PREMIUM PESCAN.IO - Analysis Report

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header

Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 2,17 MB
SHA-256 Hash: 24BB00C15D9C125410330B8D5FBFD8AC5FB117B2A7C1FB832A6E1C056624E1D6
SHA-1 Hash: 29BB44A6DBCA85135A17CBD17C53D7CCAA819915
MD5 Hash: 7F76E159C1E3A21C34BB0C97C8FB9B12
Imphash: 91B2DEACD206EF373BAA926022D03AE2
MajorOSVersion: 6
MinorOSVersion: 1
CheckSum: 002387B5
EntryPoint (rva): 1C14D0
SizeOfHeaders: 400
SizeOfImage: 230000
ImageBase: 10000000
Architecture: x86
ExportTable: 202670
ImportTable: 20CCD7
IAT: 20D274
Characteristics: 2122
TimeDateStamp: 6373AC37
Date: 15/11/2022 15:11:51
File Type: DLL
Number Of Sections: 6
ASLR: Enabled
Section Names: .text, .rdata, .data, .00cfg, .rsrc, .reloc
Number Of Executable Sections: 1
Subsystem: Windows GUI

Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
400 1C1A00 1000 1C1801
6.5513
10337531.08
.rdata
0x40000040
Initialized Data
Readable
1C1E00 4B800 1C3000 4B764
6.3453
2545556.74
.data
0xC0000040
Initialized Data
Readable
Writeable
20D600 3000 20F000 5520
3.6803
929544.13
.00cfg
0x40000040
Initialized Data
Readable
210600 200 215000 4
0.0815
128522
.rsrc
0x40000040
Initialized Data
Readable
210800 400 216000 380
2.8965
110146
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
210C00 18800 217000 186E0
6.6453
386113.15
Description
OriginalFilename: nss3.dll
CompanyName: Mozilla Foundation
LegalCopyright: License: MPL 2
LegalTrademarks: Mozilla
ProductName: Thunderbird
FileVersion: 102.5.0
ProductVersion: 102.5.0
Language: Unknown (ID=0x0)
CodePage: Unicode (UTF-16 LE) (0x4B0)

Entry Point
The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - 1C08D0
Code -> 558BEC837D0C017505E823050000FF7510FF750CFF7508E8D2FEFFFF83C40C5DC20C00A1C04421105333DB43563BC3746085
EP changed to another address -> (Address Of EntryPoint > Base Of Data)
Assembler
|PUSH EBP
|MOV EBP, ESP
|CMP DWORD PTR [EBP + 0XC], 1
|JNE 0X101C14DE
|CALL 0X101C1A01
|PUSH DWORD PTR [EBP + 0X10]
|PUSH DWORD PTR [EBP + 0XC]
|PUSH DWORD PTR [EBP + 8]
|CALL 0X101C13BE
|ADD ESP, 0XC
|POP EBP
|RET 0XC
|MOV EAX, DWORD PTR [0X102144C0]
|PUSH EBX
|XOR EBX, EBX
|INC EBX
|PUSH ESI
|CMP EAX, EBX
|JE 0X101C1561
Signatures
CheckSum Integrity Problem:
Header: 2328501
Calculated: 2279503
Certificate - Digital Signature:
• The file is signed but has been modified

Packer/Compiler
Detect It Easy (die)
PE: linker: Microsoft Linker(14.0)[-]
PE: Sign tool: Windows Authenticode(2.0)[PKCS 7]
Entropy: 6.75588

Suspicious Functions
Library Function Description
KERNEL32.DLL CreateMutexA Create a named or unnamed mutex object for controlling access to a shared resource.
KERNEL32.DLL CreateMutexW Create a named or unnamed mutex object for controlling access to a shared resource.
KERNEL32.DLL WriteFile Writes data to a specified file or input/output (I/O) device.
KERNEL32.DLL LoadLibraryA Loads the specified module into the address space of the calling process.
KERNEL32.DLL LoadLibraryW Loads the specified module into the address space of the calling process.
KERNEL32.DLL GetModuleHandleA Retrieves a handle to the specified module.
KERNEL32.DLL GetModuleHandleW Retrieves a handle to the specified module.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL CreateFileA Creates or opens a file or I/O device.
KERNEL32.DLL DeleteFileA Deletes an existing file.
KERNEL32.DLL IsDebuggerPresent Determines if the calling process is being debugged by a user-mode debugger.
KERNEL32.DLL GetTempPathA Retrieves the temporary directory path.
KERNEL32.DLL GetTempPathW Retrieves the temporary directory path.
KERNEL32.DLL CreateFileW Creates or opens a file object.
KERNEL32.DLL ReadFile Reads data from a file.
KERNEL32.DLL FindFirstFileA Starts file and directory enumeration.
KERNEL32.DLL FindNextFileA Continues file and directory enumeration.
KERNEL32.DLL FindClose Closes a file search handle.
KERNEL32.DLL ReleaseSemaphore Releases ownership of a semaphore.
KERNEL32.DLL CloseHandle Closes an open object handle.
KERNEL32.DLL UnmapViewOfFile Unmaps a mapped file view.
KERNEL32.DLL MapViewOfFile Maps a file into memory.
KERNEL32.DLL CreateFileMappingA Creates a file mapping object.
KERNEL32.DLL CreateFileMappingW Creates a file mapping object.
KERNEL32.DLL VirtualProtect Changes memory protection attributes.
KERNEL32.DLL CreateProcessA Creates and starts a new process.
KERNEL32.DLL ResumeThread Resumes a suspended thread.
KERNEL32.DLL CreateSemaphoreA Creates or opens a semaphore object.
KERNEL32.DLL GetSystemInfo Retrieves system hardware information.
KERNEL32.DLL GlobalMemoryStatusEx Retrieves memory usage information.
KERNEL32.DLL GetVersion Retrieves the operating system version.
Ws2_32.DLL socket Create a communication endpoint for networking applications.
File Access
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-multibyte-l1-1-0.dll
api-ms-win-crt-time-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
VCRUNTIME140.dll
KERNEL32.dll
WSOCK32.dll
ADVAPI32.dll
mozglue.dll
nss3.dll
WINMM.dll
ws2_32.dll
softokn3.dll
wship6.dll
@.dat
pkcs11.txt
Temp

File Access (UNICODE)
nss3.dll
ReleaseSRWLockExclusiveAcquireSRWLockExclusiveKERNEL32.DLL
kernel32.dll

SQL Queries
SELECT * FROM %Q.%Q
SELECT 1 FROM %Q.%q_segments WHERE blockid=? AND block IS NULL
SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level = ? ORDER BY idx ASC
SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level BETWEEN ? AND ?ORDER BY level DESC, idx ASC
SELECT level, idx, end_block FROM %Q.%q_segdir WHERE level BETWEEN ? AND ? ORDER BY level DESC, idx ASC
SELECT idx FROM %Q.%q_segdir WHERE level=? ORDER BY 1 ASC
SELECT size FROM %Q.%q_docsize WHERE docid=?
SELECT value FROM %Q.%q_stat WHERE id=?
SELECT max(level) FROM %Q.%q_segdir WHERE level BETWEEN ? AND ?
SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level = ? AND idx = ?
SELECT count(*) FROM %Q.%q_segdir WHERE level = ?
SELECT tbl,idx,stat FROM %Q.sqlite_stat1
SELECT level, count(*) AS cnt FROM %Q.%q_segdirGROUP BY level HAVING cnt>=? ORDER BY (level %% 1024) ASC, 2 DESC LIMIT 1
SELECT (SELECT max(idx) FROM %Q.%q_segdir WHERE level = ?) + 1
SELECT sql FROM "%w".sqlite_schema WHERE type=tableAND name<>sqlite_sequence AND coalesce(rootpage,1)>0
SELECT NOT EXISTS(SELECT docid FROM %Q.%q_content WHERE rowid!=?)
SELECT coalesce((SELECT max(blockid) FROM %Q.%q_segments) + 1, 1)
SELECT * FROM (SELECT sqlite_schema AS name,1 AS rootpage,table AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)
SELECT 2 * total(1 + leaves_end_block - start_block)FROM (SELECT * FROM %Q.%q_segdir WHERE level = ? ORDER BY idx ASC LIMIT ? )
SELECT sql FROM "%w".sqlite_schema WHERE type=index
SELECT ? UNION SELECT level / (1024 * ?) FROM %Q.%q_segdir
SELECT max( level %% 1024 ) FROM %Q.%q_segdir
SELECT CASE WHEN quick_check GLOB CHECK* THEN raise(ABORT,CHECK constraint failed) ELSE raise(ABORT,NOT NULL constraint failed) END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB CHECK* OR quick_check GLOB NULL*
SELECT raise(ABORT,%Q) FROM "%w"."%w"
SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE sqliteX_%% ESCAPE X AND sql NOT LIKE create virtual%% AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL
SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE sqliteX_%% ESCAPE X AND sql NOT LIKE create virtual%% AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL
INSERT INTO %Q.sqlite_master VALUES(index,%Q,%Q,%d,%Q);
INSERT INTO vacuum_db.||quote(name)|| SELECT*FROM"%w".||quote(name)FROM vacuum_db.sqlite_schema WHERE type=tableAND coalesce(rootpage,1)>0
INSERT INTO %Q.%q_content VALUES(%s)
INSERT INTO vacuum_db.sqlite_schema SELECT*FROM "%w".sqlite_schema WHERE type IN(view,trigger) OR(type=tableAND rootpage=0)
INSERT INTO %Q.sqlite_master VALUES(trigger,%Q,%Q,0,CREATE TRIGGER %q)
INSERT into generated column "%s"
CREATE TABLE x( name TEXT, path TEXT, pagenoINTEGER, pagetypeTEXT, ncell INTEGER, payload INTEGER, unusedINTEGER, mx_payload INTEGER, pgoffsetINTEGER, pgsizeINTEGER, schemaTEXT HIDDEN, aggregate BOOLEAN HIDDEN)
CREATE TABLE %Q.%q_segments(blockid INTEGER PRIMARY KEY, block BLOB);
CREATE TABLE %Q.%q_docsize(docid INTEGER PRIMARY KEY, size BLOB);
CREATE TABLE IF NOT EXISTS %Q.%q_stat(id INTEGER PRIMARY KEY, value BLOB);
CREATE TABLE %Q.%q_segdir(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text)
CREATE TABLE %Q.%s(%s)
CREATE TABLE %Q.%q_content(%s)
CREATE TABLE %Q.sqlite_sequence(name,seq)
CREATE TABLE x(input, token, start, end, position)
CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN)
CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN)
CREATE TABLE x(%s %Q HIDDEN, docid HIDDEN, %Q HIDDEN)
CREATE TABLE
DROP TABLE to delete table %s
DROP TABLE IF EXISTS %Q.%q_segments;DROP TABLE IF EXISTS %Q.%q_segdir;DROP TABLE IF EXISTS %Q.%q_docsize;DROP TABLE IF EXISTS %Q.%q_stat;%s DROP TABLE IF EXISTS %Q.%q_content;
DELETE FROM %Q.%s WHERE %s=%Q
DELETE FROM %Q.sqlite_sequence WHERE name=%Q
DELETE FROM %Q.%q_segdir WHERE level BETWEEN ? AND ?
DELETE FROM %Q.%q_segments WHERE blockid BETWEEN ? AND ?
DELETE FROM %Q.%q_segdir WHERE level = ? AND idx = ?
DELETE FROM %Q.%q_segdir WHERE level = ?
DELETE FROM %Q.%q_content WHERE rowid = ?
DELETE FROM %Q.%q_docsize WHERE docid = ?
DELETE FROM %Q.sqlite_master WHERE name=%Q AND type=index
DELETE FROM %Q.%q_content
DELETE FROM %Q.%q_stat
DELETE FROM %Q.%q_segments
DELETE FROM %Q.%q_segdir
DELETE FROM %Q.sqlite_master WHERE name=%Q AND type=trigger
DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!=trigger
DELETE FROM %Q.%q_docsize

Interest's Words
Encrypt
Decrypt
Encryption
PassWord
exec
createobject
attrib
start
cipher
shutdown
systeminfo
ping
expand
replace

URLs
http://ocsp.digicert.com
http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl
http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl
http://crl3.digicert.com/sha2-assured-cs-g1.crl
http://crl4.digicert.com/sha2-assured-cs-g1.crl
http://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt
http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
http://crl3.digicert.com/DigiCertTrustedRootG4.crl
http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl
http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt
https://www.digicert.com/CPS0
https://mozilla.org0/

Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii Encryption (Base64Decode)
Text Ascii Encryption (Base64Encode)
Text Ascii Information used to authenticate a user’s identity (Credential)
Text Ascii Information used for user authentication (Credential)
Text Ascii Malicious rerouting of traffic to an attacker-controlled site (Redirect)
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern VC8 - Microsoft Corporation
Resources
Path DataRVA Size FileOffset CodeText
\VERSION\1\1033 216060 31C 210860 1C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000500..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
Intelligent String
• kernel32.dll
• jsignal_policy.map
• nss3.dll
• H0F08
• https://www.digicert.com/CPS0
• :060U00Uq]dL.g?O0U0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0U

Flow Anomalies
Offset FlowVA Section Description
45A 10215000 .text CALL [static] | Indirect call to absolute memory address
4A3 10215000 .text CALL [static] | Indirect call to absolute memory address
4CF 10215000 .text CALL [static] | Indirect call to absolute memory address
4EF 10215000 .text CALL [static] | Indirect call to absolute memory address
559 10215000 .text CALL [static] | Indirect call to absolute memory address
592 10215000 .text CALL [static] | Indirect call to absolute memory address
5E3 10215000 .text CALL [static] | Indirect call to absolute memory address
6BC 10215000 .text CALL [static] | Indirect call to absolute memory address
6D4 10215000 .text CALL [static] | Indirect call to absolute memory address
8DB 10215000 .text CALL [static] | Indirect call to absolute memory address
911 10215000 .text CALL [static] | Indirect call to absolute memory address
932 10215000 .text CALL [static] | Indirect call to absolute memory address
95C 10215000 .text CALL [static] | Indirect call to absolute memory address
97D 10215000 .text CALL [static] | Indirect call to absolute memory address
B1C 10215000 .text CALL [static] | Indirect call to absolute memory address
B81 10215000 .text CALL [static] | Indirect call to absolute memory address
F31 10215000 .text CALL [static] | Indirect call to absolute memory address
F4A 10215000 .text CALL [static] | Indirect call to absolute memory address
F93 10215000 .text CALL [static] | Indirect call to absolute memory address
107C 10215000 .text CALL [static] | Indirect call to absolute memory address
10A4 10215000 .text CALL [static] | Indirect call to absolute memory address
10BD 10215000 .text CALL [static] | Indirect call to absolute memory address
112F 10215000 .text CALL [static] | Indirect call to absolute memory address
1151 10215000 .text CALL [static] | Indirect call to absolute memory address
11BE 10215000 .text CALL [static] | Indirect call to absolute memory address
11F3 10215000 .text CALL [static] | Indirect call to absolute memory address
1217 10215000 .text CALL [static] | Indirect call to absolute memory address
1872 10215000 .text CALL [static] | Indirect call to absolute memory address
1884 10215000 .text CALL [static] | Indirect call to absolute memory address
18A3 10215000 .text CALL [static] | Indirect call to absolute memory address
18BF 10215000 .text CALL [static] | Indirect call to absolute memory address
18F1 10215000 .text CALL [static] | Indirect call to absolute memory address
191E 10215000 .text CALL [static] | Indirect call to absolute memory address
194B 10215000 .text CALL [static] | Indirect call to absolute memory address
1964 10215000 .text CALL [static] | Indirect call to absolute memory address
19D2 10215000 .text CALL [static] | Indirect call to absolute memory address
19FE 10215000 .text CALL [static] | Indirect call to absolute memory address
1A17 10215000 .text CALL [static] | Indirect call to absolute memory address
1A91 10215000 .text CALL [static] | Indirect call to absolute memory address
1ABD 10215000 .text CALL [static] | Indirect call to absolute memory address
1AD6 10215000 .text CALL [static] | Indirect call to absolute memory address
1B50 10215000 .text CALL [static] | Indirect call to absolute memory address
1B7C 10215000 .text CALL [static] | Indirect call to absolute memory address
1B95 10215000 .text CALL [static] | Indirect call to absolute memory address
1C0F 10215000 .text CALL [static] | Indirect call to absolute memory address
1C2A 10215000 .text CALL [static] | Indirect call to absolute memory address
1C8B 10215000 .text CALL [static] | Indirect call to absolute memory address
1CA6 10215000 .text CALL [static] | Indirect call to absolute memory address
1CD5 10215000 .text CALL [static] | Indirect call to absolute memory address
1CFA 10215000 .text CALL [static] | Indirect call to absolute memory address
1D41 10215000 .text CALL [static] | Indirect call to absolute memory address
1D5A 10215000 .text CALL [static] | Indirect call to absolute memory address
1DDC 10215000 .text CALL [static] | Indirect call to absolute memory address
1E31 10215000 .text CALL [static] | Indirect call to absolute memory address
1E4A 10215000 .text CALL [static] | Indirect call to absolute memory address
1EAC 10215000 .text CALL [static] | Indirect call to absolute memory address
1F9D 10215000 .text CALL [static] | Indirect call to absolute memory address
1FB3 10215000 .text CALL [static] | Indirect call to absolute memory address
1FCF 10215000 .text CALL [static] | Indirect call to absolute memory address
1FEF 10215000 .text CALL [static] | Indirect call to absolute memory address
2043 10215000 .text CALL [static] | Indirect call to absolute memory address
20E1 10215000 .text CALL [static] | Indirect call to absolute memory address
20FD 10215000 .text CALL [static] | Indirect call to absolute memory address
2121 10215000 .text CALL [static] | Indirect call to absolute memory address
2165 10215000 .text CALL [static] | Indirect call to absolute memory address
217D 10215000 .text CALL [static] | Indirect call to absolute memory address
21D7 10215000 .text CALL [static] | Indirect call to absolute memory address
225A 10215000 .text CALL [static] | Indirect call to absolute memory address
227A 10215000 .text CALL [static] | Indirect call to absolute memory address
228C 10215000 .text CALL [static] | Indirect call to absolute memory address
22CC 10215000 .text CALL [static] | Indirect call to absolute memory address
232C 10215000 .text CALL [static] | Indirect call to absolute memory address
2369 10215000 .text CALL [static] | Indirect call to absolute memory address
2393 10215000 .text CALL [static] | Indirect call to absolute memory address
241B 10215000 .text CALL [static] | Indirect call to absolute memory address
242D 10215000 .text CALL [static] | Indirect call to absolute memory address
2489 10215000 .text CALL [static] | Indirect call to absolute memory address
24B4 10215000 .text CALL [static] | Indirect call to absolute memory address
24D0 10215000 .text CALL [static] | Indirect call to absolute memory address
2508 10215000 .text CALL [static] | Indirect call to absolute memory address
2520 10215000 .text CALL [static] | Indirect call to absolute memory address
2572 10215000 .text CALL [static] | Indirect call to absolute memory address
25E5 10215000 .text CALL [static] | Indirect call to absolute memory address
25F7 10215000 .text CALL [static] | Indirect call to absolute memory address
2616 10215000 .text CALL [static] | Indirect call to absolute memory address
2632 10215000 .text CALL [static] | Indirect call to absolute memory address
2648 10215000 .text CALL [static] | Indirect call to absolute memory address
26C6 10215000 .text CALL [static] | Indirect call to absolute memory address
26DA 10215000 .text CALL [static] | Indirect call to absolute memory address
2723 10215000 .text CALL [static] | Indirect call to absolute memory address
2735 10215000 .text CALL [static] | Indirect call to absolute memory address
2754 10215000 .text CALL [static] | Indirect call to absolute memory address
279A 10215000 .text CALL [static] | Indirect call to absolute memory address
280D 10215000 .text CALL [static] | Indirect call to absolute memory address
282C 10215000 .text CALL [static] | Indirect call to absolute memory address
286C 10215000 .text CALL [static] | Indirect call to absolute memory address
2887 10215000 .text CALL [static] | Indirect call to absolute memory address
28BE 10215000 .text CALL [static] | Indirect call to absolute memory address
28D2 10215000 .text CALL [static] | Indirect call to absolute memory address
28F0 10215000 .text CALL [static] | Indirect call to absolute memory address
1C659A-1C65B1 N/A .rdata Potential obfuscated jump sequence detected, count: 12
1C1C01-1C1DFF N/A .text Unusual BP Cave, count: 511
229400 N/A *Overlay* A0290000000202003082298F06092A864886F70D | .
Extra Analysis
Metric Value Percentage
Ascii Code 1460402 64,1436%
Null Byte Code 266727 11,7152%
© 2026 All rights reserved.