PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 3,47 MB SHA-256 Hash: 79D3A29F9A2BC8BF7C45CF13B98ADD264636C96C3B1B14C6A3238972391CFE5B SHA-1 Hash: C8ACA49526C17EBBC940D6B94B0A9E7A9CAD4D8C MD5 Hash: 8DDE3632D8959DC522C8D3345A6273BD Imphash: D41D8CD98F00B204E9800998ECF8427E MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 0 SizeOfHeaders: 200 SizeOfImage: 37C000 ImageBase: 0000000000400000 Architecture: x64 Characteristics: 22 TimeDateStamp: 5DEAB686 Date: 06/12/2019 20:13:58 File Type: EXE Number Of Sections: 2 ASLR: Disabled Section Names (Optional Header): .text, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
200 | 376C00 | 2000 | 376A30 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
376E00 | 600 | 37A000 | 444 |
|
|
| Description |
| OriginalFilename: grade_Increment.exe CompanyName: ?A37@5=AI7::<EEB@ LegalCopyright: Copyright 1991 ?A37@5=AI7::<EEB@. All rights reserved. ProductName: H8;E:5E5G4E<;8C433B=6@AC FileVersion: 29.27.15.63 FileDescription: H8;E:5E5G4E<;8C433B=6@AC ProductVersion: 29.27.15.63 Comments: 3@AE>IGFCE62BB<6>D Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual .NET - (You can use a decompiler for this...) • AnyCPU: False • Version: v4.0 Detect It Easy (die) • PE+(64): library: .NET(v4.0.30319)[-] • PE+(64): compiler: VB.NET(-)[-] • PE+(64): linker: Microsoft Linker(80.0)[-] • PE+(64): archive: Resources(-)[-] • Entropy: 6.47965 |
| File Access |
| Temp |
| File Access (UNICODE) |
| txt)|*.txt grade_Increment.exe Temp |
| Interest's Words |
| Decrypt exec attrib start replace |
| Interest's Words (UNICODE) |
| start ping |
| IP Addresses |
| 29.27.15.63 11.0.0.0 17.0.0.0 17.12.0.0 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Encryption (CreateDecryptor) |
| Text | Ascii | Encryption (CryptoStream) |
| Text | Ascii | Encryption (CryptoStreamMode) |
| Text | Ascii | Encryption (ICryptoTransform) |
| Text | Ascii | Keyboard Key (Scroll) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\0 | 37A058 | 3EC | 376E58 | EC0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001001B00 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • grade_Increment.exe • 29.27.15.63 • ,resources/bebaksil.rtd • /www.msftconnecttest.com • one.one.one.one • bebaksil.rtd • /CSV Files (*.csv)|*.csv • 7FungalData_{0:yyyyMMdd}.csv • 1.0.0.0 |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 18B57 | N/A | .text | CALL QWORD PTR [RIP+0x348204D9] |
| 30D9D | N/A | .text | JMP QWORD PTR [RIP+0x64C61BC5] |
| 406E6 | N/A | .text | JMP QWORD PTR [RIP+0x22FCFE7D] |
| 4241F | N/A | .text | CALL QWORD PTR [RIP+0xB84AC582] |
| 486D0 | N/A | .text | JMP QWORD PTR [RIP+0xB0E07213] |
| 53AAF | N/A | .text | JMP QWORD PTR [RIP+0x15499E5] |
| 57F5E | N/A | .text | CALL QWORD PTR [RIP+0x2CD04534] |
| 5B9FD | N/A | .text | CALL QWORD PTR [RIP+0xB6CDCFA3] |
| 5C78F | N/A | .text | CALL QWORD PTR [RIP+0xA2B0F1D2] |
| 5C80C | N/A | .text | CALL QWORD PTR [RIP+0x81CD207A] |
| 5D118 | N/A | .text | CALL QWORD PTR [RIP+0x240C1155] |
| 63EC1 | N/A | .text | JMP QWORD PTR [RIP+0x7B7AFEC1] |
| 68705 | N/A | .text | CALL QWORD PTR [RIP+0xF6CEFFD3] |
| 73C40 | N/A | .text | CALL QWORD PTR [RIP+0x9EAF099E] |
| 7B903 | N/A | .text | JMP QWORD PTR [RIP+0x84C00910] |
| 7E519 | N/A | .text | CALL QWORD PTR [RIP+0xD8626D04] |
| 8EC33 | N/A | .text | CALL QWORD PTR [RIP+0xD2FCE455] |
| 92129 | N/A | .text | CALL QWORD PTR [RIP+0xDA779438] |
| 9593B | N/A | .text | JMP QWORD PTR [RIP+0xFCA5F3A2] |
| 9B5BA | N/A | .text | JMP QWORD PTR [RIP+0xF35E5981] |
| A3A18 | N/A | .text | CALL QWORD PTR [RIP+0x8AD8908B] |
| A8F41 | N/A | .text | CALL QWORD PTR [RIP+0x86DC8F46] |
| B0451 | N/A | .text | CALL QWORD PTR [RIP+0xE6FC2F8E] |
| BA04E | N/A | .text | JMP QWORD PTR [RIP+0x37A728F8] |
| D2CD7 | N/A | .text | CALL QWORD PTR [RIP+0x4BA3FE58] |
| D8059 | N/A | .text | CALL QWORD PTR [RIP+0x5E00267B] |
| E3B94 | N/A | .text | JMP QWORD PTR [RIP+0x170960C3] |
| ED261 | N/A | .text | CALL QWORD PTR [RIP+0x9505D513] |
| 10A4FC | N/A | .text | JMP QWORD PTR [RIP+0xECE08E45] |
| 10E669 | N/A | .text | JMP QWORD PTR [RIP+0x17AD59DC] |
| 11A3DF | N/A | .text | JMP QWORD PTR [RIP+0x8525B0D4] |
| 11A4E9 | N/A | .text | CALL QWORD PTR [RIP+0x43C2B02E] |
| 1255FD | N/A | .text | CALL QWORD PTR [RIP+0xB455459] |
| 12C587 | N/A | .text | JMP QWORD PTR [RIP+0x59D12C0F] |
| 139250 | N/A | .text | JMP QWORD PTR [RIP+0x707E7DFA] |
| 13DD85 | N/A | .text | CALL QWORD PTR [RIP+0x262DF722] |
| 14594A | N/A | .text | JMP QWORD PTR [RIP+0x129A409C] |
| 14D735 | N/A | .text | JMP QWORD PTR [RIP+0x4DCE3991] |
| 14F735 | N/A | .text | JMP QWORD PTR [RIP+0x1EC8A62E] |
| 15F695 | N/A | .text | CALL QWORD PTR [RIP+0x73113D80] |
| 1873EB | N/A | .text | CALL QWORD PTR [RIP+0x98ABEA88] |
| 187B05 | N/A | .text | JMP QWORD PTR [RIP+0xC64EDF7C] |
| 1A4194 | N/A | .text | CALL QWORD PTR [RIP+0xF1B4B580] |
| 1A511B | N/A | .text | JMP QWORD PTR [RIP+0xD58753C] |
| 1A8213 | N/A | .text | CALL QWORD PTR [RIP+0xA04D48DB] |
| 1AC309 | N/A | .text | CALL QWORD PTR [RIP+0x43E100D2] |
| 1B0BBB | N/A | .text | JMP QWORD PTR [RIP+0x499404EA] |
| 1B1BAC | N/A | .text | CALL QWORD PTR [RIP+0x444B73E5] |
| 1B4732 | N/A | .text | JMP QWORD PTR [RIP+0x93789FDD] |
| 1C3942 | N/A | .text | CALL QWORD PTR [RIP+0x3CAC14A0] |
| 1D7491 | N/A | .text | JMP QWORD PTR [RIP+0x47737A8B] |
| 1EC46F | N/A | .text | CALL QWORD PTR [RIP+0xEE8A851F] |
| 1F236A | N/A | .text | JMP QWORD PTR [RIP+0xCEC0027A] |
| 1F5EE1 | N/A | .text | JMP QWORD PTR [RIP+0x8F984C6C] |
| 1FA40B | N/A | .text | JMP QWORD PTR [RIP+0x381DA4FB] |
| 1FE270 | N/A | .text | JMP QWORD PTR [RIP+0xA7021384] |
| 2021CA | N/A | .text | CALL QWORD PTR [RIP+0xE85CB18E] |
| 20F182 | N/A | .text | JMP QWORD PTR [RIP+0xABB934E3] |
| 21C0F3 | N/A | .text | CALL QWORD PTR [RIP+0x290F6493] |
| 23616C | N/A | .text | JMP QWORD PTR [RIP+0xE6DAAEC9] |
| 23A426 | N/A | .text | JMP QWORD PTR [RIP+0x3411D316] |
| 23A75E | N/A | .text | JMP QWORD PTR [RIP+0x3411D316] |
| 23DFD9 | N/A | .text | CALL QWORD PTR [RIP+0x4FDF95CC] |
| 241BFA | N/A | .text | JMP QWORD PTR [RIP+0xD549E939] |
| 24406C | N/A | .text | JMP QWORD PTR [RIP+0x982A37A4] |
| 2513B9 | N/A | .text | CALL QWORD PTR [RIP+0x1422DED2] |
| 2595C3 | N/A | .text | CALL QWORD PTR [RIP+0x1422DED2] |
| 28C7F4 | N/A | .text | CALL QWORD PTR [RIP+0x78F211AA] |
| 2986A6 | N/A | .text | JMP QWORD PTR [RIP+0x4E0BF373] |
| 2A4BBD | N/A | .text | JMP QWORD PTR [RIP+0x77A61E3E] |
| 2A5849 | N/A | .text | CALL QWORD PTR [RIP+0x6D5EAE8F] |
| 2B1239 | N/A | .text | JMP QWORD PTR [RIP+0xC2B36DB4] |
| 2BB48C | N/A | .text | CALL QWORD PTR [RIP+0x160D2BC0] |
| 2C4297 | N/A | .text | JMP QWORD PTR [RIP+0x86C78210] |
| 2DD59F | N/A | .text | CALL QWORD PTR [RIP+0xD3CBBA8A] |
| 2E6D9F | N/A | .text | JMP QWORD PTR [RIP+0x8E92BC3D] |
| 2EDA7C | N/A | .text | CALL QWORD PTR [RIP+0xF59AE530] |
| 2F65A9 | N/A | .text | JMP QWORD PTR [RIP+0x4D12E0B6] |
| 2F718C | N/A | .text | CALL QWORD PTR [RIP+0xCBBF3FB8] |
| 3036A4 | N/A | .text | CALL QWORD PTR [RIP+0x3D5B77F] |
| 309722 | N/A | .text | CALL QWORD PTR [RIP+0x1510674] |
| 3333AD | N/A | .text | CALL QWORD PTR [RIP+0x41FE3BCA] |
| 335DB9 | N/A | .text | CALL QWORD PTR [RIP+0xE7451F63] |
| 336093 | N/A | .text | CALL QWORD PTR [RIP+0x7A33A08] |
| 34351A | N/A | .text | CALL QWORD PTR [RIP+0x62B48B85] |
| 348461 | N/A | .text | CALL QWORD PTR [RIP+0xE2589FD0] |
| 355FDB | N/A | .text | CALL QWORD PTR [RIP+0x3CD35735] |
| 35C97C | N/A | .text | JMP QWORD PTR [RIP+0x200000] |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1782969 | 49,0612% |
| Null Byte Code | 1086098 | 29,8857% |
© 2026 All rights reserved.