PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 16,00 KBSHA-256 Hash: EA2E9CC14BB7043C303CF936B50B1A7463945B231D22F0E49386880BE1E50882 SHA-1 Hash: 3964DE8C10C690EB494F6758D47A72DCD7D15905 MD5 Hash: 852BE721A5752586B02DE75687260D36 Imphash: 5C4D602843F54570889588B32F7AF650 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 0000F215 EntryPoint (rva): 1128 SizeOfHeaders: 1000 SizeOfImage: 4000 ImageBase: 400000 Architecture: x86 ImportTable: 1984 IAT: 1000 Characteristics: 10F TimeDateStamp: 67E8510F Date: 29/03/2025 19:59:11 File Type: EXE Number Of Sections: 3 ASLR: Disabled Section Names: .text, .data, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | 1000 | 1000 | BD0 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
2000 | 1000 | 2000 | 9E0 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
3000 | 1000 | 3000 | 8A4 |
|
|
| Description |
| OriginalFilename: TEST TEST.exe ProductName: Project1 FileVersion: 1.00 ProductVersion: 1.00 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 1128 Code -> 68B4124000E8F0FFFFFF0000000000003000000040000000000000009B895049E7CFB541A27A46274D671E43000000000000 Assembler |PUSH 0X4012B4 |CALL 0XFFA |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |XOR BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |INC EAX |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EBX - 0X18B6AF77], BL |IRETD |MOV CH, 0X41 |MOV BYTE PTR [0X4D27467A], AL |PUSH DS |INC EBX |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |
| Signatures |
| Rich Signature Analyzer: Code -> 2199F9DB65F8978865F8978865F89788E6E4998864F897880CE79E8864F8978853DE9A8864F897885269636865F89788 Footprint md5 Hash -> EA87097EAE3994C680391974B26819EE • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Visual Basic 6 - (Native Code) Detect It Easy (die) • PE: compiler: Microsoft Visual Basic(6.0)[Native] • PE: linker: Microsoft Linker(6.0*)[-] • Entropy: 1.6909 |
| File Access |
| MSVBVM60.DLL .dat |
| File Access (UNICODE) |
| TEST TEST.exe |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | Microsoft Visual Basic 5.0 |
| Entry Point | Hex Pattern | Microsoft Visual Basic v5.0 |
| Entry Point | Hex Pattern | Microsoft Visual Basic v5.0 - v6.0 |
| Entry Point | Hex Pattern | Microsoft Visual Basic v5.0 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\30001\0 | 3774 | 130 | 3774 | 2800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFFFF00FFFF | (... ...@......................................... |
| \ICON\30002\0 | 348C | 2E8 | 348C | 2800000020000000400000000100040000000000800200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\30003\0 | 3364 | 128 | 3364 | 2800000010000000200000000100040000000000C00000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \GROUP_ICON\1\0 | 3334 | 30 | 3334 | 00000100030020200200010001003001000031752020100001000400E802000032751010100001000400280100003375 | ...... ......0...1u ..........2u........(...3u |
| \VERSION\1\1033 | 3150 | 1E4 | 3150 | E40134000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • MSVBVM60.DLL • C:\Program Files (x86)\Microsoft Visual Studio\VB98\VB6.OLBVB • TEST TEST.exe |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 1080 | 401020 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1086 | 401038 | .text | JMP [static] | Indirect jump to absolute memory address |
| 108C | 401044 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1092 | 401014 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1098 | 401010 | .text | JMP [static] | Indirect jump to absolute memory address |
| 109E | 40104C | .text | JMP [static] | Indirect jump to absolute memory address |
| 10A4 | 401008 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10AA | 401058 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10B0 | 401018 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10B6 | 401054 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10BC | 401050 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10C2 | 401040 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10C8 | 401028 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10CE | 40103C | .text | JMP [static] | Indirect jump to absolute memory address |
| 10D4 | 40100C | .text | JMP [static] | Indirect jump to absolute memory address |
| 10DA | 401004 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10E0 | 401060 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10E6 | 401000 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10EC | 40106C | .text | JMP [static] | Indirect jump to absolute memory address |
| 10F2 | 401048 | .text | JMP [static] | Indirect jump to absolute memory address |
| 10F8 | 40101C | .text | JMP [static] | Indirect jump to absolute memory address |
| 10FE | 401030 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1104 | 401068 | .text | JMP [static] | Indirect jump to absolute memory address |
| 110A | 401064 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1110 | 401034 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1116 | 401024 | .text | JMP [static] | Indirect jump to absolute memory address |
| 111C | 40102C | .text | JMP [static] | Indirect jump to absolute memory address |
| 1122 | 40105C | .text | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1850 | 11,2915% |
| Null Byte Code | 13695 | 83,5876% |
© 2026 All rights reserved.