PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 69,50 KB SHA-256 Hash: 256FFF3DAE1BB819C8B21FDC807795C3301354797ED8714B363E532C8602A94E SHA-1 Hash: 21B9080A69C773ABC4717252B4AAA992A048BA8A MD5 Hash: 57A71607BB704159D230DDA1E0FF0147 Imphash: F9B3CCE3DE2E9E78AA0CD0519C7AB711 MajorOSVersion: 5 MinorOSVersion: 1 CheckSum: 00000000 EntryPoint (rva): 11307 SizeOfHeaders: 400 SizeOfImage: 25000 ImageBase: 10000000 Architecture: x86 ImportTable: 22000 IAT: 221D4 Characteristics: 2102 TimeDateStamp: 5915D0F1 Date: 12/05/2017 15:12:49 File Type: DLL Number Of Sections: 7 ASLR: Enabled Section Names: .textbss, .text, .rdata, .data, .idata, .rsrc, .reloc Number Of Executable Sections: 2 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker [Incomplete Binary or Compressor Packer - 78,50 KB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .textbss | 0xE00000A0 Code Uninitialized Data Executable Readable Writeable |
0 | 0 | 1000 | 10000 |
|
|
| .text | 0x60000020 Code Executable Readable |
400 | A600 | 11000 | A5CB |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
AA00 | 4000 | 1C000 | 3E77 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
EA00 | 1000 | 20000 | 1F50 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
FA00 | A00 | 22000 | 9D1 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
10400 | 600 | 23000 | 459 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
10A00 | C00 | 24000 | A93 |
|
|
| Entry Point |
The section number (2) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 707 Code -> E9730F0000E985950000E9E2170000E94B950000E9C7840000E90C5B0000E9415D0000E9D2410000E9F0940000E96F950000 EP changed to another address -> (Address Of EntryPoint > Base Of Data) Assembler |JMP 0X1001227F |JMP 0X1001A896 |JMP 0X10012AF8 |JMP 0X1001A866 |JMP 0X100197E7 |JMP 0X10016E31 |JMP 0X1001706B |JMP 0X10015501 |JMP 0X1001A824 |JMP 0X1001A8A8 |
| Signatures |
| Rich Signature Analyzer: Code -> A7B2F5BAE3D39BE9E3D39BE9E3D39BE98CA505E9EBD39BE98CA531E9D4D39BE9EAAB08E9E6D39BE9E3D39AE9A0D39BE98CA530E9F3D39BE98CA501E9E2D39BE98CA506E9E2D39BE952696368E3D39BE9 Footprint md5 Hash -> 810FA892338339630AE415CC8B265B09 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Compiler: Microsoft Visual C ++ Detect It Easy (die) • PE: compiler: Microsoft Visual C/C++(2010)[-] • PE: linker: Microsoft Linker(10.0)[-] • Entropy: 5.24559 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | WinExec | Launches a specified application. |
| URLMON.DLL | URLDownloadToFileA | Download a file from the internet and save it to a local file. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\VisualStudio\10.0\Setup\VS |
| File Access |
| \Windows\c64.exe 811/c64.exe \Windows\iexplore.exe 811/iexplore.exe \Windows\86.exe 811/86.exe urlmon.dll KERNEL32.dll @.dat |
| File Access (UNICODE) |
| USER32.DLL ADVAPI32.DLL MSPDB100.DLL mscoree.dll KERNEL32.DLL user32.dll Temp |
| Interest's Words |
| exec start |
| URLs |
| http://2.tcpip.website:811/86.exe http://2.tcpip.website:811/iexplore.exe http://2.tcpip.website:811/c64.exe |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | NeoLite v2.0 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 23170 | 196 | 10570 | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String |
| • http://2.tcpip.website:811/86.exe • c:\Windows\86.exe • http://2.tcpip.website:811/iexplore.exe • c:\Windows\iexplore.exe • http://2.tcpip.website:811/c64.exe • c:\Windows\c64.exe • user32.dll • KERNEL32.DLL • mscoree.dll • MSPDB100.DLL • ADVAPI32.DLL • USER32.DLL • \1\Debug\1.pdb • urlmon.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| FAA | 100221D8 | .text | CALL [static] | Indirect call to absolute memory address |
| FC0 | 100221D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 103A | 100221D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1050 | 100221D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 10CA | 100221D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 10E0 | 100221D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 117A | 100221D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1180 | 100221D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1186 | 1002233C | .text | JMP [static] | Indirect jump to absolute memory address |
| 13C8 | 100221EC | .text | CALL [static] | Indirect call to absolute memory address |
| 14AD | 100221E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 14C2 | 100221E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 16DA | 100221F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1750 | 100221F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 186D | 100221F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BC2 | 10020EBC | .text | CALL [static] | Indirect call to absolute memory address |
| 1C3F | 10022208 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C53 | 10022204 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CD9 | 10022200 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CE7 | 10020EBC | .text | CALL [static] | Indirect call to absolute memory address |
| 1F4D | 1002220C | .text | CALL [static] | Indirect call to absolute memory address |
| 1F56 | 10022210 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F6F | 10022214 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F90 | 10022214 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FA2 | 100221E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FB1 | 10022218 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FD9 | 100221E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FFD | 100221E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2017 | 1002221C | .text | CALL [static] | Indirect call to absolute memory address |
| 2049 | 10022224 | .text | CALL [static] | Indirect call to absolute memory address |
| 208A | 10022220 | .text | CALL [static] | Indirect call to absolute memory address |
| 211D | 1002222C | .text | CALL [static] | Indirect call to absolute memory address |
| 2159 | 100221E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 216F | 100221E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2187 | 10022228 | .text | CALL [static] | Indirect call to absolute memory address |
| 226E | 10022230 | .text | CALL [static] | Indirect call to absolute memory address |
| 2393 | 100221E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 23B0 | 10022218 | .text | CALL [static] | Indirect call to absolute memory address |
| 23D3 | 100221E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 23D9 | 10022234 | .text | JMP [static] | Indirect jump to absolute memory address |
| 23E7 | 10022224 | .text | CALL [static] | Indirect call to absolute memory address |
| 2480 | 10022210 | .text | CALL [static] | Indirect call to absolute memory address |
| 253F | 100221E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 25CE | 10022238 | .text | CALL [static] | Indirect call to absolute memory address |
| 25E0 | 1002222C | .text | CALL [static] | Indirect call to absolute memory address |
| 260A | 100221D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 266A | 100221D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 26C7 | 100221D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2728 | 100221D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 278D | 100221D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 27CF | 10022224 | .text | CALL [static] | Indirect call to absolute memory address |
| 27DF | 10022204 | .text | CALL [static] | Indirect call to absolute memory address |
| 280B | 1002223C | .text | CALL [static] | Indirect call to absolute memory address |
| 2956 | 10021F3C | .text | CALL [static] | Indirect call to absolute memory address |
| 29C3 | 10021F40 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C0E | 10022250 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D41 | 1002224C | .text | CALL [static] | Indirect call to absolute memory address |
| 2D77 | 10022248 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DCB | 10022244 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DDD | 1002224C | .text | CALL [static] | Indirect call to absolute memory address |
| 2E0B | 10022248 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E34 | 10022240 | .text | CALL [static] | Indirect call to absolute memory address |
| 2EFA | 10022254 | .text | CALL [static] | Indirect call to absolute memory address |
| 32B8 | 10022258 | .text | CALL [static] | Indirect call to absolute memory address |
| 337F | 10022260 | .text | CALL [static] | Indirect call to absolute memory address |
| 33F3 | 1002225C | .text | CALL [static] | Indirect call to absolute memory address |
| 33FF | 1002225C | .text | CALL [static] | Indirect call to absolute memory address |
| 3498 | 10022264 | .text | CALL [static] | Indirect call to absolute memory address |
| 34BA | 10022268 | .text | CALL [static] | Indirect call to absolute memory address |
| 368A | 10021DC0 | .text | CALL [static] | Indirect call to absolute memory address |
| 399C | 10022278 | .text | CALL [static] | Indirect call to absolute memory address |
| 39A8 | 10022274 | .text | CALL [static] | Indirect call to absolute memory address |
| 39B0 | 100221E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 39B8 | 10022270 | .text | CALL [static] | Indirect call to absolute memory address |
| 39C4 | 1002226C | .text | CALL [static] | Indirect call to absolute memory address |
| 3AE3 | 1002227C | .text | CALL [static] | Indirect call to absolute memory address |
| 3B2F | 1002227C | .text | CALL [static] | Indirect call to absolute memory address |
| 3C39 | 1002228C | .text | CALL [static] | Indirect call to absolute memory address |
| 3C53 | 10022288 | .text | CALL [static] | Indirect call to absolute memory address |
| 3CE5 | 10022204 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DE4 | 10022284 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DEB | 10022280 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E59 | 10022284 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E60 | 10022238 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F65 | 10022248 | .text | CALL [static] | Indirect call to absolute memory address |
| 4014 | 10022290 | .text | CALL [static] | Indirect call to absolute memory address |
| 4027 | 10022294 | .text | CALL [static] | Indirect call to absolute memory address |
| 40B7 | 10022248 | .text | CALL [static] | Indirect call to absolute memory address |
| 415B | 10022298 | .text | CALL [static] | Indirect call to absolute memory address |
| 4661 | 1002229C | .text | CALL [static] | Indirect call to absolute memory address |
| 488D | 10022230 | .text | CALL [static] | Indirect call to absolute memory address |
| 48B8 | 10022220 | .text | CALL [static] | Indirect call to absolute memory address |
| 49D2 | 100222A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 49F5 | 100222A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4AB7 | 100222A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4ACA | 1002229C | .text | CALL [static] | Indirect call to absolute memory address |
| 4D6A | 10022230 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E21 | 10022230 | .text | CALL [static] | Indirect call to absolute memory address |
| 50A9 | 10022280 | .text | CALL [static] | Indirect call to absolute memory address |
| 5105 | 10022280 | .text | CALL [static] | Indirect call to absolute memory address |
| 405-9B3 | N/A | .text | Potential obfuscated jump sequence detected, count: 291 |
| 9B4-F6F | N/A | .text | Unusual BP Cave, count: 1468 |
| FE1-FFF | N/A | .text | Unusual BP Cave, count: 31 |
| 1071-108F | N/A | .text | Unusual BP Cave, count: 31 |
| 1101-111F | N/A | .text | Unusual BP Cave, count: 31 |
| 131D-1349 | N/A | .text | Unusual BP Cave, count: 45 |
| 14F3-154B | N/A | .text | Unusual BP Cave, count: 89 |
| 1642-167E | N/A | .text | Unusual BP Cave, count: 61 |
| 198E-1A0E | N/A | .text | Unusual BP Cave, count: 129 |
| 1B4B-1B86 | N/A | .text | Unusual BP Cave, count: 60 |
| 1D26-1D6C | N/A | .text | Unusual BP Cave, count: 71 |
| 1E4F-1E86 | N/A | .text | Unusual BP Cave, count: 56 |
| 20EC-2118 | N/A | .text | Unusual BP Cave, count: 45 |
| 2192-21AF | N/A | .text | Unusual BP Cave, count: 30 |
| 22FF-2349 | N/A | .text | Unusual BP Cave, count: 75 |
| 255A-25B7 | N/A | .text | Unusual BP Cave, count: 94 |
| 29CD-29F1 | N/A | .text | Unusual BP Cave, count: 37 |
| 2B32-2B81 | N/A | .text | Unusual BP Cave, count: 80 |
| 2E46-2ED6 | N/A | .text | Unusual BP Cave, count: 145 |
| 3042-3079 | N/A | .text | Unusual BP Cave, count: 56 |
| 3226-328B | N/A | .text | Unusual BP Cave, count: 102 |
| 3347-3374 | N/A | .text | Unusual BP Cave, count: 46 |
| 340C-3430 | N/A | .text | Unusual BP Cave, count: 37 |
| 370F-3771 | N/A | .text | Unusual BP Cave, count: 99 |
| 38EB-393C | N/A | .text | Unusual BP Cave, count: 82 |
| 3A00-3A25 | N/A | .text | Unusual BP Cave, count: 38 |
| 3BB2-3C14 | N/A | .text | Unusual BP Cave, count: 99 |
| 3E8D-3F2A | N/A | .text | Unusual BP Cave, count: 158 |
| 4101-4130 | N/A | .text | Unusual BP Cave, count: 48 |
| 41FF-4221 | N/A | .text | Unusual BP Cave, count: 35 |
| 42BB-42E0 | N/A | .text | Unusual BP Cave, count: 38 |
| 442C-447D | N/A | .text | Unusual BP Cave, count: 82 |
| 4557-4574 | N/A | .text | Unusual BP Cave, count: 30 |
| 47D0-4833 | N/A | .text | Unusual BP Cave, count: 100 |
| 48D8-4900 | N/A | .text | Unusual BP Cave, count: 41 |
| 4988-49A8 | N/A | .text | Unusual BP Cave, count: 33 |
| 4A25-4A43 | N/A | .text | Unusual BP Cave, count: 31 |
| 4C2D-4CA6 | N/A | .text | Unusual BP Cave, count: 122 |
| 4E8E-4EF3 | N/A | .text | Unusual BP Cave, count: 102 |
| 5154-5178 | N/A | .text | Unusual BP Cave, count: 37 |
| 51FB-521A | N/A | .text | Unusual BP Cave, count: 32 |
| 52C8-52F2 | N/A | .text | Unusual BP Cave, count: 43 |
| 54F6-551C | N/A | .text | Unusual BP Cave, count: 39 |
| 57C7-5856 | N/A | .text | Unusual BP Cave, count: 144 |
| 59FA-5A61 | N/A | .text | Unusual BP Cave, count: 104 |
| 5B64-5B9F | N/A | .text | Unusual BP Cave, count: 60 |
| 5D4C-5DB6 | N/A | .text | Unusual BP Cave, count: 107 |
| 5F04-5F4D | N/A | .text | Unusual BP Cave, count: 74 |
| 61C7-61F3 | N/A | .text | Unusual BP Cave, count: 45 |
| 643C-646A | N/A | .text | Unusual BP Cave, count: 47 |
| 6649-66B3 | N/A | .text | Unusual BP Cave, count: 107 |
| 675A-677F | N/A | .text | Unusual BP Cave, count: 38 |
| 680B-682C | N/A | .text | Unusual BP Cave, count: 34 |
| 6CF2-6D45 | N/A | .text | Unusual BP Cave, count: 84 |
| 6E4C-6E8C | N/A | .text | Unusual BP Cave, count: 65 |
| 768C-788A | N/A | .text | Unusual BP Cave, count: 511 |
| 7C02-7CDE | N/A | .text | Unusual BP Cave, count: 221 |
| 7D5C-7D7A | N/A | .text | Unusual BP Cave, count: 31 |
| 802A-80A5 | N/A | .text | Unusual BP Cave, count: 124 |
| 81E0-821E | N/A | .text | Unusual BP Cave, count: 63 |
| 857F-8656 | N/A | .text | Unusual BP Cave, count: 216 |
| 873A-8757 | N/A | .text | Unusual BP Cave, count: 30 |
| 89A7-8A1F | N/A | .text | Unusual BP Cave, count: 121 |
| 8B5E-8B96 | N/A | .text | Unusual BP Cave, count: 57 |
| 8FF1-90C8 | N/A | .text | Unusual BP Cave, count: 216 |
| 917E-91AA | N/A | .text | Unusual BP Cave, count: 45 |
| 9285-92BA | N/A | .text | Unusual BP Cave, count: 54 |
| 9484-94DE | N/A | .text | Unusual BP Cave, count: 91 |
| 963E-9670 | N/A | .text | Unusual BP Cave, count: 51 |
| 98A7-98F3 | N/A | .text | Unusual BP Cave, count: 77 |
| 99AE-99DB | N/A | .text | Unusual BP Cave, count: 46 |
| 9B2A-9B6F | N/A | .text | Unusual BP Cave, count: 70 |
| 9D26-A9CA | N/A | .text | Unusual BP Cave, count: 3237 |
| 707 | 1001227F | .text | Possible Original Entry Point Relocation | Score=4/7 - Redirects=1 - PreJumpInstructions=0 - JumpType=JMP_NEAR - TargetOffset=0x167F - TargetSection=.text |
| 11600 | N/A | *Overlay* | 000000 | ... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 39415 | 55,3807% |
| Null Byte Code | 20262 | 28,4695% |
© 2026 All rights reserved.