PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 257,50 KB SHA-256 Hash: B9DDD7F8AAEB1247EAA881CAF75F8749D4B7C4442408C37D9BB57AD9927EE19A SHA-1 Hash: 0EA4745516C343E3E2F85B1C6D354046C7C25A79 MD5 Hash: 4D69A7B084A2C4486A703E4C079079AA Imphash: 1FD1F3E132919F622E30AD7A3ADA4BDD MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 8710 SizeOfHeaders: 400 SizeOfImage: 47000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: 3BC40 ImportTable: 3BDB4 IAT: 2A000 Characteristics: 2022 TimeDateStamp: 6A678B4F Date: 27/07/2026 16:46:07 File Type: DLL Number Of Sections: 8 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, _RDATA, .fptable, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 28A00 | 1000 | 289A0 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
28E00 | 12C00 | 2A000 | 12A22 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
3BA00 | 1600 | 3D000 | 2BE4 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
3D000 | 2600 | 40000 | 2514 |
|
|
| _RDATA | 0x40000040 Initialized Data Readable |
3F600 | 200 | 43000 | F4 |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
3F800 | 200 | 44000 | 100 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
3FA00 | 200 | 45000 | F8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
3FC00 | A00 | 46000 | 9C4 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 7B10 Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E8470700004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X180008731 |CALL 0X180008E78 |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| Rich Signature Analyzer: Code -> 3782599C73E337CF73E337CF73E337CF0A6232CEDEE337CF0A6233CE66E337CF0A6234CE7AE337CF73E337CF72E337CF219633CE7CE337CF219634CE79E337CF219632CE3AE337CF0A6236CE7AE337CF73E336CFE9E337CFBC963ECE71E337CFBC9637CE72E337CFBC96C8CF72E337CFBC9635CE72E337CF5269636873E337CF Footprint md5 Hash -> 4160EEF7B052BF0B45B3E759EAB0C898 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.29**)[-] • Entropy: 6.30092 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CopyFileW | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| ADVAPI32.DLL | CryptDecrypt | Performs a cryptographic operation on data in a data block. |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| ET Functions (carving) |
| Original Name -> winhttp.dll DebugCreate WinHttpCloseHandle WinHttpConnect WinHttpGetIEProxyConfigForCurrentUser WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| File Access |
| SHELL32.dll USER32.dll KERNEL32.dll ADVAPI32.dll winhttp.dll ntdll.dll .dat @.dat \x64\tls12-download_de0b9b66\hijack_log.txt |
| File Access (UNICODE) |
| schtasks.exe Mstet.exe winhttp.dll mscoree.dll kernel32.dll AppData |
| Interest's Words |
| Decrypt exec start expand |
| Interest's Words (UNICODE) |
| schtasks schtask |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (CopyFile) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Encryption API (CryptAcquireContext) |
| Text | Ascii | Encryption API (CryptDecrypt) |
| Text | Ascii | Encryption API (CryptReleaseContext) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Execution (CreateSemaphoreW) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 45060 | 91 | 3FA60 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version='1.0' encoding='UTF-8' standalone='y |
| Intelligent String |
| • winhttp.dll • kernel32.dll • mscoree.dll • >ntdll.dll • \x64\tls12-download_de0b9b66\hijack_log.txt • runas • Mstet.exe • /create /tn "CacheTask" /tr ""%s"" /sc onlogon /rl highest /f • schtasks.exe • .bss • USER32.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 60B | N/A | .text | CALL QWORD PTR [RIP+0x28E97] |
| 6E9 | N/A | .text | CALL QWORD PTR [RIP+0x28DB9] |
| 705 | N/A | .text | CALL QWORD PTR [RIP+0x28DBD] |
| 71E | N/A | .text | CALL QWORD PTR [RIP+0x28DA4] |
| 768 | N/A | .text | CALL QWORD PTR [RIP+0x28D5A] |
| 1D53 | N/A | .text | CALL QWORD PTR [RIP+0x27727] |
| 1D97 | N/A | .text | CALL QWORD PTR [RIP+0x276C3] |
| 1DDE | N/A | .text | CALL QWORD PTR [RIP+0x2767C] |
| 1DEC | N/A | .text | CALL QWORD PTR [RIP+0x276C6] |
| 1E1A | N/A | .text | CALL QWORD PTR [RIP+0x27680] |
| 1E43 | N/A | .text | CALL QWORD PTR [RIP+0x2762F] |
| 1E4C | N/A | .text | CALL QWORD PTR [RIP+0x2766E] |
| 1E66 | N/A | .text | CALL QWORD PTR [RIP+0x2761C] |
| 1E74 | N/A | .text | CALL QWORD PTR [RIP+0x27666] |
| 1E82 | N/A | .text | CALL QWORD PTR [RIP+0x275E0] |
| 1ECA | N/A | .text | CALL QWORD PTR [RIP+0x27610] |
| 1ED8 | N/A | .text | CALL QWORD PTR [RIP+0x2758A] |
| 1EDE | N/A | .text | CALL QWORD PTR [RIP+0x2758C] |
| 1EED | N/A | .text | CALL QWORD PTR [RIP+0x275FD] |
| 1F43 | N/A | .text | CALL QWORD PTR [RIP+0x27547] |
| 1F55 | N/A | .text | CALL QWORD PTR [RIP+0x2754D] |
| 1F6E | N/A | .text | CALL QWORD PTR [RIP+0x2751C] |
| 1F88 | N/A | .text | CALL QWORD PTR [RIP+0x274F2] |
| 1F97 | N/A | .text | CALL QWORD PTR [RIP+0x274C3] |
| 1FD5 | N/A | .text | CALL QWORD PTR [RIP+0x2750D] |
| 2036 | N/A | .text | CALL QWORD PTR [RIP+0x274AC] |
| 2043 | N/A | .text | CALL QWORD PTR [RIP+0x27427] |
| 2054 | N/A | .text | CALL QWORD PTR [RIP+0x273AE] |
| 2085 | N/A | .text | CALL QWORD PTR [RIP+0x27375] |
| 2099 | N/A | .text | CALL QWORD PTR [RIP+0x27421] |
| 2113 | N/A | .text | CALL QWORD PTR [RIP+0x27667] |
| 212A | N/A | .text | CALL QWORD PTR [RIP+0x27368] |
| 2134 | N/A | .text | CALL QWORD PTR [RIP+0x27386] |
| 2173 | N/A | .text | CALL QWORD PTR [RIP+0x2729F] |
| 21D9 | N/A | .text | CALL QWORD PTR [RIP+0x27231] |
| 21E4 | N/A | .text | CALL QWORD PTR [RIP+0x27236] |
| 224B | N/A | .text | CALL QWORD PTR [RIP+0x2725F] |
| 2251 | N/A | .text | CALL QWORD PTR [RIP+0x272A1] |
| 2261 | N/A | .text | CALL QWORD PTR [RIP+0x27529] |
| 2276 | N/A | .text | CALL QWORD PTR [RIP+0x271F4] |
| 2287 | N/A | .text | CALL QWORD PTR [RIP+0x2717B] |
| 22B4 | N/A | .text | CALL QWORD PTR [RIP+0x27146] |
| 22C6 | N/A | .text | CALL QWORD PTR [RIP+0x271F4] |
| 22E4 | N/A | .text | CALL QWORD PTR [RIP+0x271A6] |
| 2354 | N/A | .text | CALL QWORD PTR [RIP+0x27426] |
| 2360 | N/A | .text | CALL QWORD PTR [RIP+0x2716A] |
| 57C1 | N/A | .text | CALL QWORD PTR [RIP+0x23C81] |
| 57F7 | N/A | .text | CALL QWORD PTR [RIP+0x23C33] |
| 58DE | N/A | .text | CALL QWORD PTR [RIP+0x23B5C] |
| 58ED | N/A | .text | CALL QWORD PTR [RIP+0x23B5D] |
| 58FA | N/A | .text | CALL QWORD PTR [RIP+0x23B28] |
| 590F | N/A | .text | CALL QWORD PTR [RIP+0x23B3B] |
| 5920 | N/A | .text | CALL QWORD PTR [RIP+0x23BBA] |
| 5931 | N/A | .text | CALL QWORD PTR [RIP+0x23BC9] |
| 59A6 | N/A | .text | CALL QWORD PTR [RIP+0x23A84] |
| 59C0 | N/A | .text | CALL QWORD PTR [RIP+0x23A72] |
| 59EF | N/A | .text | CALL QWORD PTR [RIP+0x23A4B] |
| 59FE | N/A | .text | CALL QWORD PTR [RIP+0x23A4C] |
| 5A04 | N/A | .text | CALL QWORD PTR [RIP+0x23AD6] |
| 5A12 | N/A | .text | CALL QWORD PTR [RIP+0x23A50] |
| 5A1F | N/A | .text | CALL QWORD PTR [RIP+0x23A03] |
| 5A29 | N/A | .text | CALL QWORD PTR [RIP+0x23A21] |
| 5A36 | N/A | .text | CALL QWORD PTR [RIP+0x239EC] |
| 5F2C | N/A | .text | CALL QWORD PTR [RIP+0x2387E] |
| 5F4F | N/A | .text | CALL QWORD PTR [RIP+0x2385B] |
| 5FAE | N/A | .text | CALL QWORD PTR [RIP+0x237FC] |
| 5FCA | N/A | .text | CALL QWORD PTR [RIP+0x237E0] |
| 60F3 | N/A | .text | CALL QWORD PTR [RIP+0x236B7] |
| 610F | N/A | .text | CALL QWORD PTR [RIP+0x2369B] |
| 619B | N/A | .text | CALL QWORD PTR [RIP+0x2360F] |
| 61B4 | N/A | .text | CALL QWORD PTR [RIP+0x235F6] |
| 61F0 | N/A | .text | CALL QWORD PTR [RIP+0x235BA] |
| 6577 | N/A | .text | JMP QWORD PTR [RIP+0x22FAB] |
| 6598 | N/A | .text | JMP QWORD PTR [RIP+0x22FB2] |
| 65A9 | N/A | .text | JMP QWORD PTR [RIP+0x22FB1] |
| 65B5 | N/A | .text | JMP QWORD PTR [RIP+0x22F85] |
| 65C1 | N/A | .text | JMP QWORD PTR [RIP+0x22F71] |
| 65F5 | N/A | .text | CALL QWORD PTR [RIP+0x22F6D] |
| 660A | N/A | .text | CALL QWORD PTR [RIP+0x231A0] |
| 6610 | N/A | .text | CALL QWORD PTR [RIP+0x22F52] |
| 6626 | N/A | .text | CALL QWORD PTR [RIP+0x22F3C] |
| 663F | N/A | .text | CALL QWORD PTR [RIP+0x2316B] |
| 667D | N/A | .text | CALL QWORD PTR [RIP+0x22EE5] |
| 66A6 | N/A | .text | CALL QWORD PTR [RIP+0x23104] |
| 66B2 | N/A | .text | CALL QWORD PTR [RIP+0x22EB0] |
| 66C8 | N/A | .text | CALL QWORD PTR [RIP+0x230E2] |
| 670B | N/A | .text | CALL QWORD PTR [RIP+0x22E57] |
| 673C | N/A | .text | CALL QWORD PTR [RIP+0x22E16] |
| 6769 | N/A | .text | JMP QWORD PTR [RIP+0x22DD9] |
| 6775 | N/A | .text | JMP QWORD PTR [RIP+0x22DB5] |
| 6788 | N/A | .text | JMP QWORD PTR [RIP+0x23022] |
| 67E1 | N/A | .text | CALL QWORD PTR [RIP+0x22FC9] |
| 6B21 | N/A | .text | JMP QWORD PTR [RIP+0x22A39] |
| 6B31 | N/A | .text | JMP QWORD PTR [RIP+0x22A19] |
| 6B39 | N/A | .text | JMP QWORD PTR [RIP+0x22A01] |
| 6B41 | N/A | .text | JMP QWORD PTR [RIP+0x22A01] |
| 6B56 | N/A | .text | CALL QWORD PTR [RIP+0x22A1C] |
| 6CED | N/A | .text | CALL QWORD PTR [RIP+0x228C5] |
| 6D00 | N/A | .text | CALL QWORD PTR [RIP+0x227C2] |
| 6D17 | N/A | .text | CALL QWORD PTR [RIP+0x227AB] |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 150426 | 57,0487% |
| Null Byte Code | 56558 | 21,4495% |
© 2026 All rights reserved.