PREMIUM PESCAN.IO - Analysis Report

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header

Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 1,39 MB
SHA-256 Hash: D68D643D9D513346A44C705A2E55EA96AF21BC63371DEB6610A682137EDBE17C
SHA-1 Hash: F414B49CCF112B5A93CD7049FB582BD9D39ECC4D
MD5 Hash: 9AFEAD4177E47435625D44D27F2DED9F
Imphash: B72CEDC1AC36249BACEC37C3B2E9923E
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 0005A57C
EntryPoint (rva): 1410
SizeOfHeaders: 400
SizeOfImage: 16C000
ImageBase: 63080000
Architecture: x86
ExportTable: 164000
ImportTable: 165000
Characteristics: 230E
TimeDateStamp: 57938EBF
Date: 23/07/2016 15:35:27
File Type: DLL
Number Of Sections: 10
ASLR: Disabled
Section Names: .text, .data, .rdata, .eh_fram, .bss, .edata, .idata, .CRT, .tls, .reloc
Number Of Executable Sections: 1
Subsystem: Windows Console

Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60500060
Code
Initialized Data
Executable
Readable
400 38400 1000 39000
6.3318
1745320.82
.data
0xC0600040
Initialized Data
Readable
Writeable
38800 9600 3A000 A000
7.0934
382062.59
.rdata
0x40700040
Initialized Data
Readable
41E00 F200 44000 10000
6.9167
491058.82
.eh_fram
0x40300040
Initialized Data
Readable
51000 4E00 54000 5000
5.0485
450962.33
.bss
0xC0700080
Uninitialized Data
Readable
Writeable
55E00 10B000 59000 10B000
4.1626
84065421.08
.edata
0x40300040
Initialized Data
Readable
160E00 200 164000 1000
0.9476
105360
.idata
0xC0300040
Initialized Data
Readable
Writeable
161000 1A00 165000 2000
5.5177
102352.15
.CRT
0xC0300040
Initialized Data
Readable
Writeable
162A00 200 167000 1000
0.278
123009
.tls
0xC0300040
Initialized Data
Readable
Writeable
162C00 200 168000 1000
0.2702
123013
.reloc
0x42300040
Initialized Data
GP-Relative
Readable
162E00 0 169000 3000
N/A
N/A
Description
OriginalFilename: Shareit.exe
LegalCopyright: Copyright 2016. All rights reserved.
ProductName: Lenovo SHAREit
FileVersion: 3.10.349.0
FileDescription: SHAREit
ProductVersion: 3.10.349.0

Binder/Joiner/Crypter
2 Executable files found

Entry Point
The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - 810
Code -> 83EC1CC705D03E1E63000000008B54242483FA01741A8B4C24288B442420E83DFEFFFF83C41CC20C008DB426000000008954
Assembler
|SUB ESP, 0X1C
|MOV DWORD PTR [0X631E3ED0], 0
|MOV EDX, DWORD PTR [ESP + 0X24]
|CMP EDX, 1
|JE 0X1030
|MOV ECX, DWORD PTR [ESP + 0X28]
|MOV EAX, DWORD PTR [ESP + 0X20]
|CALL 0XE60
|ADD ESP, 0X1C
|RET 0XC
|LEA ESI, [ESI]
Signatures
CheckSum Integrity Problem:
Header: 370044
Calculated: 1472926
Certificate - Digital Signature Not Found:
• The file is not signed

Packer/Compiler
Detect It Easy (die)
PE: compiler: MinGW(GCC: (i686-posix-dwarf-rev0, Built by MinGW-W64 project) 4.9.3)[-]
PE: linker: GNU linker ld (GNU Binutils)(2.25)[-]
Entropy: 5.01937

Suspicious Functions
Library Function Description
KERNEL32.DLL VirtualAlloc Reserve, commit, or both, a region of memory within the virtual address space of a process.
KERNEL32.DLL GetModuleHandleA Retrieves a handle to the specified module.
KERNEL32.DLL LoadLibraryA Loads the specified module into the address space of the calling process.
KERNEL32.DLL LoadLibraryW Loads the specified module into the address space of the calling process.
KERNEL32.DLL CreateToolhelp32Snapshot Creates a snapshot of the specified processes, heaps, threads, and modules.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL IsDebuggerPresent Determines if the calling process is being debugged by a user-mode debugger.
Ws2_32.DLL socket Create a communication endpoint for networking applications.
Ws2_32.DLL connect Establish a connection to a specified socket.
SHELL32.DLL ShellExecuteA Performs a run operation on a specific file.
SHELL32.DLL ShellExecuteW Performs a run operation on a specific file.
ET Functions (carving)
Original Name -> lib.dll
Init
qeyEvent@12

File Access
.exe
package.exe
WS2_32.dll
USER32.dll
SHELL32.dll
ole32.dll
msvcrt.dll
KERNEL32.dll
gdiplus.dll
GDI32.dll
CRYPT32.dll
lib.dll
libgcj-13.dll
ntdll.dll
advapi32.dll
libgcj-16.dll
libgcc_s_dw2-1.dll
.dat
Temp
UserProfile

File Access (UNICODE)
package.exe
Shareit.exe
\Users\Bruno\Desktop\Shareit.exe
dir00\com3.exe
\Program Files\Intel GPU\GfxUI.exe
RECYCLER\%ls.exe
GfxUI.exe
winrar.exe
SearchHelper.exe
%ls%ls.exe
%ls.exe
%ls\%ls.exe
RECYCLER\package.exe
mozglue.dll
sqlite3.dll
nss3.dll
exe!%SystemRoot%\system32\shell32.dll
Temp
AppData

SQL Queries
SELECT hostname,httpRealm,encryptedUsername,encryptedPassword FROM moz_logins;
SELECT origin_url, username_value, password_value FROM logins

Interest's Words
Encrypt
Decrypt
PassWord
exec
attrib
start
pause
hostname
shutdown
setx

Interest's Words (UNICODE)
Virus
start
pause

URLs
http://srv70.putdrive.com/putstorage/DownloadFileHash/876AD5EE3A5A4A5QQWE2044367EWQS/nss3.gz
http://b3.ge.tt/gett/5XbtZvb2/nss3.gz?index=1
http://quicks.hol.es/c13/nss3.gz
http://quick.comuf.com/c13/nss3.gz
http://srv70.putdrive.com/putstorage/DownloadFileHash/AB345ECD3A5A4A5QQWE2044366EWQS/mozglue.gz
http://b3.ge.tt/gett/5XbtZvb2/mozglue.gz?index=0
http://quicks.hol.es/c13/mozglue.gz
http://quick.comuf.com/c13/mozglue.gz
http://quicks.hol.es/c13/ad.php
http://quick.comuf.com/c13/ad.php
http://quicks.hol.es/c13/dwn13.dmp
http://quick.comuf.com/c13/dwn13.dmp
http://backupsupport.comxa.com/z/dwn13.dmp
http://backupsupport.esy.es/z/dwn13.dmp
http://supportbackup.esy.es/c/c13.php
http://supportservice.netai.net/c/c13.php
http://backupsupport.esy.es/z/c13.php
http://backupsupport.comxa.com/z/c13.php

PE Carving
Start Offset Header End Offset Size (Bytes)
0 E08A0 E08A0
E08A0 162E00 82560
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii WinAPI Sockets (WSACleanup)
Text Ascii WinAPI Sockets (bind)
Text Ascii WinAPI Sockets (connect)
Text Ascii WinAPI Sockets (recv)
Text Ascii WinAPI Sockets (send)
Text Ascii Registry (RegOpenKeyEx)
Text Ascii Registry (RegSetValueEx)
Text Ascii File (GetTempPath)
Text Ascii File (CreateFile)
Text Ascii Anti-Analysis VM (IsDebuggerPresent)
Text Ascii Anti-Analysis VM (CreateToolhelp32Snapshot)
Text Ascii Reconnaissance (FindFirstFileW)
Text Ascii Reconnaissance (FindNextFileW)
Text Ascii Reconnaissance (FindClose)
Text Ascii Stealth (GetThreadContext)
Text Ascii Stealth (SetThreadContext)
Text Ascii Stealth (ReleaseSemaphore)
Text Ascii Stealth (CloseHandle)
Text Ascii Stealth (VirtualAlloc)
Text Ascii Stealth (VirtualProtect)
Text Ascii Execution (CreateProcessW)
Text Ascii Execution (ShellExecute)
Text Ascii Execution (ResumeThread)
Text Ascii Execution (CreateSemaphoreA)
Text Ascii Execution (CreateEventA)
Text Unicode Antivirus Software (comodo)
Text Unicode Antivirus Software (Kaspersky)
Text Unicode Antivirus Software (Norton)
Text Ascii Keyboard Key ([APPS])
Text Ascii Keyboard Key ([DEL])
Text Ascii Keyboard Key ([INS])
Text Ascii Keyboard Key ([HELP])
Text Ascii Malware that monitors and collects user data (Spy)
Intelligent String
• 3.10.349.0
• http://supportservice.netai.net/c/c13.php
• http://supportbackup.esy.es/c/c13.php
• Shareit.exe
• .tls
• .CRT
• @0@.bss
• package.exe
• .\.RECYCLER\package.exe!%SystemRoot%\system32\shell32.dll
• MySe9.CoM
• EGY.CoM
• MyElahY.CoM
• c 00OCTET STRINGINTEGER
• nss3.dll
• sqlite3.dll
• logins.json
• SELECT origin_url, username_value, password_value FROM loginsLogin Data
• %ls\%ls.exe
• %ls.exe
• .exe
• ~SMR9S8973LABX9C1C3.TMP
• ~CMR9H8973LABX9C1C3.TMP
• ~QMR9D8973LABX9C1C3.TMP
• ~UMR9X8973LABX9C1C3.TMP
• c:\ntdll.dll
• %ls%ls.exe
• mozglue.dll
• package.exe
• SearchHelper.exe
• winrar.exe
• ADD HKLM\%ls /f /t REG_SZ /v "%ls" /d "%ls"
• ADD HKCU\%ls /f /t REG_SZ /v "%ls" /d "%ls"
• c:\.RECYCLER
• c:\.RECYCLER\%ls.exe
• c:\%ls.lnk
• c:\recycler.lnk
• .tmp
• C:\Users\Bruno\AppData\Local\Temp\~UMR9X8973LABX9C1C3.TMP
• C:\Users\Bruno\AppData\Local\Temp\~QMR9D8973LABX9C1C3.TMP
• C:\Users\Bruno\AppData\Local\Temp\~CMR9H8973LABX9C1C3.TMP
• C:\Users\Bruno\AppData\Local\Temp\~SMR9S8973LABX9C1C3.TMP
• C:\Program Files\Intel GPU\GfxUI.exe
• C:\Users\Bruno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe
• C:\Users\Bruno\AppData\Local\Temp\WER9mso.dir00\com3.exe
• C:\Users\Bruno\AppData\Roaming\Microsoft\Search\SearchHelper.exe
• C:\Users\Bruno\AppData\Roaming\Microsoft\persist.dat
• C:\Users\Bruno\Desktop\Shareit.exe
• http://srv70.putdrive.com/putstorage/DownloadFileHash/876AD5EE3A5A4A5QQWE2044367EWQS/nss3.gz
• http://b3.ge.tt/gett/5XbtZvb2/nss3.gz?index=1
• http://quicks.hol.es/c13/nss3.gz
• http://quick.comuf.com/c13/nss3.gz
• http://srv70.putdrive.com/putstorage/DownloadFileHash/AB345ECD3A5A4A5QQWE2044366EWQS/mozglue.gz
• http://b3.ge.tt/gett/5XbtZvb2/mozglue.gz?index=0
• http://quicks.hol.es/c13/mozglue.gz
• http://quick.comuf.com/c13/mozglue.gz
• http://quicks.hol.es/c13/ad.php
• http://quick.comuf.com/c13/ad.php
• http://quicks.hol.es/c13/dwn13.dmp
• http://quick.comuf.com/c13/dwn13.dmp
• http://backupsupport.comxa.com/z/dwn13.dmp
• http://backupsupport.esy.es/z/dwn13.dmp
• http://backupsupport.esy.es/z/c13.php
• http://backupsupport.comxa.com/z/c13.php
• KERNEL32.dll
• PWS2_32.dll

Flow Anomalies
Offset RVA Section Description
87C 631E5544 .text CALL [static] | Indirect call to absolute memory address
8FB 631E5518 .text CALL [static] | Indirect call to absolute memory address
974 631E54E8 .text CALL [static] | Indirect call to absolute memory address
99A 631E56F4 .text CALL [static] | Indirect call to absolute memory address
9C7 631E5770 .text CALL [static] | Indirect call to absolute memory address
9EA 631E5624 .text CALL [static] | Indirect call to absolute memory address
A1B 631E563C .text CALL [static] | Indirect call to absolute memory address
CD4 631E3AD4 .text CALL [static] | Indirect call to absolute memory address
D14 631E3ACC .text CALL [static] | Indirect call to absolute memory address
D21 631E3AC8 .text CALL [static] | Indirect call to absolute memory address
D41 631E3AC8 .text CALL [static] | Indirect call to absolute memory address
E7D 631E3AB8 .text CALL [static] | Indirect call to absolute memory address
EB5 631E3AC0 .text CALL [static] | Indirect call to absolute memory address
F51 631E3ABC .text CALL [static] | Indirect call to absolute memory address
F5D 631E3AC4 .text CALL [static] | Indirect call to absolute memory address
38BC 631E5624 .text CALL [static] | Indirect call to absolute memory address
3DB7 631E5444 .text CALL [static] | Indirect call to absolute memory address
3DF4 631E5548 .text CALL [static] | Indirect call to absolute memory address
3F46 631E5548 .text CALL [static] | Indirect call to absolute memory address
4270 631E54BC .text CALL [static] | Indirect call to absolute memory address
427E 631E54B4 .text CALL [static] | Indirect call to absolute memory address
4306 631E54BC .text CALL [static] | Indirect call to absolute memory address
432F 631E5514 .text CALL [static] | Indirect call to absolute memory address
438C 631E5768 .text CALL [static] | Indirect call to absolute memory address
439E 631E575C .text CALL [static] | Indirect call to absolute memory address
43CE 631E5778 .text CALL [static] | Indirect call to absolute memory address
442B 631E573C .text CALL [static] | Indirect call to absolute memory address
4437 631E578C .text CALL [static] | Indirect call to absolute memory address
446B 631E5784 .text CALL [static] | Indirect call to absolute memory address
4475 631E5748 .text CALL [static] | Indirect call to absolute memory address
45B4 631E5534 .text CALL [static] | Indirect call to absolute memory address
4613 631E5730 .text CALL [static] | Indirect call to absolute memory address
4696 631E54C0 .text CALL [static] | Indirect call to absolute memory address
473F 631E563C .text CALL [static] | Indirect call to absolute memory address
4771 631E563C .text CALL [static] | Indirect call to absolute memory address
47C0 631E5624 .text CALL [static] | Indirect call to absolute memory address
4827 631E5624 .text CALL [static] | Indirect call to absolute memory address
4964 631E5630 .text CALL [static] | Indirect call to absolute memory address
498E 631E5630 .text CALL [static] | Indirect call to absolute memory address
49CB 631E5728 .text CALL [static] | Indirect call to absolute memory address
4BD4 631E56EC .text CALL [static] | Indirect call to absolute memory address
4BE3 631E56EC .text CALL [static] | Indirect call to absolute memory address
4C5D 631E54E0 .text CALL [static] | Indirect call to absolute memory address
4CF4 631E561C .text CALL [static] | Indirect call to absolute memory address
4D3A 631E561C .text CALL [static] | Indirect call to absolute memory address
4D5B 631E54E4 .text CALL [static] | Indirect call to absolute memory address
4DB1 631E54DC .text CALL [static] | Indirect call to absolute memory address
4DE1 631E56EC .text CALL [static] | Indirect call to absolute memory address
4DF2 631E56EC .text CALL [static] | Indirect call to absolute memory address
4EBD 631E3AB8 .text CALL [static] | Indirect call to absolute memory address
4F04 631E3AC0 .text CALL [static] | Indirect call to absolute memory address
503F 631E3ABC .text CALL [static] | Indirect call to absolute memory address
504E 631E3AC4 .text CALL [static] | Indirect call to absolute memory address
50D4 631E5624 .text CALL [static] | Indirect call to absolute memory address
5349 631E3AD8 .text CALL [static] | Indirect call to absolute memory address
5355 631E3ADC .text CALL [static] | Indirect call to absolute memory address
5396 631E3AD8 .text CALL [static] | Indirect call to absolute memory address
5418 631E5624 .text CALL [static] | Indirect call to absolute memory address
5AB9 631E5624 .text CALL [static] | Indirect call to absolute memory address
5EF0 631E54E0 .text CALL [static] | Indirect call to absolute memory address
607F 631E54E4 .text CALL [static] | Indirect call to absolute memory address
6098 631E54DC .text CALL [static] | Indirect call to absolute memory address
615A 631E3AB8 .text CALL [static] | Indirect call to absolute memory address
6193 631E3AB4 .text CALL [static] | Indirect call to absolute memory address
61B6 631E3AB0 .text CALL [static] | Indirect call to absolute memory address
61D6 631E3AAC .text CALL [static] | Indirect call to absolute memory address
61F3 631E3AAC .text CALL [static] | Indirect call to absolute memory address
6210 631E3AAC .text CALL [static] | Indirect call to absolute memory address
62B8 631E3AA8 .text CALL [static] | Indirect call to absolute memory address
62C7 631E3AC4 .text CALL [static] | Indirect call to absolute memory address
633B 631E54E0 .text CALL [static] | Indirect call to absolute memory address
6402 631E54E4 .text CALL [static] | Indirect call to absolute memory address
641B 631E54DC .text CALL [static] | Indirect call to absolute memory address
65ED 631E3AF8 .text CALL [static] | Indirect call to absolute memory address
6853 631E5798 .text CALL [static] | Indirect call to absolute memory address
6868 631E5794 .text CALL [static] | Indirect call to absolute memory address
68BF 631E57B8 .text CALL [static] | Indirect call to absolute memory address
68D7 631E57A4 .text CALL [static] | Indirect call to absolute memory address
68F2 631E57A8 .text CALL [static] | Indirect call to absolute memory address
6917 631E57A0 .text CALL [static] | Indirect call to absolute memory address
6940 631E579C .text CALL [static] | Indirect call to absolute memory address
69AD 631E57B0 .text CALL [static] | Indirect call to absolute memory address
69D7 631E57AC .text CALL [static] | Indirect call to absolute memory address
6A55 631E57B4 .text CALL [static] | Indirect call to absolute memory address
6AA6 631E5784 .text CALL [static] | Indirect call to absolute memory address
6AB0 631E5748 .text CALL [static] | Indirect call to absolute memory address
6ACD 631E5514 .text CALL [static] | Indirect call to absolute memory address
6ADF 631E5544 .text CALL [static] | Indirect call to absolute memory address
6B05 631E5780 .text CALL [static] | Indirect call to absolute memory address
6B20 631E5788 .text CALL [static] | Indirect call to absolute memory address
6C5C 631E5544 .text CALL [static] | Indirect call to absolute memory address
6D3F 631E5544 .text CALL [static] | Indirect call to absolute memory address
6D5E 631E5518 .text CALL [static] | Indirect call to absolute memory address
6DDD 631E3B08 .text CALL [static] | Indirect call to absolute memory address
6E12 631E3B00 .text CALL [static] | Indirect call to absolute memory address
6E25 631E3AFC .text CALL [static] | Indirect call to absolute memory address
6E34 631E3AFC .text CALL [static] | Indirect call to absolute memory address
6EA6 631E3B08 .text CALL [static] | Indirect call to absolute memory address
6EF7 631E3AFC .text CALL [static] | Indirect call to absolute memory address
6F06 631E3AFC .text CALL [static] | Indirect call to absolute memory address
162A18 261A0 .CRT TLS Callback | Pointer to 630A61A0 - 0x255A0 .text
162A1C 26150 .CRT TLS Callback | Pointer to 630A6150 - 0x25550 .text
162A20 33550 .CRT TLS Callback | Pointer to 630B3550 - 0x32950 .text
Extra Analysis
Metric Value Percentage
Ascii Code 615958 42,3756%
Null Byte Code 656845 45,1885%
NOP Cave Found 0x9090909090 Block Count: 209 | Total: 0,0359%
© 2026 All rights reserved.