PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 5,06 MBSHA-256 Hash: 431727FD3A9A56622DF9E1B965A40DCF7E74642A73D0E25BC1B7C75B14868863 SHA-1 Hash: FA734DA72BE40E5FD71D55686CEB1DED5A61133C MD5 Hash: 91F01847C0EB4DE261A6F4BCA1079D49 Imphash: 4357A128A47852A6E2B21B222CCDB65F MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 8E1F10 SizeOfHeaders: 400 SizeOfImage: 8E8000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 8E72BC Characteristics: 22 TimeDateStamp: 6A9A21E2 Date: 04/09/2026 1:41:54 File Type: EXE Number Of Sections: 3 ASLR: Disabled Section Names (Optional Header): UPX0, UPX1, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI [Incomplete Binary or Compressor Packer - 3,85 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| UPX0 | 0xE0000080 Uninitialized Data Executable Readable Writeable |
400 | 0 | 1000 | 3D8000 |
|
|
| UPX1 | 0xE0000040 Initialized Data Executable Readable Writeable |
400 | 509E00 | 3D9000 | 50A000 |
|
|
| .rsrc | 0xC0000040 Initialized Data Readable Writeable |
50A200 | 4A00 | 8E3000 | 5000 |
|
|
| Description |
| CompanyName: mrc ProductName: Kyan Pro FileVersion: 0.1.0 FileDescription: Kyan Pro ProductVersion: 0.1.0 Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (2) have the Entry Point Information -> EntryPoint (calculated) - 509310 Code -> 53565755488D35E570AFFF488DBE0080C2FF488D87BC9F8A00FF30C70054C9F09B5057B85AF18D00504889E14889FA4889F7 Assembler |PUSH RBX |PUSH RSI |PUSH RDI |PUSH RBP |LEA RSI, [RIP - 0X508F1B] |LEA RDI, [RSI - 0X3D8000] |LEA RAX, [RDI + 0X8A9FBC] |PUSH QWORD PTR [RAX] |MOV DWORD PTR [RAX], 0X9BF0C954 |PUSH RAX |PUSH RDI |MOV EAX, 0X8DF15A |PUSH RAX |MOV RCX, RSP |MOV RDX, RDI |MOV RDI, RSI |
| Signatures |
| Rich Signature Analyzer: Code -> 75B4644B31D50A1831D50A1831D50A1838AD99183FD50A18B65C091938D50A18B65C0E193CD50A18B65C0F191ED50A1848540B1932D50A1831D50B1892D40A18AD5C0E193DD50A1831D50A1876D50A18AD5CF51830D50A18AD5C081930D50A185269636831D50A18 Footprint md5 Hash -> A73EEDD2693BF2CE963BF593D2CF0B03 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compression: UPX Detect It Easy (die) • PE+(64): packer: UPX(5.20)[LZMA,brute] • PE+(64): linker: Microsoft Linker(14.44**)[-] • Entropy: 7.99987 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| Ws2_32.DLL | send | Sends data through a network socket. |
| File Access |
| ws2_32.dll wintrust.dll user32.dll shlwapi.dll shell32.dll oleaut32.dll ole32.dll ntdll.dll KERNEL32.DLL gdi32.dll dwmapi.dll crypt32.dll comctl32.dll bcryptprimitives.dll bcrypt.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-convert-l1-1-0.dll api-ms-win-core-synch-l1-2-0.dll advapi32.dll .scr |
| Interest's Words |
| attrib |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Software that monitors and collects user data (Spy) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 8E3224 | 458 | 50A424 | 89504E470D0A1A0A0000000D4948445200000020000000200806000000737A7AF40000041F494441547801EDC003A0245996 | .PNG........IHDR... ... .....szz.....IDATx.....$Y. |
| \ICON\2\1033 | 8E3680 | 22C | 50A880 | 89504E470D0A1A0A0000000D49484452000000100000001008060000001FF3FF61000001F3494441547801EDC003A0245996 | .PNG........IHDR................a....IDATx.....$Y. |
| \ICON\3\1033 | 8E38B0 | 31B | 50AAB0 | 89504E470D0A1A0A0000000D4948445200000018000000180806000000E0773DF8000002E2494441547801EDC003A0245996 | .PNG........IHDR..............w=.....IDATx.....$Y. |
| \ICON\4\1033 | 8E3BD0 | 7D9 | 50ADD0 | 89504E470D0A1A0A0000000D49484452000000300000003008060000005702F987000007A0494441547801EDC003A0245996 | .PNG........IHDR...0...0.....W.......IDATx.....$Y. |
| \ICON\5\1033 | 8E43B0 | B6A | 50B5B0 | 89504E470D0A1A0A0000000D4948445200000040000000400806000000AA6971DE00000B31494441547801EDC003A0245996 | .PNG........IHDR...@...@......iq....1IDATx.....$Y. |
| \ICON\6\1033 | 8E4F20 | 2013 | 50C120 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A86600001FDA4944415478DAED9D097415C5D2 | .PNG........IHDR.............\r.f....IDATx....t... |
| \GROUP_ICON\32512\1033 | 8E6F38 | 5A | 50E138 | 000001000600202000000100200058040000010010100000010020002C020000020018180000010020001B03000003003030000001002000D9070000040040400000010020006A0B000005000000000001002000132000000600 | ...... .... .X........... .,........... .......00.... .......@@.... .j........... .. .... |
| \VERSION\1\1033 | 8E6F98 | 1D0 | 50E198 | D00134000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000100 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 8E716C | 14E | 50E36C | 203C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E7631 | <assembly xmlns="urn:schemas-microsoft-com:asm.v1 |
| Intelligent String |
| • (2.KtV |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 11C6B | N/A | UPX1 | JMP QWORD PTR [RIP+0x7954287] |
| 12A81 | N/A | UPX1 | JMP QWORD PTR [RIP+0x22D7E6B2] |
| 18A56 | N/A | UPX1 | CALL QWORD PTR [RIP+0xE3E8D394] |
| 1DB05 | N/A | UPX1 | JMP QWORD PTR [RIP+0x95377C93] |
| 1EEA6 | N/A | UPX1 | JMP QWORD PTR [RIP+0xC714C062] |
| 23550 | N/A | UPX1 | JMP QWORD PTR [RIP+0xCB868248] |
| 2A338 | N/A | UPX1 | CALL QWORD PTR [RIP+0x1BE6D8B8] |
| 2DAA8 | N/A | UPX1 | JMP QWORD PTR [RIP+0xF5A4487B] |
| 2F8A7 | N/A | UPX1 | JMP QWORD PTR [RIP+0xF5AA98A3] |
| 33A58 | N/A | UPX1 | JMP QWORD PTR [RIP+0xEE019413] |
| 352E9 | N/A | UPX1 | CALL QWORD PTR [RIP+0xE2B9AB78] |
| 5666B | N/A | UPX1 | CALL QWORD PTR [RIP+0x600F2EF1] |
| 56D49 | N/A | UPX1 | JMP QWORD PTR [RIP+0x4CC58AE7] |
| 58D55 | N/A | UPX1 | CALL QWORD PTR [RIP+0x28D65146] |
| 5D28D | N/A | UPX1 | JMP QWORD PTR [RIP+0x5CF06937] |
| 5D330 | N/A | UPX1 | CALL QWORD PTR [RIP+0x697457C1] |
| 60B60 | N/A | UPX1 | JMP QWORD PTR [RIP+0x1669CABF] |
| 617C5 | N/A | UPX1 | JMP QWORD PTR [RIP+0x8CBC2455] |
| 61E59 | N/A | UPX1 | CALL QWORD PTR [RIP+0x3586F637] |
| 63122 | N/A | UPX1 | CALL QWORD PTR [RIP+0xD11211A3] |
| 640B6 | N/A | UPX1 | JMP QWORD PTR [RIP+0xDB4CE023] |
| 66A66 | N/A | UPX1 | JMP QWORD PTR [RIP+0xD5535400] |
| 68243 | N/A | UPX1 | JMP QWORD PTR [RIP+0x970735A6] |
| 6AFA8 | N/A | UPX1 | CALL QWORD PTR [RIP+0x836D99DE] |
| 71866 | N/A | UPX1 | CALL QWORD PTR [RIP+0x67229919] |
| 89E5B | N/A | UPX1 | JMP QWORD PTR [RIP+0xD3F0B068] |
| 8BD13 | N/A | UPX1 | JMP QWORD PTR [RIP+0xF63AC887] |
| 93B08 | N/A | UPX1 | JMP QWORD PTR [RIP+0x3279974A] |
| A6E88 | N/A | UPX1 | CALL QWORD PTR [RIP+0xFE03D87] |
| AB3BD | N/A | UPX1 | CALL QWORD PTR [RIP+0xB87EDC2E] |
| AF7B8 | N/A | UPX1 | JMP QWORD PTR [RIP+0x3F2DD4FF] |
| B5D1A | N/A | UPX1 | CALL QWORD PTR [RIP+0xD74AE5EC] |
| B68A1 | N/A | UPX1 | CALL QWORD PTR [RIP+0xC0D2B411] |
| B8B6F | N/A | UPX1 | CALL QWORD PTR [RIP+0x3C66F00B] |
| BBCAB | N/A | UPX1 | JMP QWORD PTR [RIP+0x4A95BCE4] |
| C5837 | N/A | UPX1 | CALL QWORD PTR [RIP+0xBA673F7C] |
| C6160 | N/A | UPX1 | JMP QWORD PTR [RIP+0x90ACC530] |
| CAD44 | N/A | UPX1 | JMP QWORD PTR [RIP+0x1277FD09] |
| D0688 | N/A | UPX1 | JMP QWORD PTR [RIP+0x7F589E1E] |
| D0C94 | N/A | UPX1 | JMP QWORD PTR [RIP+0x710D8A2D] |
| D5B8C | N/A | UPX1 | CALL QWORD PTR [RIP+0xC13EAD83] |
| D7492 | N/A | UPX1 | CALL QWORD PTR [RIP+0x3A9AFC63] |
| F7355 | N/A | UPX1 | JMP QWORD PTR [RIP+0x2C7D59C1] |
| F8114 | N/A | UPX1 | JMP QWORD PTR [RIP+0xF9BED21D] |
| FA7EB | N/A | UPX1 | CALL QWORD PTR [RIP+0xD78B105A] |
| 1038E2 | N/A | UPX1 | CALL QWORD PTR [RIP+0x8AC1D1D3] |
| 104B03 | N/A | UPX1 | JMP QWORD PTR [RIP+0xB8D405DB] |
| 10DC69 | N/A | UPX1 | JMP QWORD PTR [RIP+0x6BC22816] |
| 10FAAB | N/A | UPX1 | CALL QWORD PTR [RIP+0x7AB1FCED] |
| 1100CA | N/A | UPX1 | JMP QWORD PTR [RIP+0xC09438D4] |
| 11FFCD | N/A | UPX1 | CALL QWORD PTR [RIP+0xDC3BFF] |
| 126632 | N/A | UPX1 | JMP QWORD PTR [RIP+0x4E2CF474] |
| 136AE7 | N/A | UPX1 | JMP QWORD PTR [RIP+0x1B654891] |
| 137ECE | N/A | UPX1 | CALL QWORD PTR [RIP+0xF4C0A0A1] |
| 1441CF | N/A | UPX1 | CALL QWORD PTR [RIP+0x9CE948A8] |
| 14E8C6 | N/A | UPX1 | CALL QWORD PTR [RIP+0x487B1B7A] |
| 15586E | N/A | UPX1 | CALL QWORD PTR [RIP+0x44699F54] |
| 158D62 | N/A | UPX1 | CALL QWORD PTR [RIP+0x413D4828] |
| 15A7DC | N/A | UPX1 | JMP QWORD PTR [RIP+0xDC98DB0D] |
| 1657E0 | N/A | UPX1 | CALL QWORD PTR [RIP+0xBE67D9C7] |
| 167877 | N/A | UPX1 | CALL QWORD PTR [RIP+0x5DA9680A] |
| 16AD0F | N/A | UPX1 | JMP QWORD PTR [RIP+0x510AA582] |
| 17B7B4 | N/A | UPX1 | CALL QWORD PTR [RIP+0x61C57A6D] |
| 17FD8F | N/A | UPX1 | CALL QWORD PTR [RIP+0x36B54542] |
| 1824FA | N/A | UPX1 | JMP QWORD PTR [RIP+0xD0E8B4AA] |
| 18A937 | N/A | UPX1 | CALL QWORD PTR [RIP+0x95ECBEB6] |
| 18F4CB | N/A | UPX1 | CALL QWORD PTR [RIP+0xFA0CA46] |
| 197548 | N/A | UPX1 | CALL QWORD PTR [RIP+0x9A1F8E10] |
| 198A5B | N/A | UPX1 | CALL QWORD PTR [RIP+0xB481AC5F] |
| 1A29B2 | N/A | UPX1 | CALL QWORD PTR [RIP+0xC16FE87D] |
| 1A6057 | N/A | UPX1 | JMP QWORD PTR [RIP+0xC4EAC994] |
| 1B7A62 | N/A | UPX1 | CALL QWORD PTR [RIP+0x29560DE2] |
| 1BCA7B | N/A | UPX1 | CALL QWORD PTR [RIP+0xE75F54A9] |
| 1BDD08 | N/A | UPX1 | CALL QWORD PTR [RIP+0x1A7CDAD7] |
| 1C0F20 | N/A | UPX1 | CALL QWORD PTR [RIP+0xFE3F368C] |
| 1C9953 | N/A | UPX1 | JMP QWORD PTR [RIP+0x88CFCA06] |
| 1CF7B2 | N/A | UPX1 | JMP QWORD PTR [RIP+0x1267BC7] |
| 1D4D49 | N/A | UPX1 | CALL QWORD PTR [RIP+0xBC14005D] |
| 1DB19E | N/A | UPX1 | CALL QWORD PTR [RIP+0xBD46DD3B] |
| 1DFEDD | N/A | UPX1 | JMP QWORD PTR [RIP+0xB8BF7A3A] |
| 1E1A8C | N/A | UPX1 | CALL QWORD PTR [RIP+0x4C312D58] |
| 1E2403 | N/A | UPX1 | CALL QWORD PTR [RIP+0x4A519DC1] |
| 202C8A | N/A | UPX1 | CALL QWORD PTR [RIP+0x73500553] |
| 20427A | N/A | UPX1 | JMP QWORD PTR [RIP+0x5803BA76] |
| 20B42E | N/A | UPX1 | CALL QWORD PTR [RIP+0xC97AE661] |
| 21088B | N/A | UPX1 | CALL QWORD PTR [RIP+0x57F74824] |
| 215FB6 | N/A | UPX1 | JMP QWORD PTR [RIP+0x8454282F] |
| 22297E | N/A | UPX1 | CALL QWORD PTR [RIP+0x68FE72B] |
| 23FE7E | N/A | UPX1 | JMP QWORD PTR [RIP+0xAD95DAFD] |
| 24B3FA | N/A | UPX1 | JMP QWORD PTR [RIP+0x81D8B90B] |
| 24EC99 | N/A | UPX1 | JMP QWORD PTR [RIP+0xAEF21B46] |
| 251EAE | N/A | UPX1 | JMP QWORD PTR [RIP+0xDE5639F7] |
| 25A8D1 | N/A | UPX1 | JMP QWORD PTR [RIP+0xE9D83746] |
| 25A9BC | N/A | UPX1 | JMP QWORD PTR [RIP+0x75D2D8A8] |
| 25BB98 | N/A | UPX1 | CALL QWORD PTR [RIP+0x2E5D63B8] |
| 282BB2 | N/A | UPX1 | JMP QWORD PTR [RIP+0xC6F98D05] |
| 2883E7 | N/A | UPX1 | CALL QWORD PTR [RIP+0xD71B52CA] |
| 2888AA | N/A | UPX1 | JMP QWORD PTR [RIP+0xDE9F13AE] |
| 28BFB6 | N/A | UPX1 | CALL QWORD PTR [RIP+0xA62F2C3C] |
| 29E9A1 | N/A | UPX1 | JMP QWORD PTR [RIP+0xEDBBEE82] |
| 50A0A8 | 1408E2AC7 | UPX1 | TLS Callback | Pointer to 8E2AC7 - 0x509EC7 UPX1 |
| 400-50A1FF | 3D9000 | UPX1 | Executable section anomaly, first bytes: 1A03002420DB2FF0 |
| 50EC00 | N/A | *Overlay* | B64812A75DC320020E0000000000000036CAD306 | .H..]. .........6... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 3642996 | 68,6899% |
| Null Byte Code | 24635 | 0,4645% |
© 2026 All rights reserved.