000020
Code
Executable
Readable
 318600 42400 31C000 423E9
7.9993
253.12
BDC22CEC
0x60000020
Code
Executable
Readable
 35AA00 42400 360000 423E9
7.9994
207.52
29B4D9C2
0x60000020
Code
Executable
Readable
 39CE00 800 3A4000 800
7.9095
250.75
44713E5D
0x60000020
Code
Executable
Readable
 39D600 69200 3A6000 69008
7.9993
406.48
3E34E4F6
0x60000020
Code
Executable
Readable
 406800 400 410000 2F4
6.4635
18648
.rsrc
0x40000040
Initialized Data
Readable
 406C00 600 412000 5E8
4.1541
72580
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 407200 200 414000 C
0.0815
128522
AD274881
0x40000040
Initialized Data
Readable
 407400 3C000 416000 3BEA4
5.7893
2203251.42
Description
OriginalFilename: Test Performance.exe
LegalCopyright: Copyright 2026
ProductName: Test Performance
FileVersion: 1.0.0.0
FileDescription: Test Performance
ProductVersion: 1.0.0.0
Language: Unknown (ID=0x0)
CodePage: Unicode (UTF-16 LE) (0x4B0)
Entry Point
The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - 3183FE
Code -> FF25002040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
Assembler
|JMP DWORD PTR [0X402000]
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
Signatures
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Compiler: Microsoft Visual .NET - (You can use a decompiler for this...)
• AnyCPU: False
• Version: v4.0
Detect It Easy (die)
• PE: library: .NET(v4.0.30319)[-]
• PE: linker: Microsoft Linker(48.0)[-]
• Entropy: 6.11529
File Access
Test Performance.exe
ntdll.dll
mscoree.dll
File Access (UNICODE)
Test Performance.exe
Interest's Words
Decrypt
exec
attrib
start
cipher
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii Encryption (CipherMode)
Text Ascii Encryption (CreateDecryptor)
Text Ascii Encryption (CryptoStream)
Text Ascii Encryption (CryptoStreamMode)
Text Ascii Encryption (ICryptoTransform)
Entry Point Hex Pattern Microsoft Visual C / Basic .NET
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ 8.0
Entry Point Hex Pattern Microsoft Visual C v7.0 / Basic .NET
Entry Point Hex Pattern Microsoft Visual Studio .NET
Entry Point Hex Pattern .NET executable
Resources
Path DataRVA Size FileOffset CodeText
\VERSION\1\0 4120A0 35C 406CA0 5C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000\.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\24\1\0 4123FC 1EA 406FFC EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65...<?xml version="1.0" encoding="UTF-8" standalone
Intelligent String
• 1.0.0.0
• Test Performance.exe
• _CorExeMainmscoree.dll
Flow Anomalies
Offset FlowVA Section Description
4F44E 20000005 .text JMP [static] | Indirect jump to absolute memory address
7C794 20000001 .text JMP [static] | Indirect jump to absolute memory address
93C73 24000007 .text CALL [static] | Indirect call to absolute memory address
F7B79 20000003 .text CALL [static] | Indirect call to absolute memory address
154E22 1CFE51DF .text JMP [static] | Indirect jump to absolute memory address
16C999 50000 .text CALL [static] | Indirect call to absolute memory address
253353 20000001 .text JMP [static] | Indirect jump to absolute memory address
3183FE 402000 .text JMP [static] | Indirect jump to absolute memory address
31CFFC 402000 561478BB CALL [static] | Indirect call to absolute memory address
3461B7 81B4D2B 561478BB JMP [static] | Indirect jump to absolute memory address
34D13A 7CA3F50E 561478BB JMP [static] | Indirect jump to absolute memory address
353771 70825F01 561478BB JMP [static] | Indirect jump to absolute memory address
354543 70825F01 561478BB JMP [static] | Indirect jump to absolute memory address
3581F7 54B192CF 561478BB CALL [static] | Indirect call to absolute memory address
35CBE0 54B192CF BDC22CEC CALL [static] | Indirect call to absolute memory address
368C05 54B192CF BDC22CEC JMP [static] | Indirect jump to absolute memory address
370C2B 54B192CF BDC22CEC CALL [static] | Indirect call to absolute memory address
371DA7 54B192CF BDC22CEC JMP [static] | Indirect jump to absolute memory address
37830D 54B192CF BDC22CEC JMP [static] | Indirect jump to absolute memory address
379EFB 54B192CF BDC22CEC JMP [static] | Indirect jump to absolute memory address
37A567 47948C43 BDC22CEC CALL [static] | Indirect call to absolute memory address
37BB5A 118B8500 BDC22CEC JMP [static] | Indirect jump to absolute memory address
37C70F 4DB9CFBE BDC22CEC CALL [static] | Indirect call to absolute memory address
381C9D 47CEF2D0 BDC22CEC CALL [static] | Indirect call to absolute memory address
389BEA 6F75694E BDC22CEC CALL [static] | Indirect call to absolute memory address
39800E 6F75694E BDC22CEC CALL [static] | Indirect call to absolute memory address
39C708 6F75694E BDC22CEC JMP [static] | Indirect jump to absolute memory address
3B274F 28ABD9E 44713E5D CALL [static] | Indirect call to absolute memory address
3B2B07 2D99E227 44713E5D CALL [static] | Indirect call to absolute memory address
3B4EFE 2D99E227 44713E5D CALL [static] | Indirect call to absolute memory address
3D6998 20FE180 44713E5D CALL [static] | Indirect call to absolute memory address
3DB34B A4959A7 44713E5D JMP [static] | Indirect jump to absolute memory address
3DDD9E A4959A7 44713E5D CALL [static] | Indirect call to absolute memory address
3E2F53 A4959A7 44713E5D JMP [static] | Indirect jump to absolute memory address
3E9A51 3D21D284 44713E5D JMP [static] | Indirect jump to absolute memory address
3FF808 633393F 44713E5D JMP [static] | Indirect jump to absolute memory address
318600-35A9FF 31C000 561478BB Executable section anomaly, first bytes: E52304000FFDB74F
35AA00-39CDFF 360000 BDC22CEC Executable section anomaly, first bytes: E5230400A5243CEB
39CE00-39D5FF 3A4000 29B4D9C2 Executable section anomaly, first bytes: B6F7FABD885F5A6A
39D600-4067FF 3A6000 44713E5D Executable section anomaly, first bytes: FD31AD2100900600
406800-406BFF 410000 3E34E4F6 Executable section anomaly, first bytes: BCD49C59EC020000
Extra Analysis
Metric Value Percentage
Ascii Code 2224522 49,7683%
Null Byte Code 866238 19,38%
© 2026 All rights reserved.