PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 248,50 KBSHA-256 Hash: 57F8E4E1D3339C0ABADC0F64FC6A4ABAFF19CD138724CDBB3FAE5F37905547C5 SHA-1 Hash: 3D20C1F2F551DBA4712F6DDA43E87DD6CD32422B MD5 Hash: 690387324DC7C8704A9430CDABF22A7A Imphash: E25AAB61B610A6308AA82A7D334D06EC MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 8D7D0 SizeOfHeaders: 1000 SizeOfImage: 91000 ImageBase: 400000 Architecture: x86 ImportTable: 90154 Characteristics: 103 TimeDateStamp: 67924F90 Date: 23/01/2025 14:17:52 File Type: EXE Number Of Sections: 3 ASLR: Disabled Section Names: UPX0, UPX1, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI [Incomplete Binary or Compressor Packer - 331,50 KB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| UPX0 | 0xE0000080 Uninitialized Data Executable Readable Writeable |
400 | 0 | 1000 | 51000 |
|
|
| UPX1 | 0xE0000040 Initialized Data Executable Readable Writeable |
400 | 3BA00 | 52000 | 3C000 |
|
|
| .rsrc | 0xC0000040 Initialized Data Readable Writeable |
3BE00 | 2400 | 8E000 | 3000 |
|
|
| Description |
| OriginalFilename: ChromeCacheView.exe CompanyName: NirSoft LegalCopyright: Copyright 2008 - 2025 Nir Sofer ProductName: ChromeCacheView FileVersion: 2.52 FileDescription: ChromeCacheView ProductVersion: 2.52 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (2) - (UPX1) have the Entry Point Information -> EntryPoint (calculated) - 3BBD0 Code -> 60BE002045008DBE00F0FAFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB Assembler |PUSHAD |MOV ESI, 0X452000 |LEA EDI, [ESI - 0X51000] |PUSH EDI |OR EBP, 0XFFFFFFFF |JMP 0X48D7F2 |NOP |NOP |NOP |NOP |NOP |NOP |MOV AL, BYTE PTR [ESI] |INC ESI |MOV BYTE PTR [EDI], AL |INC EDI |ADD EBX, EBX |JNE 0X48D7F9 |MOV EBX, DWORD PTR [ESI] |SUB ESI, -4 |ADC EBX, EBX |JB 0X48D7E8 |MOV EAX, 1 |ADD EBX, EBX |
| Signatures |
| Rich Signature Analyzer: Code -> 0424C2034045AC504045AC504045AC50D781D2504145AC506783C2507345AC506783D1505D45AC506783C150E445AC50834AF3504245AC50834AF1505145AC504045AD507C44AC506783DE501145AC506783D0504145AC506783D4504145AC50526963684045AC50 Footprint md5 Hash -> 566D0810BB0BE084160088518BB05743 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compression: UPX - Version: 3.95 Detect It Easy (die) • PE: packer: UPX(3.95)[NRV,brute] • PE: compiler: Microsoft Visual C/C++(2005)[-] • PE: linker: Microsoft Linker(8.0 or 11.0)[-] • Entropy: 7.89846 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| File Access |
| USER32.dll SHELL32.dll ole32.dll KERNEL32.DLL GDI32.dll comdlg32.dll COMCTL32.dll ADVAPI32.dll ?ePointerKERNEL32.DLL |
| File Access (UNICODE) |
| ChromeCacheView.exe |
| Interest's Words |
| <script |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | UPX - www.upx.sourceforge.net |
| Entry Point | Hex Pattern | UPX 2.90 (LZMA) |
| Entry Point | Hex Pattern | UPX v0.80 - v0.84 |
| Entry Point | Hex Pattern | UPX v0.89.6 - v1.02 / v1.05 - v1.22 |
| Entry Point | Hex Pattern | UPX v2.0 - Markus, Laszlo & Reiser (h) |
| Entry Point | Hex Pattern | UPX V2.00-V2.90 - Markus Oberhumer & Laszlo Molnar & John Reiser |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\1033 | 857A8 | 134 | 33BA8 | 59B9E19656EF9B2BECEE84639478094529CE3203200411BB57EF5AF2D82777176D1D068E1865736B9C7693B882519ABBAD5B | Y...V..+...c.x.E).2. ...W.Z..’w.m....esk.v...Q...[ |
| \CURSOR\2\1037 | 858DC | 134 | 33CDC | 0E130F417102B815D12CD162642CD26CA5226E17304E0941566A006F1167402F3817005ED220582A59803D5D0BA56D40206E | ...Aq....,.bd,.l."n.0N.AVj.o.g@/8... X*Y.=]..m@ n |
| \BITMAP\104\1037 | 85A10 | 568 | 33E10 | 6324B3DD8F604E254373630549DB458C139F9B1448D068A8C42C26A506CE5F6AE1EF90A50A1A7697FA271C609CAFF7BBA21E | c$...N%Csc.I.E.....H.h..,&..._j......v..’....... |
| \BITMAP\133\1033 | 85F78 | D8 | 34378 | 2B7BA799C2E160A757E431044622DDD0663245846E813538FBC4D87180E1072083EFA1ED764AE724BD8FDB0561E683321F1F | +{.....W.1.F"..f2E.n.58...q... ....vJ.$....a..2.. |
| \BITMAP\134\1033 | 86050 | D8 | 34450 | DA2B8D08A3263261C24745759C16481813198E831AA5D5C32CC4A6CD145571809DC065C3145560C740A8179FF40470A47475 | .+...&2a.GEu..H.........,....Uq...e..U.@.....p.tu |
| \ICON\3\1037 | 8E7AC | 2E8 | 3C5AC | 2800000020000000400000000100040000000000000200000000000000000000100000001000000000000000000080000080 | (... ...@......................................... |
| \ICON\4\1037 | 8EA98 | 128 | 3C898 | 2800000010000000200000000100040000000000C00000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\5\1037 | 8EBC4 | 8A8 | 3C9C4 | 2800000020000000400000000100080000000000000400000000000000000000000100000001000000000000000080000080 | (... ...@......................................... |
| \ICON\6\1037 | 8F470 | 568 | 3D270 | 2800000010000000200000000100080000000000000100000000000000000000000100000001000000000000000080000080 | (....... ......................................... |
| \MENU\102\1033 | 87348 | A14 | 35748 | 826EEB39AD66BABB033AADF7D99A8BBF6E8B87B6DEAD60B5F7527BF16925B872BBD7F7441CEC10873B0F6617B93F6347B8A7 | .n.9.f...:......n.......R{.i%.r...D....;.f..?cG.. |
| \MENU\104\1033 | 87D5C | 2CC | 3615C | 271C0755736104486025D17019B9B055BD975A09E2601C6E99654A97719E53FA290875A64320F7B43E564A7F77030D7CEC99 | ’..Usa.H%.p...U..Z...n.eJ.q.S.).u.C ..>VJ.w..|.. |
| \MENU\109\1037 | 88028 | 12 | 36428 | 2F423032B108B50A4072290249610256298D | /B02....@r).Ia.V). |
| \DIALOG\105\1037 | 8803C | BC | 3643C | 6ACA2C153D9680DD662D4096298B7B86900ABA6D592312F0B598D53BE0561C1389FD324424C6206DEBB863B0287BB4DF465A | j.,.=...f-@.).{....mY.....;.V....2D$. m..c.({..FZ |
| \DIALOG\107\1037 | 880F8 | 296 | 364F8 | 5547FD64DBC2DD8A9DDCAA2C05D28D8DCE9366230DC695A95FED02140A21797769391CEB555B805671AE40152C5907A4D516 | UG.d.......,......f...._....!ywi9..U[.Vq.@.,Y.... |
| \DIALOG\109\1037 | 88390 | 348 | 36790 | 10253709432045EDEC10EA8263D7E920599D480528FF41501BE1A829D788808A1471622E8F17570D1C2043857353D4466804 | .%7.C E.....c.. Y.H.(.AP...).....qb...W.. C.sS.Fh. |
| \DIALOG\110\1037 | 886D8 | 60C | 36AD8 | 175FDA72635CC5BD8B56A154A1C3714B5E5AB096EED3ED3216E211A7D3E1D4AEDC536D218B72C951C3B73F61562A509FEDB0 | ._.rc\...V.T..qKZ.....2.........Sm!.r.Q..?aV*P... |
| \DIALOG\112\1037 | 88CE4 | FA | 370E4 | 60E4B32613224D22228C670D0AABF73616C2D8C76F088B216D09031978043257E67C534AE031613C21EAA92D6F1927F9B3C0 | ..&."M"".g....6....o..!m...x.2W.|SJ.1a<!..-o.’... |
| \DIALOG\114\1037 | 88DE0 | 134 | 371E0 | 88C02D0B946B5226D2C1FB3CD05F7085D011952C5B20961AC2855D81D1C405BB117B172F8D1BC6A05B0FD45508B859208B0D | ..-..kR&...<._p....,[ ....]......{./....[..U..Y .. |
| \DIALOG\1096\1033 | 88F14 | 336 | 37314 | 43E994B0256D53AB1090F791D6746CA59BA7CB2C5641C0BAEDD081C2C10CCF20B38570A4CD3F1BA18300480D20D6402C56B7 | C...%mS......tl....,VA......... ..p..?....H. .@,V. |
| \STRING\1\1033 | 8924C | 20C | 3764C | 960D4CCA018CDF5D2B021B404C74BD0147119F96952E7F222DC488B3E333A46D22C6A50ABF60834AC7AF6165583130122737 | ..L....]+..@Lt..G......"-....3.m".....J..aeX10.’7 |
| \STRING\2\1033 | 89458 | 24 | 37858 | 017C73CBBB0AF0029E13C30E9402C015801592DFBE801B84DF8E370901D8F73B7B988E1F | .|s.......................7....;{... |
| \STRING\32\1033 | 8947C | 118 | 3787C | 5EC0435B6F9E8A3C02B8F7137F2AA358EC8E49470E5F1901AC0A039F40F90B78C73A86D18B7693F8DC062FAF8333082CB4E5 | .C[o..<.....*.X..IG._......@..x.:...v..../..3.,.. |
| \STRING\38\1033 | 89594 | 21A | 37994 | 1524301507922E5182402973DCC66020ADD357A7288D15867B878C1562C3856D0524C69C2565636A6C13813D0F398A837589 | .$0....Q.@)s.. ..W.(...{...b..m.$..%ecjl..=.9..u. |
| \STRING\39\1033 | 897B0 | 78 | 37BB0 | CBF7D96241044A1F6510C6361BD7A9200769CD051FC265D8A73D1CAD286355101189CD06422FC30121360E6969811B60615E | ...bA.J.e..6... .i....e..=..(cU.....B/..!6.ii..a |
| \STRING\47\1033 | 89828 | 44 | 37C28 | EB7A9671EC9B7F1C2E10597F657BD94A158987086408ACE76F310586D846F12209264863172047E799548A142BADC41690E704DE8881E792869F2F312E45428ADDC6DB19 | .z.q......Y.e{.J....d...o1...F.".&Hc. G..T..+............./1.EB..... |
| \STRING\48\1033 | 8986C | 1EC | 37C6C | 2156AD811BADFDEA02865805CA2D7DCB32031122D323781306FC8BFC2AE8224050253343CD30F0289827673E4F3AE464A9EF | !V........X..-}.2..".x.....*."@P%3C.0.(.’g>O:.d.. |
| \STRING\49\1033 | 89A58 | A0 | 37E58 | CFB983154EF80B24F980064CA7016B3E4526414D85A2D5B6524025D9174E2FACDD22D025C391DB183EA53071D2C8A4199729 | ....N..$...L..k>E&AM....R@%..N/..".%....>.0q.....) |
| \STRING\63\1033 | 89AF8 | B8 | 37EF8 | 896F41A448C43BD1203B9A1120D7408108DA246AA3297063D2BF7329F0D26E8CADA149762D58D835E79E60C2851AA5AE0F23 | .oA.H.;. ;.. .@...$j.)pc..s)..n...Iv-X.5........ |
| \STRING\64\1033 | 89BB0 | 14E | 37FB0 | 1FAF60224264BDD56175C243C5A9206BC482D645772206EC06B7304019856C05543FFBF6005E0743782D22C92A2D80B1799D | .."Bd..au.C.. k...Ew"....0@..l.T?....Cx-".*-..y. |
| \ACCELERATOR\103\1037 | 89D00 | 98 | 38100 | A8D6B9FB82CDC20AAF5B8B4BE10D9BB88F9165CD256C2F85F1AA355DC2ECCDAF80BF1DA49766789F85AF958F57AB13BB410A | .........[.K......e.%l/...5].........fx.....W...A. |
| \GROUP_CURSOR\103\1033 | 89D98 | 14 | 38198 | 515AACB562E14E61AC7B9A35167CC30EB259A771 | QZ..b.Na.{.5.|...Y.q |
| \GROUP_CURSOR\110\1037 | 89DAC | 14 | 381AC | 82D3EE4BD8D6D7BFC16BE1765CBEAE41AEA6C17C | ...K.....k.v\..A...| |
| \GROUP_ICON\101\1037 | 8F9DC | 3E | 3D7DC | 0000010004002020100001000400E8020000030010101000010004002801000004002020000001000800A808000005001010000001000800680500000600 | ...... ....................(..... ....................h..... |
| \VERSION\1\1037 | 8FA20 | 2E8 | 3D820 | E80234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000500 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 8FD0C | 445 | 3DB0C | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122 | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" |
| Intelligent String |
| • ChromeCacheView.exe • <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 454 | 45332C | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 1F7E | 72E6DE60 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 3603 | 2EC0DFA4 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 144D5 | 2EC0DFA4 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 146CA | 4E8C181B | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 17C45 | 1D6B90B0 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 2758B | 1D6B90B0 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 2A093 | 1D6B90B0 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 2A1E9 | F2974DF | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 38762 | F2974DF | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 3BBDF | N/A | UPX1 | Possible Original Entry Point Relocation | Score=3/7 - Redirects=2 - PreJumpInstructions=5 - JumpType=JMP_SHORT - TargetOffset=0x5414AC4C - TargetSection=UPX1 |
| 400-3BDFF | 52000 | UPX1 | Executable section anomaly, first bytes: CDFFFFFF558BEC53 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 176762 | 69,4644% |
| Null Byte Code | 6520 | 2,5622% |
| NOP Cave Found | 0x9090909090 | Block Count: 1 | Total: 0,001% |
© 2026 All rights reserved.