PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 24,50 KBSHA-256 Hash: 3FB58064FA4DFA0AF8606F103253645B49A8FA609E9A0462F7AEAC7CE1C7614D SHA-1 Hash: 3CA723219278282016DB595E50098BF19F068FBF MD5 Hash: 63A76419AE421741DAC10BBA97329F1C Imphash: FABA43BD150C11998E765BFAC33512C6 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 39F0 SizeOfHeaders: 400 SizeOfImage: A000 ImageBase: 400000 Architecture: x86 ImportTable: 6000 IAT: 6304 Characteristics: 10E TimeDateStamp: 32E2D2B4 Date: 20/01/1997 2:04:36 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names: .text, .rdata, .data, .idata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 2E00 | 1000 | 2C86 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
3200 | 800 | 4000 | 798 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
3A00 | 400 | 5000 | 484 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
3E00 | A00 | 6000 | 802 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
4800 | 1200 | 7000 | 10A0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
5A00 | 800 | 9000 | 62A |
|
|
| Description |
| OriginalFilename: PORTSCAN.EXE CompanyName: 7th Sphere LegalCopyright: Copyright 1997 7th Sphere ProductName: PORTSCAN Application FileDescription: PORTSCAN Custom 7th Sphere Scanner Comments: 1/19/97 AM - WIDE BETA 1 - V1.1 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 2DF0 Code -> 64A100000000558BEC6AFF681044400068E23B4000506489250000000083EC785356578965E8C745FC000000006A02FF1508 Assembler |MOV EAX, DWORD PTR FS:[0] |PUSH EBP |MOV EBP, ESP |PUSH -1 |PUSH 0X404410 |PUSH 0X403BE2 |PUSH EAX |MOV DWORD PTR FS:[0], ESP |SUB ESP, 0X78 |PUSH EBX |PUSH ESI |PUSH EDI |MOV DWORD PTR [EBP - 0X18], ESP |MOV DWORD PTR [EBP - 4], 0 |PUSH 2 |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: EP:Microsoft C/C++(3.0-5.0)[-] • PE: compiler: Microsoft C/C++(3.0)[-] • PE: linker: Microsoft Linker(3.0)[-] • Entropy: 5.36909 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| File Access |
| WSOCK32.dll USER32.dll KERNEL32.dll MSVCRT40.dll MFC40.DLL @.dat \SPHERE\DOCS\SCANLOG.TXT |
| File Access (UNICODE) |
| PORTSCAN.EXE |
| Interest's Words |
| start hostname |
| Interest's Words (UNICODE) |
| start |
| Emails |
| amann@radix.net |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | Keyboard Key (Scroll) |
| Entry Point | Hex Pattern | Microsoft Visual C 2.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 4.2 (2) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 4.2 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ v4.2 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 71B0 | 2E8 | 49B0 | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \DIALOG\100\1033 | 74AC | 264 | 4CAC | C400C08000000000080000000000D9004F00000000005900650020004F006C0064006500200050006F007200740053006300 | ................O.....Y.e. .O.l.d.e. .P.o.r.t.S.c. |
| \DIALOG\102\1033 | 7710 | 58C | 4F10 | 0100FFFF0000000000000400C000CA901C0000000000EB00B700000000003700740068002000530070006800650072006500 | ..............................7.t.h. .S.p.h.e.r.e. |
| \STRING\7\1033 | 8010 | 90 | 5810 | 0000000000000000000012002600410062006F0075007400200050006F00720074005300630061006E002E002E002E000000 | ............&.A.b.o.u.t. .P.o.r.t.S.c.a.n......... |
| \GROUP_ICON\128\1033 | 7498 | 14 | 4C98 | 0000010001002020100001000400E80200000100 | ...... ............ |
| \VERSION\1\1033 | 7C9C | 374 | 549C | 740334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | t.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • C:\SPHERE\DOCS\SCANLOG.TXT • USER32.dll • Mail: amann@radix.net • PORTSCAN.EXE |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 4BD | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 544 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 5FB | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 615 | 406560 | .text | CALL [static] | Indirect call to absolute memory address |
| 709 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 783 | 406520 | .text | CALL [static] | Indirect call to absolute memory address |
| 7DB | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 863 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 8B9 | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 900 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 907 | 406524 | .text | CALL [static] | Indirect call to absolute memory address |
| AF7 | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| B7F | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| BBA | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| C24 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1105 | 406550 | .text | CALL [static] | Indirect call to absolute memory address |
| 12AB | 406540 | .text | CALL [static] | Indirect call to absolute memory address |
| 13B5 | 40654C | .text | CALL [static] | Indirect call to absolute memory address |
| 14E4 | 406554 | .text | CALL [static] | Indirect call to absolute memory address |
| 150E | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 152E | 406548 | .text | CALL [static] | Indirect call to absolute memory address |
| 1561 | 406544 | .text | CALL [static] | Indirect call to absolute memory address |
| 1676 | 406530 | .text | CALL [static] | Indirect call to absolute memory address |
| 1741 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 175B | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 17BC | 406518 | .text | CALL [static] | Indirect call to absolute memory address |
| 182E | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1891 | 406518 | .text | CALL [static] | Indirect call to absolute memory address |
| 18A5 | 406524 | .text | CALL [static] | Indirect call to absolute memory address |
| 18E4 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 18FE | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1905 | 406524 | .text | CALL [static] | Indirect call to absolute memory address |
| 1927 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 193E | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1955 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 196C | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 19A5 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A09 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A25 | 40654C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A2F | 406524 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A69 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A7C | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A8F | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AA2 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B86 | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 1EEC | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 1F0E | 406304 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F3B | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 1FE3 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 207C | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 20C2 | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 2139 | 406304 | .text | CALL [static] | Indirect call to absolute memory address |
| 2189 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 21A6 | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 2219 | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 224E | 406518 | .text | CALL [static] | Indirect call to absolute memory address |
| 2310 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 23BF | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 23CF | 406518 | .text | CALL [static] | Indirect call to absolute memory address |
| 2421 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 2452 | 406518 | .text | CALL [static] | Indirect call to absolute memory address |
| 246F | 40652C | .text | CALL [static] | Indirect call to absolute memory address |
| 248C | 40652C | .text | CALL [static] | Indirect call to absolute memory address |
| 24A2 | 40652C | .text | CALL [static] | Indirect call to absolute memory address |
| 24D8 | 40652C | .text | CALL [static] | Indirect call to absolute memory address |
| 24F4 | 406514 | .text | CALL [static] | Indirect call to absolute memory address |
| 25A7 | 406568 | .text | CALL [static] | Indirect call to absolute memory address |
| 25C6 | 40655C | .text | CALL [static] | Indirect call to absolute memory address |
| 25D6 | 40655C | .text | CALL [static] | Indirect call to absolute memory address |
| 260E | 40651C | .text | CALL [static] | Indirect call to absolute memory address |
| 2AA0 | 406448 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AA6 | 4064C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AAC | 4064BC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AB2 | 4064B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AB8 | 40631C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2ABE | 4063E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AC4 | 4063EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2ACA | 406320 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AD0 | 406324 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AD6 | 406328 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2ADC | 40632C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AE2 | 406330 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AE8 | 406334 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AEE | 406338 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AF4 | 40633C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2AFA | 406340 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B00 | 406344 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B06 | 406348 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B0C | 40634C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B12 | 406354 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B18 | 406358 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B1E | 40635C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B24 | 406360 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B2A | 406364 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B30 | 406368 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B36 | 40636C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B3C | 406370 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B42 | 406374 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B48 | 406378 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B4E | 40637C | .text | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 12113 | 48,282% |
| Null Byte Code | 9232 | 36,7985% |
© 2026 All rights reserved.