PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 79,00 KB SHA-256 Hash: 3AA891D3A2F59A8F956570423BE1D12CDCE1424DFC93B2DA8599A913D5AA47EB SHA-1 Hash: 25BC9BDC05B24C2446D2AD7A11D99CCFF9E45DC4 MD5 Hash: 623DAEDA52A6C10F061C7387B5E7A485 Imphash: 5E0E85D2CF7E075F37F9D081C1DB394C MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): D232 SizeOfHeaders: 400 SizeOfImage: 1A000 ImageBase: 10000000 Architecture: x86 ExportTable: 11160 ImportTable: 1138C IAT: F000 Characteristics: 2102 TimeDateStamp: 626C3C2F Date: 29/04/2022 19:27:43 File Type: DLL Number Of Sections: 7 ASLR: Enabled Section Names: .text, .rdata, .data, .detourc, .detourd, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | DC00 | 1000 | DA6C |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
E000 | 3200 | F000 | 317C |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
11200 | 200 | 13000 | 60C |
|
|
| .detourc | 0x40000040 Initialized Data Readable |
11400 | 1200 | 14000 | 1188 |
|
|
| .detourd | 0xC0000040 Initialized Data Readable Writeable |
12600 | 200 | 16000 | C |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
12800 | 200 | 17000 | F8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
12A00 | 1200 | 18000 | 10E4 |
|
|
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - C632 Code -> 558BEC837D0C017505E83E050000FF7510FF750CFF7508E8AEFEFFFF83C40C5DC20C00558BEC568B7508FF36E88F060000FF Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X1000D240 |CALL 0X1000D77E |PUSH DWORD PTR [EBP + 0X10] |PUSH DWORD PTR [EBP + 0XC] |PUSH DWORD PTR [EBP + 8] |CALL 0X1000D0FC |ADD ESP, 0XC |POP EBP |RET 0XC |PUSH EBP |MOV EBP, ESP |PUSH ESI |MOV ESI, DWORD PTR [EBP + 8] |PUSH DWORD PTR [ESI] |CALL 0X1000D8F2 |
| Signatures |
| Rich Signature Analyzer: Code -> 70636FB5340201E6340201E6340201E63D7A92E63C0201E6667704E7270201E6667705E73E0201E6667702E7360201E6667700E7300201E66F6A07E7360201E66F6A05E7350201E66F6A00E7270201E6340200E6AF0201E6627708E7270201E6627701E7350201E66277FEE6350201E6627703E7350201E652696368340201E6 Footprint md5 Hash -> 3408AE8F8B36E58B4AF79C221B73F6F9 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Compiler: Microsoft Visual C ++ 6 DLL Detect It Easy (die) • PE: linker: Microsoft Linker(14.29**)[-] • Entropy: 6.30482 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | OpenEventA | Opens an existing event object. |
| KERNEL32.DLL | OpenEventW | Opens an existing event object. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| ET Functions (carving) |
| Original Name -> version.dll GetFileVersionInfoA GetFileVersionInfoByHandle GetFileVersionInfoExA GetFileVersionInfoExW GetFileVersionInfoSizeA GetFileVersionInfoSizeExA GetFileVersionInfoSizeExW GetFileVersionInfoSizeW GetFileVersionInfoW VerFindFileA VerFindFileW VerInstallFileA VerInstallFileW VerLanguageNameA VerLanguageNameW VerQueryValueA VerQueryValueW |
| File Access |
| api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll VCRUNTIME140.dll MSVCP140.dll ole32.dll ADVAPI32.dll GDI32.dll USER32.dll KERNEL32.dll DSOUND.dll DDRAW.dll version.dll .dat @.dat Temp |
| File Access (UNICODE) |
| MSCOREE.DLL Cannot load original version.dll GetProcAddress\version.dll kernel32.dll |
| Interest's Words |
| exec attrib |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 17060 | 91 | 12860 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • api-ms-win-crt-string-l1-1-0.dll • 8_initterm9_initterm_eapi-ms-win-crt-runtime-l1-1-0.dll • api-ms-win-core-synch-l1-2-0.dll • kernel32.dll • \version.dll • vector too long.ttf • .ttc • .otf • sjis_ext.bin • MSCOREE.DLL • E:\Projects\VnTools\VNTranslationTools\Release\VNTextProxy.pdb • .tls • .bss • KERNEL32.dll • USER32.dll • ADVAPI32.dll • VCRUNTIME140.dll • api-ms-win-crt-stdio-l1-1-0.dll • api-ms-win-crt-heap-l1-1-0.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| C88 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| CE5 | 1000F134 | .text | CALL [static] | Indirect call to absolute memory address |
| CF5 | 1000F134 | .text | CALL [static] | Indirect call to absolute memory address |
| E29 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| E9A | 1000F1A8 | .text | CALL [static] | Indirect call to absolute memory address |
| EC0 | 1000F1A8 | .text | CALL [static] | Indirect call to absolute memory address |
| F0E | 1000F1A4 | .text | CALL [static] | Indirect call to absolute memory address |
| F4E | 1000F1A4 | .text | CALL [static] | Indirect call to absolute memory address |
| F9E | 1000F1A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 101D | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 10AF | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1125 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1135 | 10013544 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1164 | 1000F124 | .text | CALL [static] | Indirect call to absolute memory address |
| 11E6 | 1000F0F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 11F0 | 1000F128 | .text | CALL [static] | Indirect call to absolute memory address |
| 129B | 1000F098 | .text | CALL [static] | Indirect call to absolute memory address |
| 12B2 | 1000F230 | .text | CALL [static] | Indirect call to absolute memory address |
| 12C2 | 1000F104 | .text | CALL [static] | Indirect call to absolute memory address |
| 12DB | 1000F14C | .text | CALL [static] | Indirect call to absolute memory address |
| 12E2 | 1000F110 | .text | CALL [static] | Indirect call to absolute memory address |
| 13DE | 1000F124 | .text | CALL [static] | Indirect call to absolute memory address |
| 145B | 1000F128 | .text | CALL [static] | Indirect call to absolute memory address |
| 14E0 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 17FF | 1000F05C | .text | CALL [static] | Indirect call to absolute memory address |
| 183A | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 18C2 | 1000F228 | .text | CALL [static] | Indirect call to absolute memory address |
| 18FC | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1997 | 1000F058 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A1E | 1000F224 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A4F | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CBC | 1000F054 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CF0 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1DB8 | 1000F050 | .text | CALL [static] | Indirect call to absolute memory address |
| 1DF5 | 1000F04C | .text | CALL [static] | Indirect call to absolute memory address |
| 1E53 | 1000F048 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E89 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1EF3 | 1000F044 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F29 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2058 | 1000F050 | .text | CALL [static] | Indirect call to absolute memory address |
| 2076 | 1000F040 | .text | CALL [static] | Indirect call to absolute memory address |
| 20AA | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 23B8 | 1000F0FC | .text | CALL [static] | Indirect call to absolute memory address |
| 23E5 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 24A8 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 25C3 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 25E5 | 1000F100 | .text | CALL [static] | Indirect call to absolute memory address |
| 27A0 | 100135B0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 27B0 | 100135AC | .text | JMP [static] | Indirect jump to absolute memory address |
| 27C0 | 100135A8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 27D0 | 100135A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 27E0 | 100135A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 27F0 | 1001359C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2800 | 10013598 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2810 | 10013594 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2820 | 10013590 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2830 | 1001358C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2840 | 10013588 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2850 | 10013584 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2860 | 10013580 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2870 | 1001357C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2880 | 10013578 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2890 | 10013574 | .text | JMP [static] | Indirect jump to absolute memory address |
| 28A0 | 10013570 | .text | JMP [static] | Indirect jump to absolute memory address |
| 291F | 1000F150 | .text | CALL [static] | Indirect call to absolute memory address |
| 2926 | 1000F03C | .text | CALL [static] | Indirect call to absolute memory address |
| 293B | 1000F038 | .text | CALL [static] | Indirect call to absolute memory address |
| 2951 | 1000F050 | .text | CALL [static] | Indirect call to absolute memory address |
| 295D | 1000F034 | .text | CALL [static] | Indirect call to absolute memory address |
| 2A07 | 1000F034 | .text | CALL [static] | Indirect call to absolute memory address |
| 2A73 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B3B | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C35 | 1000F134 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D84 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DE5 | 1000F228 | .text | CALL [static] | Indirect call to absolute memory address |
| 30D5 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 323C | 1000F02C | .text | CALL [static] | Indirect call to absolute memory address |
| 329E | 1000F02C | .text | CALL [static] | Indirect call to absolute memory address |
| 3422 | 1000F028 | .text | CALL [static] | Indirect call to absolute memory address |
| 35B5 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3633 | 1000F0FC | .text | CALL [static] | Indirect call to absolute memory address |
| 363A | 1000F118 | .text | CALL [static] | Indirect call to absolute memory address |
| 3649 | 1000F1AC | .text | CALL [static] | Indirect call to absolute memory address |
| 3A45 | 1000F0F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3B03 | 1000F0EC | .text | CALL [static] | Indirect call to absolute memory address |
| 3C81 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3D6D | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E2F | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FA2 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4115 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4165 | 1000F138 | .text | CALL [static] | Indirect call to absolute memory address |
| 4215 | 1000F1E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 43E0 | 1000F0E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 455C | 1000F0E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 475C | 1000F0FC | .text | CALL [static] | Indirect call to absolute memory address |
| 476F | 1000F118 | .text | CALL [static] | Indirect call to absolute memory address |
| 477E | 1000F1AC | .text | CALL [static] | Indirect call to absolute memory address |
| 47B3 | 1000F22C | .text | CALL [static] | Indirect call to absolute memory address |
| 47CC | 1000F20C | .text | CALL [static] | Indirect call to absolute memory address |
| 47F9 | 1000F214 | .text | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 46902 | 57,9781% |
| Null Byte Code | 15853 | 19,5968% |
© 2026 All rights reserved.