PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 93,05 KB SHA-256 Hash: A94ECCCB5B88E3860D619FBB3B87FF4AF6448240AB65B89D610F348D75E793F2 SHA-1 Hash: 12C2879EBB5A2DF0F1A5EB8706CC3A2C528BCCBF MD5 Hash: 70301F4CF14CC29A4312446A02227F4C Imphash: 5F510E22D141C137199E2FF4021A57BE MajorOSVersion: 5 MinorOSVersion: 1 CheckSum: 0001E961 EntryPoint (rva): 217F SizeOfHeaders: 400 SizeOfImage: 18000 ImageBase: 400000 Architecture: x86 ImportTable: 12E70 IAT: D000 Characteristics: 102 TimeDateStamp: 6377E6AD Date: 18/11/2022 20:10:21 File Type: EXE Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: highestAvailable |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | C000 | 1000 | BF3A |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
C400 | 6800 | D000 | 66F2 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
12C00 | A00 | 14000 | 1284 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
13600 | 600 | 16000 | 450 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
13C00 | 1000 | 17000 | FC0 |
|
|
| Description |
| FileVersion: 26.4.3.9662 ProductVersion: 26.4.3.9662 Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 157F Code -> E80B060000E97AFEFFFFC20000558BEC6A00FF15B0D04000FF7508FF15ACD0400068090400C0FF15B4D0400050FF15B8D040 Assembler |CALL 0X40278F |JMP 0X402003 |RET 0 |PUSH EBP |MOV EBP, ESP |PUSH 0 |CALL DWORD PTR [0X40D0B0] |PUSH DWORD PTR [EBP + 8] |CALL DWORD PTR [0X40D0AC] |PUSH 0XC0000409 |CALL DWORD PTR [0X40D0B4] |PUSH EAX |
| Signatures |
| Rich Signature Analyzer: Code -> F81028A3BC7146F0BC7146F0BC7146F008EDB7F0B67146F008EDB5F0C67146F008EDB4F0A47146F03C0A42F1AD7146F03C0A45F1A87146F03C0A43F1967146F0B509D5F0B67146F0A223D5F0BF7146F0BC7147F0CC7146F0320A4FF1BD7146F0320AB9F0BD7146F0320A44F1BD7146F052696368BC7146F0 Footprint md5 Hash -> F87DE1A44097384EC4753B562E6A2F91 • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32] • PE: compiler: Microsoft Visual C/C++(-)[-] • PE: linker: Microsoft Linker(14.33**)[-] • PE: Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 6.49904 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| Windows REG (UNICODE) |
| System\CurrentControlSet\Control\SafeBoot\Network |
| File Access |
| OLEAUT32.dll ADVAPI32.dll KERNEL32.dll SHLWAPI.dll mscoree.dll .dat @.dat |
| File Access (UNICODE) |
| mscoree.dll |
| Interest's Words |
| PADDINGX exec start ping |
| Interest's Words (UNICODE) |
| shutdown |
| URLs |
| http://ocsp.digicert.com http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl http://cacerts.digicert.com/DigiCertTrustedRootG4.crt http://crl3.digicert.com/DigiCertTrustedRootG4.crl http://cacerts.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crt http://crl3.digicert.com/DigiCertTrustedG4TimeStampingRSA4096SHA2562025CA1.crl http://www.digicert.com/CPS0 http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | Service (OpenSCManager) |
| Text | Ascii | Service (CreateService) |
| Text | Ascii | Service (StartServiceCtrlDispatcher) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Reconnaissance (FindNextFileA) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Execution (CreateEventW) |
| Entry Point | Hex Pattern | HA Archive |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\0 | 160A0 | 22C | 136A0 | 2C0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000400 | ,.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 162CC | 184 | 138CC | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version='1.0' encoding='UTF-8' standalone='y |
| Intelligent String |
| • mscoree.dll • .dll • C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetServiceRunner.pdb • .bss • KERNEL32.dll • OLEAUT32.dll • :060U00Uq]dL.g?O0U0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0U |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 453 | 40D060 | .text | CALL [static] | Indirect call to absolute memory address |
| 45D | 40D048 | .text | CALL [static] | Indirect call to absolute memory address |
| 4D2 | 40D154 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E1 | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| 64E | 40D180 | .text | CALL [static] | Indirect call to absolute memory address |
| 73C | 40D154 | .text | CALL [static] | Indirect call to absolute memory address |
| 744 | 40D050 | .text | CALL [static] | Indirect call to absolute memory address |
| 757 | 40D064 | .text | CALL [static] | Indirect call to absolute memory address |
| 764 | 40D178 | .text | CALL [static] | Indirect call to absolute memory address |
| 771 | 40D170 | .text | CALL [static] | Indirect call to absolute memory address |
| 7B6 | 40D160 | .text | CALL [static] | Indirect call to absolute memory address |
| 82E | 40D15C | .text | CALL [static] | Indirect call to absolute memory address |
| 8D8 | 40D154 | .text | CALL [static] | Indirect call to absolute memory address |
| 8E5 | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| 914 | 40D158 | .text | CALL [static] | Indirect call to absolute memory address |
| 93D | 40D154 | .text | CALL [static] | Indirect call to absolute memory address |
| 960 | 40D150 | .text | CALL [static] | Indirect call to absolute memory address |
| 98D | 40D158 | .text | CALL [static] | Indirect call to absolute memory address |
| 9E0 | 40D154 | .text | CALL [static] | Indirect call to absolute memory address |
| 9ED | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| A22 | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| B3B | 40D034 | .text | CALL [static] | Indirect call to absolute memory address |
| B4D | 40D034 | .text | CALL [static] | Indirect call to absolute memory address |
| B5E | 40D034 | .text | CALL [static] | Indirect call to absolute memory address |
| C07 | 40D16C | .text | CALL [static] | Indirect call to absolute memory address |
| C1A | 40D05C | .text | CALL [static] | Indirect call to absolute memory address |
| C3D | 40D000 | .text | CALL [static] | Indirect call to absolute memory address |
| C7F | 40D014 | .text | CALL [static] | Indirect call to absolute memory address |
| C9D | 40D160 | .text | CALL [static] | Indirect call to absolute memory address |
| CCF | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| CEA | 40D158 | .text | CALL [static] | Indirect call to absolute memory address |
| D15 | 40D15C | .text | CALL [static] | Indirect call to absolute memory address |
| D24 | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| D3F | 40D150 | .text | CALL [static] | Indirect call to absolute memory address |
| D6D | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| D8F | 40D014 | .text | CALL [static] | Indirect call to absolute memory address |
| E3B | 40D024 | .text | CALL [static] | Indirect call to absolute memory address |
| E56 | 40D150 | .text | CALL [static] | Indirect call to absolute memory address |
| E83 | 40D010 | .text | CALL [static] | Indirect call to absolute memory address |
| E99 | 40D028 | .text | CALL [static] | Indirect call to absolute memory address |
| EAE | 40D068 | .text | CALL [static] | Indirect call to absolute memory address |
| EC6 | 40D004 | .text | CALL [static] | Indirect call to absolute memory address |
| F09 | 40D020 | .text | CALL [static] | Indirect call to absolute memory address |
| F2D | 40D018 | .text | CALL [static] | Indirect call to absolute memory address |
| F45 | 40D048 | .text | CALL [static] | Indirect call to absolute memory address |
| F52 | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| F79 | 40D01C | .text | CALL [static] | Indirect call to absolute memory address |
| F99 | 40D058 | .text | CALL [static] | Indirect call to absolute memory address |
| FCA | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| FEA | 40D164 | .text | CALL [static] | Indirect call to absolute memory address |
| 1038 | 40D098 | .text | CALL [static] | Indirect call to absolute memory address |
| 1047 | 40D09C | .text | CALL [static] | Indirect call to absolute memory address |
| 1082 | 40D084 | .text | CALL [static] | Indirect call to absolute memory address |
| 14BB | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 1591 | 40D0B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 159A | 40D0AC | .text | CALL [static] | Indirect call to absolute memory address |
| 15A5 | 40D0B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 15AC | 40D0B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 15BF | 40D0BC | .text | CALL [static] | Indirect call to absolute memory address |
| 16C4 | 40D0BC | .text | CALL [static] | Indirect call to absolute memory address |
| 189E | 40D0BC | .text | CALL [static] | Indirect call to absolute memory address |
| 196A | 40D098 | .text | CALL [static] | Indirect call to absolute memory address |
| 198A | 40D0B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1994 | 40D0AC | .text | CALL [static] | Indirect call to absolute memory address |
| 19C7 | 40D0C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 19E8 | 40D050 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A2D | 40D0B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B54 | 40D0CC | .text | CALL [static] | Indirect call to absolute memory address |
| 1B63 | 40D0C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B6C | 40D04C | .text | CALL [static] | Indirect call to absolute memory address |
| 1B79 | 40D0C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BE5 | 40D0D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C6A | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C96 | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FD7 | 40D088 | .text | CALL [static] | Indirect call to absolute memory address |
| 21FF | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B8C | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CCC | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CFC | 40D0A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D40 | 40D048 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DB9 | 40D0D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E71 | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 3433 | 40D0DC | .text | CALL [static] | Indirect call to absolute memory address |
| 36A3 | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 3C1E | 40D084 | .text | CALL [static] | Indirect call to absolute memory address |
| 3D7F | 40D088 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E2A | 40D0F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E34 | 40D044 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E54 | 40D0F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E5E | 40D048 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E86 | 40D0F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3EBA | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 3EC7 | 40D0E0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EF5 | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 3EFF | 40D0EC | .text | CALL [static] | Indirect call to absolute memory address |
| 3F30 | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F3A | 40D0E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F6E | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F78 | 40D0E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FAF | 40D188 | .text | CALL [static] | Indirect call to absolute memory address |
| 14C00 | N/A | *Overlay* | 38280000000202003082282C06092A864886F70D | 8(......0.(,..*.H...) |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 54088 | 56,7627% |
| Null Byte Code | 20384 | 21,392% |
© 2026 All rights reserved.