PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 103,00 KB SHA-256 Hash: 438C646BDC8E3AE592EF61DA87DBB72A3AF98D53E1B88942C0373724CC486F59 SHA-1 Hash: DC930FC850F962280A493037C3392111DF9D80DC MD5 Hash: 508BB106A71BA20F48E0FEC514F557EA Imphash: 6A693B212401AC6CAE3BF810DEF01E0D MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 1850 SizeOfHeaders: 400 SizeOfImage: 1E000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: 18150 ImportTable: 182BC IAT: F000 Characteristics: 2022 TimeDateStamp: BB3BEE20 Date: 17/07/2069 6:09:36 File Type: DLL Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .fptable, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | D600 | 1000 | D440 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
DA00 | 9C00 | F000 | 9BCE |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
17600 | C00 | 19000 | 1BA0 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
18200 | 1000 | 1B000 | F84 |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
19200 | 200 | 1C000 | 100 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
19400 | 800 | 1D000 | 658 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - C50 Code -> 48895C24084889742410574883EC20498BF88BDA488BF183FA017505E81F0000004C8BC78BD3488BCE488B5C2430488B7424 Assembler |MOV QWORD PTR [RSP + 8], RBX |MOV QWORD PTR [RSP + 0X10], RSI |PUSH RDI |SUB RSP, 0X20 |MOV RDI, R8 |MOV EBX, EDX |MOV RSI, RCX |CMP EDX, 1 |JNE 0X180001871 |CALL 0X180001890 |MOV R8, RDI |MOV EDX, EBX |MOV RCX, RSI |MOV RBX, QWORD PTR [RSP + 0X30] |
| Signatures |
| Rich Signature Analyzer: Code -> 6718D4632379BA302379BA302379BA305AF8BF31AA79BA305AF8BE312F79BA305AF8B9312B79BA30A4F0B9312A79BA30A4F0BE312D79BA30A4F0BF310279BA305AF8BB312679BA302379BB304779BA30B6F0BE312279BA30B6F0BA312279BA30B6F0B8312279BA30526963682379BA30 Footprint md5 Hash -> 895B10104BE4155D30B79B035E37B575 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.44**)[-] • Entropy: 5.89401 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| ET Functions (carving) |
| Original Name -> AltTabWorkContinuationFocus.dll pal_focus_consume_recent_gain pal_focus_is_foreground pal_focus_is_recent_gain pal_focus_is_recent_loss pal_focus_last_recent_gain_had_alt pal_focus_last_recent_gain_had_tab pal_focus_last_recent_loss_from_no_foreground |
| File Access |
| KERNEL32.dll USER32.dll AltTabWorkContinuationFocus.dll .dat @.dat |
| File Access (UNICODE) |
| mscoree.dll |
| Interest's Words |
| start |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualProtect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Intelligent String |
| • mscoree.dll • .bss • USER32.dll • KERNEL32.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 40D | N/A | .text | CALL QWORD PTR [RIP+0xE01D] |
| 45C | N/A | .text | CALL QWORD PTR [RIP+0xDFBE] |
| 47B | N/A | .text | CALL QWORD PTR [RIP+0xDFAF] |
| 49A | N/A | .text | CALL QWORD PTR [RIP+0xDF80] |
| 4DD | N/A | .text | CALL QWORD PTR [RIP+0xDF4D] |
| 505 | N/A | .text | CALL QWORD PTR [RIP+0xDF15] |
| 512 | N/A | .text | CALL QWORD PTR [RIP+0xDF18] |
| 576 | N/A | .text | CALL QWORD PTR [RIP+0xDEA4] |
| 5BD | N/A | .text | CALL QWORD PTR [RIP+0xDE6D] |
| 5E5 | N/A | .text | CALL QWORD PTR [RIP+0xDE35] |
| 5F2 | N/A | .text | CALL QWORD PTR [RIP+0xDE38] |
| 622 | N/A | .text | CALL QWORD PTR [RIP+0xDDF8] |
| 66D | N/A | .text | CALL QWORD PTR [RIP+0xDDC5] |
| 680 | N/A | .text | CALL QWORD PTR [RIP+0xDDA2] |
| 6AD | N/A | .text | CALL QWORD PTR [RIP+0xDD85] |
| 6C0 | N/A | .text | CALL QWORD PTR [RIP+0xDD62] |
| 6ED | N/A | .text | CALL QWORD PTR [RIP+0xDD45] |
| 700 | N/A | .text | CALL QWORD PTR [RIP+0xDD22] |
| 748 | N/A | .text | CALL QWORD PTR [RIP+0xDCFA] |
| 751 | N/A | .text | CALL QWORD PTR [RIP+0xDF31] |
| 77B | N/A | .text | CALL QWORD PTR [RIP+0xDEFF] |
| 78B | N/A | .text | CALL QWORD PTR [RIP+0xDCAF] |
| 845 | N/A | .text | CALL QWORD PTR [RIP+0xDE45] |
| 85C | N/A | .text | CALL QWORD PTR [RIP+0xDE2E] |
| B6A | N/A | .text | CALL QWORD PTR [RIP+0xDB40] |
| BE1 | N/A | .text | CALL QWORD PTR [RIP+0xDAC9] |
| C20 | N/A | .text | CALL QWORD PTR [RIP+0xDA8A] |
| CBF | N/A | .text | CALL QWORD PTR [RIP+0xD79B] |
| CCD | N/A | .text | CALL QWORD PTR [RIP+0xD785] |
| CD9 | N/A | .text | CALL QWORD PTR [RIP+0xD761] |
| CE9 | N/A | .text | CALL QWORD PTR [RIP+0xD761] |
| D50 | N/A | .text | JMP QWORD PTR [RIP+0xD712] |
| E90 | N/A | .text | CALL QWORD PTR [RIP+0xD81A] |
| 10DC | N/A | .text | CALL QWORD PTR [RIP+0xD3C6] |
| 1109 | N/A | .text | CALL QWORD PTR [RIP+0xD361] |
| 1123 | N/A | .text | CALL QWORD PTR [RIP+0xD34F] |
| 1167 | N/A | .text | CALL QWORD PTR [RIP+0xD313] |
| 11BB | N/A | .text | CALL QWORD PTR [RIP+0xD2C7] |
| 11D8 | N/A | .text | CALL QWORD PTR [RIP+0xD2BA] |
| 11E3 | N/A | .text | CALL QWORD PTR [RIP+0xD2A7] |
| 122E | N/A | .text | CALL QWORD PTR [RIP+0xD47C] |
| 126A | N/A | .text | CALL QWORD PTR [RIP+0xD440] |
| 1613 | N/A | .text | CALL QWORD PTR [RIP+0xD257] |
| 165C | N/A | .text | CALL QWORD PTR [RIP+0xCE56] |
| 1776 | N/A | .text | CALL QWORD PTR [RIP+0xCD44] |
| 1889 | N/A | .text | CALL QWORD PTR [RIP+0xCE21] |
| 1AA8 | N/A | .text | CALL QWORD PTR [RIP+0xCA1A] |
| 1B2F | N/A | .text | CALL QWORD PTR [RIP+0xC99B] |
| 1C27 | N/A | .text | CALL QWORD PTR [RIP+0xC8BB] |
| 1C7A | N/A | .text | CALL QWORD PTR [RIP+0xCA30] |
| 1DF8 | N/A | .text | CALL QWORD PTR [RIP+0xC67A] |
| 2090 | N/A | .text | CALL QWORD PTR [RIP+0xC422] |
| 22A5 | N/A | .text | CALL QWORD PTR [RIP+0xC27D] |
| 22B3 | N/A | .text | CALL QWORD PTR [RIP+0xC20F] |
| 22DD | N/A | .text | CALL QWORD PTR [RIP+0xC245] |
| 234B | N/A | .text | CALL QWORD PTR [RIP+0xC1C7] |
| 2357 | N/A | .text | CALL QWORD PTR [RIP+0xC1C3] |
| 23A3 | N/A | .text | JMP QWORD PTR [RIP+0xC307] |
| 23AF | N/A | .text | JMP QWORD PTR [RIP+0xC143] |
| 23EC | N/A | .text | JMP QWORD PTR [RIP+0xC2BE] |
| 23F8 | N/A | .text | JMP QWORD PTR [RIP+0xC112] |
| 2434 | N/A | .text | JMP QWORD PTR [RIP+0xC276] |
| 2440 | N/A | .text | JMP QWORD PTR [RIP+0xC0BA] |
| 2480 | N/A | .text | CALL QWORD PTR [RIP+0xC22A] |
| 2488 | N/A | .text | CALL QWORD PTR [RIP+0xC07A] |
| 24DF | N/A | .text | CALL QWORD PTR [RIP+0xC1CB] |
| 24E7 | N/A | .text | CALL QWORD PTR [RIP+0xC003] |
| 26A6 | N/A | .text | CALL QWORD PTR [RIP+0xC004] |
| 2EE7 | N/A | .text | CALL QWORD PTR [RIP+0xB643] |
| 33D3 | N/A | .text | CALL QWORD PTR [RIP+0xB2D7] |
| 3681 | N/A | .text | CALL QWORD PTR [RIP+0xAEB1] |
| 3CFE | N/A | .text | CALL QWORD PTR [RIP+0xA9AC] |
| 3D18 | N/A | .text | CALL QWORD PTR [RIP+0xA822] |
| 3D59 | N/A | .text | CALL QWORD PTR [RIP+0xA7D9] |
| 4083 | N/A | .text | CALL QWORD PTR [RIP+0xA427] |
| 414C | N/A | .text | CALL QWORD PTR [RIP+0xA3F6] |
| 4157 | N/A | .text | CALL QWORD PTR [RIP+0xA3FB] |
| 4166 | N/A | .text | CALL QWORD PTR [RIP+0xA3E4] |
| 4195 | N/A | .text | CALL QWORD PTR [RIP+0xA3C5] |
| 41AB | N/A | .text | CALL QWORD PTR [RIP+0xA36F] |
| 41C7 | N/A | .text | CALL QWORD PTR [RIP+0xA34B] |
| 4C76 | N/A | .text | CALL QWORD PTR [RIP+0x982C] |
| 4CC4 | N/A | .text | CALL QWORD PTR [RIP+0x97FE] |
| 4CF8 | N/A | .text | CALL QWORD PTR [RIP+0x97D2] |
| 5117 | N/A | .text | CALL QWORD PTR [RIP+0x93AB] |
| 5136 | N/A | .text | CALL QWORD PTR [RIP+0x9394] |
| 51A4 | N/A | .text | CALL QWORD PTR [RIP+0x9326] |
| 5321 | N/A | .text | CALL QWORD PTR [RIP+0x91A1] |
| 5354 | N/A | .text | CALL QWORD PTR [RIP+0x9176] |
| 54AB | N/A | .text | JMP QWORD PTR [RIP+0x9027] |
| 54DF | N/A | .text | CALL QWORD PTR [RIP+0x9003] |
| 550B | N/A | .text | JMP QWORD PTR [RIP+0x8FCF] |
| 5594 | N/A | .text | CALL QWORD PTR [RIP+0x8F2E] |
| 55C9 | N/A | .text | CALL QWORD PTR [RIP+0x8F01] |
| 5600 | N/A | .text | CALL QWORD PTR [RIP+0x8EC2] |
| 5610 | N/A | .text | CALL QWORD PTR [RIP+0x8EBA] |
| 56BB | N/A | .text | CALL QWORD PTR [RIP+0x8DAF] |
| 56D3 | N/A | .text | CALL QWORD PTR [RIP+0x8D9F] |
| 570E | N/A | .text | CALL QWORD PTR [RIP+0x8D6C] |
| 5747 | N/A | .text | CALL QWORD PTR [RIP+0x8D3B] |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 54418 | 51,5947% |
| Null Byte Code | 30680 | 29,0883% |
© 2026 All rights reserved.