PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 439,50 KBSHA-256 Hash: 90C573D36E19DF8549BBC900E8B3D16E3F0E0B38E6139B5BBEB28DFE2C1F4750 SHA-1 Hash: 4936D343BF461F198045C6D17C4A1ECE20963836 MD5 Hash: 539C7CBF7CE40C870E0C74596ECB0270 Imphash: 7238BD6C39921EE25D3BF50CDD4FD063 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 5DB74 SizeOfHeaders: 400 SizeOfImage: 75000 ImageBase: 400000 Architecture: x86 ImportTable: 62000 Characteristics: 818E TimeDateStamp: 2A425E19 Date: 19/06/1992 22:22:17 File Type: EXE Number Of Sections: 8 ASLR: Disabled Section Names: CODE, DATA, BSS, .idata, .tls, .rdata, .reloc, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| CODE | 0x60000020 Code Executable Readable |
400 | 5D400 | 1000 | 5D298 |
|
|
| DATA | 0xC0000040 Initialized Data Readable Writeable |
5D800 | 1400 | 5F000 | 1234 |
|
|
| BSS | 0xC0000000 Readable Writeable |
5EC00 | 0 | 61000 | CD1 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
5EC00 | 2600 | 62000 | 248C |
|
|
| .tls | 0xC0000000 Readable Writeable |
61200 | 0 | 65000 | 10 |
|
|
| .rdata | 0x50000040 Initialized Data Discardable Readable |
61200 | 200 | 66000 | 18 |
|
|
| .reloc | 0x50000040 Initialized Data Discardable Readable |
61400 | 6600 | 67000 | 6460 |
|
|
| .rsrc | 0x50000040 Initialized Data Discardable Readable |
67A00 | 6400 | 6E000 | 6400 |
|
|
| Entry Point |
The section number (1) - (CODE) have the Entry Point Information -> EntryPoint (calculated) - 5CF74 Code -> 558BECB9060000006A006A004975F9B8E4D94500E8B38CFAFF33C055681EDE450064FF306489206A00E87299FAFF8D45ECE8 Assembler |PUSH EBP |MOV EBP, ESP |MOV ECX, 6 |PUSH 0 |PUSH 0 |DEC ECX |JNE 0X45DB7C |MOV EAX, 0X45D9E4 |CALL 0X406840 |XOR EAX, EAX |PUSH EBP |PUSH 0X45DE1E |PUSH DWORD PTR FS:[EAX] |MOV DWORD PTR FS:[EAX], ESP |PUSH 0 |CALL 0X407514 |LEA EAX, [EBP - 0X14] |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Borland Delphi 7 Detect It Easy (die) • PE: compiler: Borland Delphi(6)[-] • PE: linker: Turbo Linker(2.25*,Delphi)[-] • Entropy: 6.57804 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| USER32.DLL | CallWindowProcA | Invokes the window procedure for the specified window and messages. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| Windows REG |
| SOFTWARE\Borland\Delphi\RTL Software\Borland\Locales Software\Borland\Delphi\Locales System\CurrentControlSet\Control\Keyboard Layouts\%.8x SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0 SYSTEM\CurrentControlSet\Control\Terminal Server |
| File Access |
| Advapi32.dll netapi32.dll shell32.dll comctl32.dll oleaut32.dll kernel32.dll ole32.dll user32.dll gdi32.dll mpr.dll vcltest3.dll IMM32.DLL TestExec.ini Temp |
| Interest's Words |
| exec attrib start systeminfo netcfg expand replace |
| IP Addresses |
| 10.55.2.63 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | Keyboard Key (Alt+) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (UpArrow) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ v7.0 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\0 | 6E6A8 | 134 | 680A8 | 070001002800000020000000400000000100010000000000000200000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\2\0 | 6E7DC | 134 | 681DC | 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\3\0 | 6E910 | 134 | 68310 | 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\4\0 | 6EA44 | 134 | 68444 | 0E000C002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\5\0 | 6EB78 | 134 | 68578 | 10000E002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\6\0 | 6ECAC | 134 | 686AC | 000000002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\7\0 | 6EDE0 | 134 | 687E0 | 020002002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \ICON\1\1036 | 6EF14 | 25A8 | 68914 | 280000003000000060000000010020000000000080250000130B0000130B00000000000000000000FFFFFF00FFFFFF00FFFF | (...0........ ......%............................ |
| \STRING\4084\0 | 714BC | 4FC | 6AEBC | 040041006C0074002B002C004C00650020005000720065007300730065002D00700061007000690065007200730020006E00 | ..A.l.t.+.,.L.e. .P.r.e.s.s.e.-.p.a.p.i.e.r.s. .n. |
| \STRING\4085\0 | 719B8 | E4 | 6B3B8 | 0300540061006200050045006300680061007000060045006E0074007200E900650006004500730070006100630065000800 | ..T.a.b...E.c.h.a.p...E.n.t.r...e...E.s.p.a.c.e... |
| \STRING\4086\0 | 71A9C | 148 | 6B49C | 0D004100760065007200740069007300730065006D0065006E00740006004500720072006500750072000B0049006E006600 | ..A.v.e.r.t.i.s.s.e.m.e.n.t...E.r.r.e.u.r...I.n.f. |
| \STRING\4087\0 | 71BE4 | 46C | 6B5E4 | 2B004C006500200063006F006E0074007200F4006C0065002000270025007300270020006E00270061002000700061007300 | +.L.e. .c.o.n.t.r...l.e. .’.%.s.’. .n.’.a. .p.a.s. |
| \STRING\4088\0 | 72050 | 4C4 | 6BA50 | 1E00450072007200650075007200200064002700E90063007200690074007500720065002000640061006E00730020006C00 | ..E.r.r.e.u.r. .d.’...c.r.i.t.u.r.e. .d.a.n.s. .l. |
| \STRING\4089\0 | 72514 | 4C8 | 6BF14 | 1E00560061006C006500750072002000640065002000700072006F00700072006900E9007400E900200069006E0063006F00 | ..V.a.l.e.u.r. .d.e. .p.r.o.p.r.i...t... .i.n.c.o. |
| \STRING\4090\0 | 729DC | 4D0 | 6C3DC | 1A0041006E006300EA007400720065002000640065002000270025007300270020006E006F006E002000740072006F007500 | ..A.n.c...t.r.e. .d.e. .’.%.s.’. .n.o.n. .t.r.o.u. |
| \STRING\4091\0 | 72EAC | E4 | 6C8AC | 08004E006F00760065006D0062007200650008004400E900630065006D006200720065000300440069006D0003004C007500 | ..N.o.v.e.m.b.r.e...D...c.e.m.b.r.e...D.i.m...L.u. |
| \STRING\4092\0 | 72F90 | D8 | 6C990 | 03004A0075006C00030041006F00FB00030053006500700003004F006300740003004E006F00760003004400E90063000700 | ..J.u.l...A.o.....S.e.p...O.c.t...N.o.v...D...c... |
| \STRING\4093\0 | 73068 | 2DC | 6CA68 | 1C004500720072006500750072002000640065002000760061007200690061006E007400200069006E006100740074006500 | ..E.r.r.e.u.r. .d.e. .v.a.r.i.a.n.t. .i.n.a.t.t.e. |
| \STRING\4094\0 | 73344 | 460 | 6CD44 | 07004C0065006300740075007200650008004500630072006900740075007200650031004500720072006500750072002000 | ..L.e.c.t.u.r.e...E.c.r.i.t.u.r.e.1.E.r.r.e.u.r. . |
| \STRING\4095\0 | 737A4 | 470 | 6D1A4 | 14004400E90062006F007200640065006D0065006E00740020006400270065006E00740069006500720029004F007000E900 | ..D...b.o.r.d.e.m.e.n.t. .d.’.e.n.t.i.e.r.).O.p... |
| \STRING\4096\0 | 73C14 | 3E4 | 6D614 | 2A00270025007300270020006E0027006500730074002000700061007300200075006E0065002000760061006C0065007500 | *.’.%.s.’. .n.’.e.s.t. .p.a.s. .u.n.e. .v.a.l.e.u. |
| \RCDATA\DVCLAL\0 | 73FF8 | 10 | 6D9F8 | 263D4F38C28237B8F3244203179B3A83 | &=O8..7..$B...:. |
| \RCDATA\PACKAGEINFO\0 | 74008 | 20C | 6DA08 | 000000CC000000003100000001BF496E73745F53574D545F434845465F50617274616765001046436F6D4F626A001071436F | ........1.....Inst_SWMT_CHEF_Partage..FComObj..qCo |
| \GROUP_CURSOR\32761\0 | 74214 | 14 | 6DC14 | 0000020001002000400001000100340100000100 | ...... .@.....4..... |
| \GROUP_CURSOR\32762\0 | 74228 | 14 | 6DC28 | 0000020001002000400001000100340100000200 | ...... .@.....4..... |
| \GROUP_CURSOR\32763\0 | 7423C | 14 | 6DC3C | 0000020001002000400001000100340100000300 | ...... .@.....4..... |
| \GROUP_CURSOR\32764\0 | 74250 | 14 | 6DC50 | 0000020001002000400001000100340100000400 | ...... .@.....4..... |
| \GROUP_CURSOR\32765\0 | 74264 | 14 | 6DC64 | 0000020001002000400001000100340100000500 | ...... .@.....4..... |
| \GROUP_CURSOR\32766\0 | 74278 | 14 | 6DC78 | 0000020001002000400001000100340100000600 | ...... .@.....4..... |
| \GROUP_CURSOR\32767\0 | 7428C | 14 | 6DC8C | 0000020001002000400001000100340100000700 | ...... .@.....4..... |
| \GROUP_ICON\MAINICON\1036 | 742A0 | 14 | 6DCA0 | 0000010001003030000001001800A82500000100 | ......00.......%.... |
| Intelligent String |
| • advapi32.dll • 10.55.2.63 • TestExec.ini • ole32.dll • oleaut32.dll • kernel32.dll • .tls • .wmf • USER32.DLL • comctl32.dll • vcltest3.dll • User32.dll • Partage.lnk • CloseHandleuser32.dll • CharNextAadvapi32.dll • RegCloseKeyoleaut32.dll • RegCloseKeykernel32.dll • CloseHandlempr.dll • user32.dll • SysFreeStringkernel32.dll • Sleepoleaut32.dll • VariantInitcomctl32.dll • shell32.dll • netapi32.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 634 | 462230 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 63C | 46222C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 644 | 462228 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 64C | 462224 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 654 | 462220 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 65C | 46221C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 664 | 462218 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 66C | 462214 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 674 | 462210 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 67C | 46220C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 684 | 462208 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 68C | 462204 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 694 | 462244 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 69C | 462200 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6A4 | 462240 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6AC | 4621FC | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6B4 | 4621F8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6BC | 4621F4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6C4 | 4621F0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6CC | 4621EC | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6D4 | 4621E8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6DC | 4621E4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6E4 | 4621E0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6EC | 4621DC | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6F4 | 4621D8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 6FC | 4621D4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 704 | 4621D0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 70C | 46223C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 714 | 4621CC | CODE | JMP [static] | Indirect jump to absolute memory address |
| 71C | 4621C8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 724 | 4621C4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 72C | 462254 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 734 | 462250 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 73C | 46224C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 744 | 4621C0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 74C | 4621BC | CODE | JMP [static] | Indirect jump to absolute memory address |
| 754 | 462264 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 75C | 462260 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 764 | 46225C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 76C | 4621B8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 774 | 4621B4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 77C | 4621B0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 7A8 | 4621AC | CODE | JMP [static] | Indirect jump to absolute memory address |
| 7B0 | 4621A8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 7B8 | 4621A4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 7C0 | 4621A0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 7C8 | 46219C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 7D0 | 462198 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 7D8 | 462194 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 7E0 | 462190 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 1B2D | 45F02C | CODE | CALL [static] | Indirect call to absolute memory address |
| 1B4D | 45F030 | CODE | CALL [static] | Indirect call to absolute memory address |
| 1B75 | 45F034 | CODE | CALL [static] | Indirect call to absolute memory address |
| 1B8E | 45F030 | CODE | CALL [static] | Indirect call to absolute memory address |
| 1BA7 | 45F02C | CODE | CALL [static] | Indirect call to absolute memory address |
| 1C4E | 461008 | CODE | CALL [static] | Indirect call to absolute memory address |
| 1EF5 | 46102C | CODE | CALL [static] | Indirect call to absolute memory address |
| 28B8 | 462238 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 28D5 | FF00 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 2E70 | 461014 | CODE | CALL [static] | Indirect call to absolute memory address |
| 2E8E | 461014 | CODE | CALL [static] | Indirect call to absolute memory address |
| 2EA6 | 461014 | CODE | CALL [static] | Indirect call to absolute memory address |
| 2F18 | 461014 | CODE | CALL [static] | Indirect call to absolute memory address |
| 2F38 | 461014 | CODE | CALL [static] | Indirect call to absolute memory address |
| 2F55 | 461014 | CODE | CALL [static] | Indirect call to absolute memory address |
| 3032 | 461018 | CODE | CALL [static] | Indirect call to absolute memory address |
| 3137 | 461010 | CODE | CALL [static] | Indirect call to absolute memory address |
| 31BA | 461018 | CODE | CALL [static] | Indirect call to absolute memory address |
| 326D | 461014 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 339E | FF | CODE | JMP [static] | Indirect jump to absolute memory address |
| 33F0 | 461018 | CODE | CALL [static] | Indirect call to absolute memory address |
| 3693 | 461238 | CODE | CALL [static] | Indirect call to absolute memory address |
| 37AD | 461028 | CODE | CALL [static] | Indirect call to absolute memory address |
| 46E0 | 4616F0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 46E8 | 461660 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 46F0 | 461664 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 46F8 | 46166C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4700 | 461674 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4708 | 461678 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4710 | 46167C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4718 | 461680 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4720 | 461684 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4728 | 46168C | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4730 | 461690 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4738 | 461694 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4740 | 461698 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4748 | 4616A0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4759 | 4616A4 | CODE | CALL [static] | Indirect call to absolute memory address |
| 4764 | 4616A8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 476C | 4616AC | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4774 | 4616B0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 477C | 4616B4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4784 | 4616BC | CODE | JMP [static] | Indirect jump to absolute memory address |
| 478C | 4616C0 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 4794 | 4616C4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 479C | 4616C8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 47A4 | 4616D8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 47B1 | 4616E4 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 47B8 | 4616E8 | CODE | JMP [static] | Indirect jump to absolute memory address |
| 47C0 | 4616EC | CODE | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 263495 | 58,5482% |
| Null Byte Code | 64261 | 14,2787% |
© 2026 All rights reserved.