PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 414,00 KBSHA-256 Hash: F407C5CFAD75CA4775A27A59088A48CF6D7AEBD1290BAFCFE27E8583C412CAD7 SHA-1 Hash: 32DBC983D9E5C69CE6A87CC01C673CE2B8EB0DCF MD5 Hash: 78343FC2BA62E4AC5B3D62C2769C83E4 Imphash: EF471C0EDF1877CD5A881A6A8BF647B9 MajorOSVersion: 5 MinorOSVersion: 1 CheckSum: 00000000 EntryPoint (rva): EAF00 SizeOfHeaders: 1000 SizeOfImage: 100000 ImageBase: 400000 Architecture: x86 ImportTable: FEC20 Characteristics: 122 TimeDateStamp: 6911EE1F Date: 10/11/2025 13:52:31 File Type: EXE Number Of Sections: 3 ASLR: Enabled Section Names: UPX0, UPX1, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker [Incomplete Binary or Compressor Packer - 610,00 KB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| UPX0 | 0xE0000080 Uninitialized Data Executable Readable Writeable |
400 | 0 | 1000 | 96000 |
|
|
| UPX1 | 0xE0000040 Initialized Data Executable Readable Writeable |
400 | 54200 | 97000 | 55000 |
|
|
| .rsrc | 0xC0000040 Initialized Data Readable Writeable |
54600 | 13200 | EC000 | 14000 |
|
|
| Description |
| Language: English (United Kingdom) (ID=0x809) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (2) - (UPX1) have the Entry Point Information -> EntryPoint (calculated) - 54300 Code -> 60BE007049008DBE00A0F6FF57EB0B908A064688074701DB75078B1E83EEFC11DB72EDB80100000001DB75078B1E83EEFC11 Assembler |PUSHAD |MOV ESI, 0X497000 |LEA EDI, [ESI - 0X96000] |PUSH EDI |JMP 0X4EAF1A |NOP |MOV AL, BYTE PTR [ESI] |INC ESI |MOV BYTE PTR [EDI], AL |INC EDI |ADD EBX, EBX |JNE 0X4EAF21 |MOV EBX, DWORD PTR [ESI] |SUB ESI, -4 |ADC EBX, EBX |JB 0X4EAF10 |MOV EAX, 1 |ADD EBX, EBX |JNE 0X4EAF33 |MOV EBX, DWORD PTR [ESI] |SUB ESI, -4 |
| Signatures |
| Rich Signature Analyzer: Code -> FD64C89EB905A6CDB905A6CDB905A6CD27A561CDB805A6CD48C36BCD8A05A6CD48C368CD1705A6CD48C369CD8B05A6CDB07D25CDB005A6CDB07D35CD9C05A6CDB905A7CDAD07A6CDDFEB7ECDF405A6CDDFEB6BCDBB05A6CDDFEB6FCDB805A6CDB90531CDB805A6CDDFEB6ACDB805A6CD52696368B905A6CD Footprint md5 Hash -> FB7356D50041EAE0004BFF8AD52855C5 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compression: UPX - Version: 3.91 Detect It Easy (die) • PE: packer: UPX(3.91)[NRV,brute] • PE: library: AutoIt(3.XX)[-] • PE: linker: Microsoft Linker(11.0)[-] • Entropy: 7.88294 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| File Access |
| WSOCK32.dll WINMM.dll WININET.dll VERSION.dll UxTheme.dll USERENV.dll USER32.dll SHELL32.dll PSAPI.DLL OLEAUT32.dll ole32.dll MPR.dll IPHLPAPI.DLL GDI32.dll COMDLG32.dll COMCTL32.dll ADVAPI32.dll KERNEL32.DLL kernel32.dll UserProfile |
| Interest's Words |
| exec start |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 - Debug |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (MFC) |
| Entry Point | Hex Pattern | UPX - www.upx.sourceforge.net |
| Entry Point | Hex Pattern | UPX v0.89.6 - v1.02 / v1.05 - v1.22 |
| Entry Point | Hex Pattern | UPX V2.00-V2.90 - Markus Oberhumer & Laszlo Molnar & John Reiser |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\2057 | EC4A4 | 128 | 54AA4 | 2800000010000000200000000100040000000000C000000000000000000000000000000000000000000000007A60EB00795F | (....... ...................................z..y_ |
| \ICON\2\2057 | EC5D0 | 2E8 | 54BD0 | 2800000020000000400000000100040000000000000000000000000000000000000000000000000000000000000000000080 | (... ...@......................................... |
| \ICON\3\2057 | EC8BC | 128 | 54EBC | 2800000010000000200000000100040000000000000000000000000000000000000000000000000000000000000000000080 | (....... ......................................... |
| \ICON\4\2057 | EC9E8 | EA8 | 54FE8 | 28000000300000006000000001000800000000000000000000000000000000000000000000000000000000009F7747000000 | (...0.......................................wG... |
| \ICON\5\2057 | ED894 | 8A8 | 55E94 | 2800000020000000400000000100080000000000000000000000000000000000000000000000000000000000A06A3C00AB7E | (... ...@....................................j<..~ |
| \ICON\6\2057 | EE140 | 568 | 56740 | 28000000100000002000000001000800000000000000000000000000000000000000000000000000000000009E6F3E009D72 | (....... ....................................o>..r |
| \ICON\7\2057 | EE6AC | 25A8 | 56CAC | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... |
| \ICON\8\2057 | F0C58 | 10A8 | 59258 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\9\2057 | F1D04 | 468 | 5A304 | 2800000010000000200000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (....... ..... ................................... |
| \STRING\7\2057 | CA148 | 594 | 33548 | 4D5C014011B9A212CF9947B0031F873474539BA15AA46216494240810F32704779504AFEC0456F538D0878248E496040581D | M\.@......G....4tS..Z.b.IB@..2pGyPJ..EoS..x$.I@X. |
| \STRING\8\2057 | CA6DC | 68A | 33ADC | 7F610AAD74F7957E285054ADF1C640046D4FCEB8C2F82009630464D0D18BC3BE57D58B1333A85EAF5757538DAAAA3B8C56D7 | .a..t..~(PT...@.mO.... .c.d.....W...3..WWS...;.V. |
| \STRING\9\2057 | CAD68 | 490 | 34168 | CA04E100D8B2DB20E895A489F4B07C95D5741E143D33B82E2A0C189A1139C55E460397C5927638038E8CA0F67F869D037C04 | ....... ......|..t..=3..*....9.F....v8.........|. |
| \STRING\10\2057 | CB1F8 | 5FC | 345F8 | B5A14DC28393E93D135C1E4060A5B23AE8BD659953E03959E3FBE10068112D1798521684BF194068611CFA896B0F4D094A32 | ..M....=.\.@..:..e.S.9Y....h.-..R....@ha...k.M.J2 |
| \STRING\11\2057 | CB7F4 | 65C | 34BF4 | A995DE5581E36C855A43BB228944DBFEBAE284052763663981DD47D8F0F3557C553E88FA2C4AF48BCBC4C20A7853D8770D71 | ...U..l.ZC.".D......’cf9..G...U|U>..,J......xS.w.q |
| \STRING\12\2057 | CBE50 | 466 | 35250 | 6886336883952B57AE2C68852568821E688417D05EE7CA68041068020A060E7891DA224D6F142652F81387305DEFE73DDB7B | h.3h..+W.,h.%h..h.....h..h....x.."Mo.&R...0]..=.{ |
| \STRING\313\2057 | CC2B8 | 158 | 356B8 | 9422630D579B7F83DE5F86E7CB22856D94A612A3307A09400D3BDD14E83F21FA75A6C6975069DA7419A171699D8608187810 | ."c.W...._...".m....0z.@.;...?!.u...Pi.t..qi....x. |
| \RCDATA\SCRIPT\0 | F2170 | C586 | 5A770 | A3484BBE986C4AA9994C530A86D6487D41553321454130364DA8FF7324A73CF67A12F167ACC193E76B43CA52A6AD0000E1BB | .HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R...... |
| \GROUP_ICON\99\2057 | FE6FC | 76 | 66CFC | 0000010008002020100001000400E8020000020010101000010004002801000003003030000001000800A80E000004002020 | ...... ....................(.....00............ |
| \GROUP_ICON\169\2057 | FE778 | 14 | 66D78 | 0000010001001010100001000400280100000100 | ..............(..... |
| \VERSION\1\2057 | FE790 | DC | 66D90 | DC0034000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\2057 | FE870 | 3B0 | 66E70 | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122 | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 41F | FE870 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 10CA6 | 25CC2202 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 12C3E | 25CC2202 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 143E0 | 443B8486 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 172E7 | 68093DEA | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 22240 | 28A22B8 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 2AD47 | 28A22B8 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 334C5 | 2541A4C1 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 406B4 | 2541A4C1 | UPX1 | JMP [static] | Indirect jump to absolute memory address |
| 4585C | 2541A4C1 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 48347 | 79616F80 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 504CA | 2328F8D8 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 50A03 | 2328F8D8 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 52E93 | 238E7A02 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 5322C | E1CEA2B | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 535FF | D6D6923 | UPX1 | CALL [static] | Indirect call to absolute memory address |
| 56BB9 | D0C0918 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 400-545FF | 97000 | UPX1 | Executable section anomaly, first bytes: DBFFFFFF558BEC56 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 286251 | 67,5222% |
| Null Byte Code | 14507 | 3,422% |
© 2026 All rights reserved.