PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 32,53 KB
SHA-256 Hash: 64CDBAC35641E956372F315088D9D6D89CEBE9916894EF24C359B699FBA29F24
SHA-1 Hash: 75760A182077BE13A46C45E6B80051262B511C40
MD5 Hash: 5CBE81D6F302F75ED9AADB376590A0B5
Imphash: DAE02F32A21E03CE65412F6E56942DAA
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): 972E
SizeOfHeaders: 200
SizeOfImage: E000
ImageBase: 400000
Architecture: x86
ImportTable: 96D8
IAT: 2000
Characteristics: 2122
TimeDateStamp: D4E336F7
Date: 07/03/2083 15:55:35
File Type: DLL
Number Of Sections: 3
ASLR: Disabled
Section Names: .text, .rsrc, .reloc
Number Of Executable Sections: 1
Subsystem: Windows Console
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 200 7800 2000 7734
6.2369
456888.87
.rsrc
0x40000040
Initialized Data
Readable
 7A00 600 A000 46C
2.6271
184155
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 8000 200 C000 C
0.0815
128522
Description
OriginalFilename: RuntimeBroker.dll
CompanyName: 10.0.26100.7019
LegalCopyright: Microsoft Corporation. All rights reserved.
ProductName: Microsoft Windows Operating System
FileVersion: 10.0.26100.7019
FileDescription: Runtime Broker
ProductVersion: 10.0.26100.7019
Comments: Runtime Broker
Language: Unknown (ID=0x0)
CodePage: Unicode (UTF-16 LE) (0x4B0)
Entry Point
The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - 792E
Code -> FF25002040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
EP changed to another address -> (Address Of EntryPoint > Base Of Data)
Assembler
|JMP DWORD PTR [0X402000]
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
Signatures
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Compiler: Microsoft Visual .NET - (You can use a decompiler for this...)
• AnyCPU: True
• Version: v4.0
Detect It Easy (die)
• PE: Protector: Eziriz .NET Reactor(6.x.x.x)[By Dr.FarFar]
• PE: protector: Obfuscar(1.0)[-]
• PE: library: .NET(v4.0.30319)[-]
• PE: linker: Microsoft Linker(48.0)[-]
• Entropy: 6.01731
File Access
mscoree.dll
RuntimeBroker.dll
File Access (UNICODE)
RuntimeBroker.dll
Interest's Words
Decrypt
unescape
attrib
start
cipher
replace
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii Encryption (CipherMode)
Text Ascii Encryption (CreateDecryptor)
Text Ascii Encryption (CryptoStream)
Text Ascii Encryption (CryptoStreamMode)
Text Ascii Encryption (FromBase64String)
Text Ascii Encryption (ICryptoTransform)
Text Ascii Encryption (ToBase64String)
Text Ascii Information used to authenticate a user’s identity (Credential)
Text Ascii Information used for user authentication (Credential)
Entry Point Hex Pattern Microsoft Visual C / Basic .NET
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ 8.0
Entry Point Hex Pattern Microsoft Visual C v7.0 / Basic .NET
Entry Point Hex Pattern Microsoft Visual Studio .NET
Entry Point Hex Pattern .NET executable
Entry Point Hex Pattern TrueVision Targa Graphics format
Resources
Path DataRVA Size FileOffset CodeText
\VERSION\1\0 A058 410 7A58 100434000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
Intelligent String
• RuntimeBroker.dll
• _CorDllMainmscoree.dll
Flow Anomalies
Offset FlowVA Section Description
792E 402000 .text JMP [static] | Indirect jump to absolute memory address
8200 N/A *Overlay* 0A6368616C6C656E6765206275696C6420323032 | .challenge build 202
Extra Analysis
Metric Value Percentage
Ascii Code 17873 53,6598%
Null Byte Code 9122 27,3868%
© 2026 All rights reserved.