PESCAN.IO - Analysis Report

PESCAN.IO - Analysis Report

File Structure:
PE chart code: - The executable header is displayed in light blue. - The executable sections are pink. - Non-executable sections are black. - Code added to executables externally to a compiler appears in red. Chart code for other files: - Printable characters are blue. - Non-printable characters (Null Bytes) are black.

Information:

Size: 2,50 MB
SHA-256 Hash: 4809EB53DEBF0923F50D3BA05C05B5B149F3D6F1C65D43871044522F80EA3241
SHA-1 Hash: 072ADF2D6CB8104A44E8AEF76AC846D5F4F45558
MD5 Hash: 6CE7E21B0E6D41794777C8ADA46577E7
Imphash: D41D8CD98F00B204E9800998ECF8427E
MajorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): 281120
SizeOfHeaders: 280110
SizeOfImage: 7027A000
ImageBase: 10000
Architecture: x86
ImportTable: 281020
Characteristics: 102
TimeDateStamp: 0
Date: 01/01/1970
File Type: EXE
Number Of Sections: -1
ASLR: Disabled
Number Of Executable Sections: 0
Subsystem: Windows Console
[Incomplete Binary or Compressor Packer - 1,75 GB Missing]

Entry Point:

Information -> EntryPoint (calculated) - 290519
EP changed to another address -> (Address Of EntryPoint > Base Of Data)

Signatures:

Certificate - Digital Signature Not Found:
• The file is not signed

Packer/Compiler:

Detect It Easy (die)
• Entropy: 1.69613

File Access:

msvcrt.dll
kernel32.dll

Interest's Words:

exec

Intelligent String:

• kernel32.dll
• msvcrt.dll

Extra 4n4lysis:

Metric	Value	Percentage
Ascii Code	479491	18,284%
Null Byte Code	2102831	80,1853%