PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 91,50 KB SHA-256 Hash: 47EAC828C08C160C84D775105D3AA24D6FC6E53FD3A7E2A758DEDC528B0AA2C3 SHA-1 Hash: 88508CF7E6EFA883CA88212EE8BECD967146D023 MD5 Hash: 565764EA2F0E55968D324F679044C5ED Imphash: 2C5F2513605E48F2D8EA5440A870CB9E MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 1000 SizeOfHeaders: 400 SizeOfImage: 1A000 ImageBase: 400000 Architecture: x86 ImportTable: 1716C IAT: 17470 Characteristics: 10F TimeDateStamp: 5D40055D Date: 30/07/2019 8:52:45 File Type: EXE Number Of Sections: 5 ASLR: Disabled Section Names: .code, .text, .rdata, .data, .rsrc Number Of Executable Sections: 2 Subsystem: Windows Console |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .code | 0x60000020 Code Executable Readable |
400 | 3A00 | 1000 | 387E |
|
|
| .text | 0x60000020 Code Executable Readable |
3E00 | DA00 | 5000 | D962 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
11800 | 3400 | 13000 | 33A5 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
14C00 | 1200 | 17000 | 178C |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
15E00 | 1000 | 19000 | FFC |
|
|
| Entry Point |
The section number (1) - (.code) have the Entry Point Information -> EntryPoint (calculated) - 400 Code -> 68AC00000068000000006868804100E85C40000083C40C6800000000E855400000A36C804100680000000068001000006800 Assembler |PUSH 0XAC |PUSH 0 |PUSH 0X418068 |CALL 0X405070 |ADD ESP, 0XC |PUSH 0 |CALL 0X405076 |MOV DWORD PTR [0X41806C], EAX |PUSH 0 |PUSH 0X1000 |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Pure Basic 4.x Detect It Easy (die) • PE: compiler: PureBasic(4.X)[-] • PE: linker: Polink(2.50*)[-] • Entropy: 6.74634 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| File Access |
| SHLWAPI.DLL OLE32.DLL WINMM.DLL SHELL32.DLL COMCTL32.DLL GDI32.DLL USER32.DLL KERNEL32.dll MSVCRT.dll @.dat Temp |
| File Access (UNICODE) |
| 0123456789abcdefKernel32.dll Shell32.DLL Kernel32.DLL SHELL32.DLL ntdll.dll |
| Interest's Words |
| exec attrib systeminfo |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ShellExecute) |
| Entry Point | Hex Pattern | PKLITE32 v1.1 |
| Entry Point | Hex Pattern | PureBasic4xNeilHodgson |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \RCDATA\126DFBE6C5CF4D12BC7745CCC93F0F1D\0 | 1921C | E | 1601C | 789C636018052319000002000001 | x.c......... |
| \RCDATA\415A7AC781\0 | 1922C | 1 | 1602C | 01 | . |
| \RCDATA\A65593E6A5E26CE322F89E11011BBB89\0 | 19230 | B5A | 16030 | 1927ABE9346321FEE4761094F2B97F7F87CC54EEF6C488182BAB5A583E1EA3CFF73AB7711883B2D79E39E876A7D53A9825E7 | .'..4c!..v........T.....+.ZX>....:.q.....9.v..:.%. |
| \RCDATA\C23A3505AE39C7C195672DCD4324CD388D6A513B\0 | 19D8C | B | 16B8C | 3723BCE82D2660FAE30F1A | 7..-&.... |
| \24\1\0 | 19D98 | 263 | 16B98 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • SHELL32.DLL • ntdll.dll • 0123456789abcdefKernel32.dll • MSVCRT.dll • USER32.DLL • GDI32.DLL • COMCTL32.DLL • SHLWAPI.DLL |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 3E70 | 417470 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3E76 | 4174B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3E7C | 4174B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3E82 | 4174BC | .text | JMP [static] | Indirect jump to absolute memory address |
| 3E88 | 4174C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3E8E | 4174C4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3E94 | 4174C8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3E9A | 4174CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EA0 | 4174D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EA6 | 4174D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EAC | 4174D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EB2 | 4174DC | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EB8 | 4174E0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EBE | 4174E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EC4 | 4174E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3ECA | 4174EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 3ED0 | 4174F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3ED6 | 4174F4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EDC | 4174F8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EE2 | 4174FC | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EE8 | 417500 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EEE | 417504 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EF4 | 417508 | .text | JMP [static] | Indirect jump to absolute memory address |
| 40F5 | 417474 | .text | JMP [static] | Indirect jump to absolute memory address |
| 40FB | 417478 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4101 | 41747C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4107 | 417480 | .text | JMP [static] | Indirect jump to absolute memory address |
| 410D | 417484 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4113 | 417488 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4119 | 41748C | .text | JMP [static] | Indirect jump to absolute memory address |
| 411F | 417490 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4125 | 417494 | .text | JMP [static] | Indirect jump to absolute memory address |
| 412B | 417498 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4131 | 41749C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4137 | 4174A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 413D | 4174A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4143 | 4174A8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4149 | 4174AC | .text | JMP [static] | Indirect jump to absolute memory address |
| 414F | 4175A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4155 | 417694 | .text | JMP [static] | Indirect jump to absolute memory address |
| 415B | 417698 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4161 | 41769C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4167 | 4176A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 416D | 4176A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 417A | 41750C | .text | CALL [static] | Indirect call to absolute memory address |
| 418F | 417510 | .text | CALL [static] | Indirect call to absolute memory address |
| 41AD | 417514 | .text | CALL [static] | Indirect call to absolute memory address |
| 41BA | 417518 | .text | CALL [static] | Indirect call to absolute memory address |
| 41D1 | 41751C | .text | CALL [static] | Indirect call to absolute memory address |
| 41EF | 41750C | .text | CALL [static] | Indirect call to absolute memory address |
| 4214 | 41751C | .text | CALL [static] | Indirect call to absolute memory address |
| 4222 | 417514 | .text | CALL [static] | Indirect call to absolute memory address |
| 4240 | 417520 | .text | CALL [static] | Indirect call to absolute memory address |
| 424C | 41750C | .text | CALL [static] | Indirect call to absolute memory address |
| 426C | 417510 | .text | CALL [static] | Indirect call to absolute memory address |
| 4280 | 417514 | .text | CALL [static] | Indirect call to absolute memory address |
| 42A5 | 417524 | .text | CALL [static] | Indirect call to absolute memory address |
| 42B7 | 41750C | .text | CALL [static] | Indirect call to absolute memory address |
| 42CE | 41751C | .text | CALL [static] | Indirect call to absolute memory address |
| 42DA | 417510 | .text | CALL [static] | Indirect call to absolute memory address |
| 431D | 417514 | .text | CALL [static] | Indirect call to absolute memory address |
| 434A | 4174B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 435A | 417528 | .text | CALL [static] | Indirect call to absolute memory address |
| 4393 | 41752C | .text | CALL [static] | Indirect call to absolute memory address |
| 43F2 | 41752C | .text | CALL [static] | Indirect call to absolute memory address |
| 44E3 | 417680 | .text | CALL [static] | Indirect call to absolute memory address |
| 44F3 | 417530 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4522 | 417534 | .text | CALL [static] | Indirect call to absolute memory address |
| 4546 | 417534 | .text | CALL [static] | Indirect call to absolute memory address |
| 4A6A | 417538 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B38 | 41753C | .text | CALL [static] | Indirect call to absolute memory address |
| 4D01 | 4175D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5505 | 4175DC | .text | CALL [static] | Indirect call to absolute memory address |
| 558C | 4175DC | .text | CALL [static] | Indirect call to absolute memory address |
| 5596 | 4175DC | .text | CALL [static] | Indirect call to absolute memory address |
| 7C15 | 417668 | .text | CALL [static] | Indirect call to absolute memory address |
| 7C1D | 417688 | .text | CALL [static] | Indirect call to absolute memory address |
| 7C43 | 4175E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 7C7A | 417538 | .text | CALL [static] | Indirect call to absolute memory address |
| 7CAD | 41753C | .text | CALL [static] | Indirect call to absolute memory address |
| 7CCF | 4175E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 7CED | 4175E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 7CFC | 4175EC | .text | CALL [static] | Indirect call to absolute memory address |
| 7D0A | 4175F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 7D1F | 417538 | .text | CALL [static] | Indirect call to absolute memory address |
| 7D2F | 4175F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 7D3D | 4175E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 7D53 | 4175F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 7DB2 | 417660 | .text | CALL [static] | Indirect call to absolute memory address |
| 7DE9 | 4175FC | .text | CALL [static] | Indirect call to absolute memory address |
| 7DF9 | 417600 | .text | CALL [static] | Indirect call to absolute memory address |
| 7E21 | 417604 | .text | CALL [static] | Indirect call to absolute memory address |
| 7E48 | 417608 | .text | CALL [static] | Indirect call to absolute memory address |
| 7E59 | 41760C | .text | CALL [static] | Indirect call to absolute memory address |
| 7ED3 | 417618 | .text | CALL [static] | Indirect call to absolute memory address |
| 7F71 | 417620 | .text | CALL [static] | Indirect call to absolute memory address |
| 8016 | 417624 | .text | CALL [static] | Indirect call to absolute memory address |
| 801F | 417628 | .text | CALL [static] | Indirect call to absolute memory address |
| 8026 | 41762C | .text | CALL [static] | Indirect call to absolute memory address |
| 8039 | 417630 | .text | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 58840 | 62,7988% |
| Null Byte Code | 13647 | 14,5652% |
© 2026 All rights reserved.