PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 2,03 MB SHA-256 Hash: 16BCD78F967ED322FE822CA84BC7CDA037A36E88A9C5302B62C6941A1617E275 SHA-1 Hash: 7B294918B50BC9DFDD23CE40970835C991525686 MD5 Hash: 65A0AE65BD564EB2AC902D31FE646F9D Imphash: 6ED4F5F04D62B18D96B26D6DB7C18840 MajorOSVersion: 6 MinorOSVersion: 1 CheckSum: 00210906 EntryPoint (rva): 5BF270 SizeOfHeaders: 200 SizeOfImage: 5C1000 ImageBase: 0000000000400000 Architecture: x64 ImportTable: 5C0000 Characteristics: 222 TimeDateStamp: 0 Date: 01/01/1970 File Type: EXE Number Of Sections: 3 ASLR: Disabled Section Names (Optional Header): UPX0, UPX1, UPX2 Number Of Executable Sections: 2 Subsystem: Windows Console [Incomplete Binary or Compressor Packer - 3,73 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| UPX0 | 0xE0000080 Uninitialized Data Executable Readable Writeable |
200 | 0 | 1000 | 3BD000 |
|
|
| UPX1 | 0xE0000040 Initialized Data Executable Readable Writeable |
200 | 201600 | 3BE000 | 202000 |
|
|
| UPX2 | 0xC0000040 Initialized Data Readable Writeable |
201800 | 200 | 5C0000 | 1000 |
|
|
| Entry Point |
The section number (2) have the Entry Point Information -> EntryPoint (calculated) - 201470 Code -> 53565755488D35AAEDDFFF488DBEDB2FC4FF5731DB31C94883CDFFE85000000001DB7402F3C38B1E4883EEFC11DB8A16F3C3 Assembler |PUSH RBX |PUSH RSI |PUSH RDI |PUSH RBP |LEA RSI, [RIP - 0X201256] |LEA RDI, [RSI - 0X3BD025] |PUSH RDI |XOR EBX, EBX |XOR ECX, ECX |OR RBP, 0XFFFFFFFFFFFFFFFF |CALL 0X1070 |ADD EBX, EBX |JE 0X1026 |RET |MOV EBX, DWORD PTR [RSI] |SUB RSI, -4 |ADC EBX, EBX |MOV DL, BYTE PTR [RSI] |RET |
| Packer/Compiler |
| Compression: UPX Detect It Easy (die) • PE+(64): packer: UPX(4.02)[NRV,brute] • PE+(64): Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 7.92344 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| File Access |
| KERNEL32.DLL &d/d.dll |
| Interest's Words |
| ping |
| URLs |
| http://ocsp.digicert.com http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl http://cacerts.digicert.com/DigiCertTrustedRootG4.crt http://crl3.digicert.com/DigiCertTrustedRootG4.crl http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://www.digicert.com/CPS0 http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Stealth (VirtualProtect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Intelligent String |
| • :060U00Uq]dL.g?O0U0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0U • .1RL61 • 8'CI • KERNEL32.DLL |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 29C1 | N/A | UPX1 | CALL QWORD PTR [RIP+0x1CEA09F5] |
| 2FB1 | N/A | UPX1 | CALL QWORD PTR [RIP+0xC101E2B5] |
| E5B7 | N/A | UPX1 | CALL QWORD PTR [RIP+0x365C8851] |
| EF05 | N/A | UPX1 | CALL QWORD PTR [RIP+0x38D85D4C] |
| 18C34 | N/A | UPX1 | CALL QWORD PTR [RIP+0x9D182A1F] |
| 19E23 | N/A | UPX1 | CALL QWORD PTR [RIP+0xE01C0580] |
| 211F1 | N/A | UPX1 | CALL QWORD PTR [RIP+0x22E405A1] |
| 22125 | N/A | UPX1 | JMP QWORD PTR [RIP+0x3E846C8B] |
| 222A0 | N/A | UPX1 | JMP QWORD PTR [RIP+0x77766243] |
| 24FAC | N/A | UPX1 | CALL QWORD PTR [RIP+0x4A6E2AC] |
| 25207 | N/A | UPX1 | JMP QWORD PTR [RIP+0x20831B65] |
| 27197 | N/A | UPX1 | JMP QWORD PTR [RIP+0x20B368C1] |
| 2AA77 | N/A | UPX1 | CALL QWORD PTR [RIP+0xDF86DBB] |
| 2C8E3 | N/A | UPX1 | JMP QWORD PTR [RIP+0xB219000] |
| 2D770 | N/A | UPX1 | JMP QWORD PTR [RIP+0xFE5892A4] |
| 32C50 | N/A | UPX1 | JMP QWORD PTR [RIP+0xA406C4C9] |
| 3655D | N/A | UPX1 | JMP QWORD PTR [RIP+0x1418AE06] |
| 37F3A | N/A | UPX1 | JMP QWORD PTR [RIP+0x1A77C817] |
| 3810D | N/A | UPX1 | JMP QWORD PTR [RIP+0xA237C817] |
| 381DD | N/A | UPX1 | JMP QWORD PTR [RIP+0x4A77C817] |
| 3827A | N/A | UPX1 | JMP QWORD PTR [RIP+0x2237C817] |
| 3C024 | N/A | UPX1 | CALL QWORD PTR [RIP+0x66C21BB1] |
| 3E878 | N/A | UPX1 | CALL QWORD PTR [RIP+0x8C9D4A5D] |
| 3FBDC | N/A | UPX1 | JMP QWORD PTR [RIP+0xB466DEE8] |
| 4294B | N/A | UPX1 | CALL QWORD PTR [RIP+0x2C470427] |
| 4303F | N/A | UPX1 | JMP QWORD PTR [RIP+0xFF50A2E4] |
| 441CF | N/A | UPX1 | JMP QWORD PTR [RIP+0x34860652] |
| 4C253 | N/A | UPX1 | JMP QWORD PTR [RIP+0x38ED215E] |
| 5284E | N/A | UPX1 | JMP QWORD PTR [RIP+0x4F5AE25D] |
| 56206 | N/A | UPX1 | CALL QWORD PTR [RIP+0x6AC2C817] |
| 597AC | N/A | UPX1 | JMP QWORD PTR [RIP+0x731D5889] |
| 5A669 | N/A | UPX1 | JMP QWORD PTR [RIP+0x1AF71B0B] |
| 5EBAC | N/A | UPX1 | CALL QWORD PTR [RIP+0x1B35BFD1] |
| 5F179 | N/A | UPX1 | CALL QWORD PTR [RIP+0x138C36BF] |
| 662DC | N/A | UPX1 | JMP QWORD PTR [RIP+0x4183DB03] |
| 696E8 | N/A | UPX1 | JMP QWORD PTR [RIP+0x6F03345C] |
| 6A8ED | N/A | UPX1 | JMP QWORD PTR [RIP+0x167F6638] |
| 6CAFE | N/A | UPX1 | CALL QWORD PTR [RIP+0x800C968A] |
| 6F393 | N/A | UPX1 | JMP QWORD PTR [RIP+0x96818459] |
| 6FD0B | N/A | UPX1 | JMP QWORD PTR [RIP+0x639FD20] |
| 70C6C | N/A | UPX1 | JMP QWORD PTR [RIP+0x736F7483] |
| 70FF2 | N/A | UPX1 | JMP QWORD PTR [RIP+0x736F7483] |
| 73BC8 | N/A | UPX1 | JMP QWORD PTR [RIP+0xA863A820] |
| 76E54 | N/A | UPX1 | CALL QWORD PTR [RIP+0x2D40520D] |
| 76E62 | N/A | UPX1 | CALL QWORD PTR [RIP+0x32C5020E] |
| 780E5 | N/A | UPX1 | CALL QWORD PTR [RIP+0x24418361] |
| 7819C | N/A | UPX1 | CALL QWORD PTR [RIP+0x5884E962] |
| 790C7 | N/A | UPX1 | CALL QWORD PTR [RIP+0x4F21A298] |
| 7946E | N/A | UPX1 | CALL QWORD PTR [RIP+0x8E403A] |
| 7A7FE | N/A | UPX1 | CALL QWORD PTR [RIP+0x46B69BF4] |
| 7B8A4 | N/A | UPX1 | CALL QWORD PTR [RIP+0xF402D724] |
| 7E738 | N/A | UPX1 | JMP QWORD PTR [RIP+0x6C3900A3] |
| 8358C | N/A | UPX1 | CALL QWORD PTR [RIP+0x1BA8DA6E] |
| 85237 | N/A | UPX1 | JMP QWORD PTR [RIP+0x1B1680A5] |
| 87745 | N/A | UPX1 | CALL QWORD PTR [RIP+0x52197627] |
| 88984 | N/A | UPX1 | CALL QWORD PTR [RIP+0x3005644C] |
| 8B263 | N/A | UPX1 | CALL QWORD PTR [RIP+0x19790246] |
| 8F71B | N/A | UPX1 | JMP QWORD PTR [RIP+0xEB55643B] |
| 926A2 | N/A | UPX1 | JMP QWORD PTR [RIP+0x24799058] |
| 994F3 | N/A | UPX1 | CALL QWORD PTR [RIP+0x781D5BF6] |
| A1D7F | N/A | UPX1 | JMP QWORD PTR [RIP+0xBE5604A0] |
| A2CCE | N/A | UPX1 | CALL QWORD PTR [RIP+0xD2DD7F08] |
| ACE5F | N/A | UPX1 | JMP QWORD PTR [RIP+0x23450474] |
| AE8E4 | N/A | UPX1 | JMP QWORD PTR [RIP+0xD032052A] |
| B66D0 | N/A | UPX1 | JMP QWORD PTR [RIP+0x47EDAD59] |
| B85B8 | N/A | UPX1 | JMP QWORD PTR [RIP+0x27C4D315] |
| C08E5 | N/A | UPX1 | JMP QWORD PTR [RIP+0x812E7505] |
| C7301 | N/A | UPX1 | JMP QWORD PTR [RIP+0x5148A910] |
| C7657 | N/A | UPX1 | JMP QWORD PTR [RIP+0x2D21671A] |
| C7E5A | N/A | UPX1 | CALL QWORD PTR [RIP+0x2FC0BC55] |
| C85D9 | N/A | UPX1 | JMP QWORD PTR [RIP+0x26E20E47] |
| C8A70 | N/A | UPX1 | JMP QWORD PTR [RIP+0x3D5410AE] |
| C97F0 | N/A | UPX1 | JMP QWORD PTR [RIP+0x51C45B15] |
| CA053 | N/A | UPX1 | JMP QWORD PTR [RIP+0x4C68F999] |
| CA9D4 | N/A | UPX1 | JMP QWORD PTR [RIP+0xA034069E] |
| CAE6D | N/A | UPX1 | JMP QWORD PTR [RIP+0x1A27DB2] |
| CB012 | N/A | UPX1 | JMP QWORD PTR [RIP+0xA41AEB8] |
| CB262 | N/A | UPX1 | JMP QWORD PTR [RIP+0x38D972BF] |
| CBDF4 | N/A | UPX1 | JMP QWORD PTR [RIP+0x4A7D4CE1] |
| CBF02 | N/A | UPX1 | JMP QWORD PTR [RIP+0x44FC2E2] |
| CC0A5 | N/A | UPX1 | JMP QWORD PTR [RIP+0x2318A1F4] |
| CC594 | N/A | UPX1 | JMP QWORD PTR [RIP+0x6061E6F7] |
| CFA6F | N/A | UPX1 | JMP QWORD PTR [RIP+0x6F623C21] |
| D4095 | N/A | UPX1 | CALL QWORD PTR [RIP+0x4C975A29] |
| D916C | N/A | UPX1 | CALL QWORD PTR [RIP+0xCED80100] |
| D964C | N/A | UPX1 | CALL QWORD PTR [RIP+0x4692A390] |
| DF690 | N/A | UPX1 | CALL QWORD PTR [RIP+0x133823F5] |
| E29FC | N/A | UPX1 | JMP QWORD PTR [RIP+0x2505E10A] |
| E5962 | N/A | UPX1 | JMP QWORD PTR [RIP+0x53D6808] |
| E87CA | N/A | UPX1 | JMP QWORD PTR [RIP+0xE21F9007] |
| EA55B | N/A | UPX1 | JMP QWORD PTR [RIP+0xA92FD807] |
| EB194 | N/A | UPX1 | JMP QWORD PTR [RIP+0x6E68D37C] |
| EC18B | N/A | UPX1 | JMP QWORD PTR [RIP+0x6F1CD253] |
| EC43A | N/A | UPX1 | CALL QWORD PTR [RIP+0xB4C98081] |
| EC4FB | N/A | UPX1 | CALL QWORD PTR [RIP+0xC919568C] |
| EC524 | N/A | UPX1 | CALL QWORD PTR [RIP+0x3E79A434] |
| EC57B | N/A | UPX1 | JMP QWORD PTR [RIP+0xB3F601CD] |
| ECA60 | N/A | UPX1 | JMP QWORD PTR [RIP+0x7B1CF243] |
| ED90E | N/A | UPX1 | JMP QWORD PTR [RIP+0xFFB19ABF] |
| F2D1A | N/A | UPX1 | JMP QWORD PTR [RIP+0x1A3BFC65] |
| 200-2017FF | 3BE000 | UPX1 | Executable section anomaly, first bytes: 342E303200555058 |
| 201A00 | N/A | *Overlay* | A8510000000202003082519806092A864886F70D | .Q......0.Q...*.H... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1472046 | 69,2821% |
| Null Byte Code | 16223 | 0,7635% |
© 2026 All rights reserved.