PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,39 MB SHA-256 Hash: D68D643D9D513346A44C705A2E55EA96AF21BC63371DEB6610A682137EDBE17C SHA-1 Hash: F414B49CCF112B5A93CD7049FB582BD9D39ECC4D MD5 Hash: 9AFEAD4177E47435625D44D27F2DED9F Imphash: B72CEDC1AC36249BACEC37C3B2E9923E MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 0005A57C EntryPoint (rva): 1410 SizeOfHeaders: 400 SizeOfImage: 16C000 ImageBase: 63080000 Architecture: x86 ExportTable: 164000 ImportTable: 165000 Characteristics: 230E TimeDateStamp: 57938EBF Date: 23/07/2016 15:35:27 File Type: DLL Number Of Sections: 10 ASLR: Disabled Section Names: .text, .data, .rdata, .eh_fram, .bss, .edata, .idata, .CRT, .tls, .reloc Number Of Executable Sections: 1 Subsystem: Windows Console |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60500060 Code Initialized Data Executable Readable |
400 | 38400 | 1000 | 39000 |
|
|
| .data | 0xC0600040 Initialized Data Readable Writeable |
38800 | 9600 | 3A000 | A000 |
|
|
| .rdata | 0x40700040 Initialized Data Readable |
41E00 | F200 | 44000 | 10000 |
|
|
| .eh_fram | 0x40300040 Initialized Data Readable |
51000 | 4E00 | 54000 | 5000 |
|
|
| .bss | 0xC0700080 Uninitialized Data Readable Writeable |
55E00 | 10B000 | 59000 | 10B000 |
|
|
| .edata | 0x40300040 Initialized Data Readable |
160E00 | 200 | 164000 | 1000 |
|
|
| .idata | 0xC0300040 Initialized Data Readable Writeable |
161000 | 1A00 | 165000 | 2000 |
|
|
| .CRT | 0xC0300040 Initialized Data Readable Writeable |
162A00 | 200 | 167000 | 1000 |
|
|
| .tls | 0xC0300040 Initialized Data Readable Writeable |
162C00 | 200 | 168000 | 1000 |
|
|
| .reloc | 0x42300040 Initialized Data GP-Relative Readable |
162E00 | 0 | 169000 | 3000 |
|
|
| Description |
| OriginalFilename: Shareit.exe LegalCopyright: Copyright 2016. All rights reserved. ProductName: Lenovo SHAREit FileVersion: 3.10.349.0 FileDescription: SHAREit ProductVersion: 3.10.349.0 |
| Binder/Joiner/Crypter |
| 2 Executable files found |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 810 Code -> 83EC1CC705D03E1E63000000008B54242483FA01741A8B4C24288B442420E83DFEFFFF83C41CC20C008DB426000000008954 Assembler |SUB ESP, 0X1C |MOV DWORD PTR [0X631E3ED0], 0 |MOV EDX, DWORD PTR [ESP + 0X24] |CMP EDX, 1 |JE 0X1030 |MOV ECX, DWORD PTR [ESP + 0X28] |MOV EAX, DWORD PTR [ESP + 0X20] |CALL 0XE60 |ADD ESP, 0X1C |RET 0XC |LEA ESI, [ESI] |
| Signatures |
| CheckSum Integrity Problem: • Header: 370044 • Calculated: 1472926 Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: MinGW(GCC: (i686-posix-dwarf-rev0, Built by MinGW-W64 project) 4.9.3)[-] • PE: linker: GNU linker ld (GNU Binutils)(2.25)[-] • Entropy: 5.01937 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| ET Functions (carving) |
| Original Name -> lib.dll Init qeyEvent@12 |
| File Access |
| .exe package.exe WS2_32.dll USER32.dll SHELL32.dll ole32.dll msvcrt.dll KERNEL32.dll gdiplus.dll GDI32.dll CRYPT32.dll lib.dll libgcj-13.dll ntdll.dll advapi32.dll libgcj-16.dll libgcc_s_dw2-1.dll .dat Temp UserProfile |
| File Access (UNICODE) |
| package.exe Shareit.exe \Users\Bruno\Desktop\Shareit.exe dir00\com3.exe \Program Files\Intel GPU\GfxUI.exe RECYCLER\%ls.exe GfxUI.exe winrar.exe SearchHelper.exe %ls%ls.exe %ls.exe %ls\%ls.exe RECYCLER\package.exe mozglue.dll sqlite3.dll nss3.dll exe!%SystemRoot%\system32\shell32.dll Temp AppData |
| SQL Queries |
| SELECT hostname,httpRealm,encryptedUsername,encryptedPassword FROM moz_logins; SELECT origin_url, username_value, password_value FROM logins |
| Interest's Words |
| Encrypt Decrypt PassWord exec attrib start pause hostname shutdown setx |
| Interest's Words (UNICODE) |
| Virus start pause |
| URLs |
| http://srv70.putdrive.com/putstorage/DownloadFileHash/876AD5EE3A5A4A5QQWE2044367EWQS/nss3.gz http://b3.ge.tt/gett/5XbtZvb2/nss3.gz?index=1 http://quicks.hol.es/c13/nss3.gz http://quick.comuf.com/c13/nss3.gz http://srv70.putdrive.com/putstorage/DownloadFileHash/AB345ECD3A5A4A5QQWE2044366EWQS/mozglue.gz http://b3.ge.tt/gett/5XbtZvb2/mozglue.gz?index=0 http://quicks.hol.es/c13/mozglue.gz http://quick.comuf.com/c13/mozglue.gz http://quicks.hol.es/c13/ad.php http://quick.comuf.com/c13/ad.php http://quicks.hol.es/c13/dwn13.dmp http://quick.comuf.com/c13/dwn13.dmp http://backupsupport.comxa.com/z/dwn13.dmp http://backupsupport.esy.es/z/dwn13.dmp http://supportbackup.esy.es/c/c13.php http://supportservice.netai.net/c/c13.php http://backupsupport.esy.es/z/c13.php http://backupsupport.comxa.com/z/c13.php |
| PE Carving |
| Start Offset Header | End Offset | Size (Bytes) |
|---|---|---|
| 0 | E08A0 | E08A0 |
| E08A0 | 162E00 | 82560 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (WSACleanup) |
| Text | Ascii | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | WinAPI Sockets (recv) |
| Text | Ascii | WinAPI Sockets (send) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (GetThreadContext) |
| Text | Ascii | Stealth (SetThreadContext) |
| Text | Ascii | Stealth (ReleaseSemaphore) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (CreateSemaphoreA) |
| Text | Ascii | Execution (CreateEventA) |
| Text | Unicode | Antivirus Software (comodo) |
| Text | Unicode | Antivirus Software (Kaspersky) |
| Text | Unicode | Antivirus Software (Norton) |
| Text | Ascii | Keyboard Key ([APPS]) |
| Text | Ascii | Keyboard Key ([DEL]) |
| Text | Ascii | Keyboard Key ([INS]) |
| Text | Ascii | Keyboard Key ([HELP]) |
| Text | Ascii | Malware that monitors and collects user data (Spy) |
| Intelligent String |
| • 3.10.349.0 • http://supportservice.netai.net/c/c13.php • http://supportbackup.esy.es/c/c13.php • Shareit.exe • .tls • .CRT • @0@.bss • package.exe • .\.RECYCLER\package.exe!%SystemRoot%\system32\shell32.dll • MySe9.CoM • EGY.CoM • MyElahY.CoM • c 00OCTET STRINGINTEGER • nss3.dll • sqlite3.dll • logins.json • SELECT origin_url, username_value, password_value FROM loginsLogin Data • %ls\%ls.exe • %ls.exe • .exe • ~SMR9S8973LABX9C1C3.TMP • ~CMR9H8973LABX9C1C3.TMP • ~QMR9D8973LABX9C1C3.TMP • ~UMR9X8973LABX9C1C3.TMP • c:\ntdll.dll • %ls%ls.exe • mozglue.dll • package.exe • SearchHelper.exe • winrar.exe • ADD HKLM\%ls /f /t REG_SZ /v "%ls" /d "%ls" • ADD HKCU\%ls /f /t REG_SZ /v "%ls" /d "%ls" • c:\.RECYCLER • c:\.RECYCLER\%ls.exe • c:\%ls.lnk • c:\recycler.lnk • .tmp • C:\Users\Bruno\AppData\Local\Temp\~UMR9X8973LABX9C1C3.TMP • C:\Users\Bruno\AppData\Local\Temp\~QMR9D8973LABX9C1C3.TMP • C:\Users\Bruno\AppData\Local\Temp\~CMR9H8973LABX9C1C3.TMP • C:\Users\Bruno\AppData\Local\Temp\~SMR9S8973LABX9C1C3.TMP • C:\Program Files\Intel GPU\GfxUI.exe • C:\Users\Bruno\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ShareIt Service.exe • C:\Users\Bruno\AppData\Local\Temp\WER9mso.dir00\com3.exe • C:\Users\Bruno\AppData\Roaming\Microsoft\Search\SearchHelper.exe • C:\Users\Bruno\AppData\Roaming\Microsoft\persist.dat • C:\Users\Bruno\Desktop\Shareit.exe • http://srv70.putdrive.com/putstorage/DownloadFileHash/876AD5EE3A5A4A5QQWE2044367EWQS/nss3.gz • http://b3.ge.tt/gett/5XbtZvb2/nss3.gz?index=1 • http://quicks.hol.es/c13/nss3.gz • http://quick.comuf.com/c13/nss3.gz • http://srv70.putdrive.com/putstorage/DownloadFileHash/AB345ECD3A5A4A5QQWE2044366EWQS/mozglue.gz • http://b3.ge.tt/gett/5XbtZvb2/mozglue.gz?index=0 • http://quicks.hol.es/c13/mozglue.gz • http://quick.comuf.com/c13/mozglue.gz • http://quicks.hol.es/c13/ad.php • http://quick.comuf.com/c13/ad.php • http://quicks.hol.es/c13/dwn13.dmp • http://quick.comuf.com/c13/dwn13.dmp • http://backupsupport.comxa.com/z/dwn13.dmp • http://backupsupport.esy.es/z/dwn13.dmp • http://backupsupport.esy.es/z/c13.php • http://backupsupport.comxa.com/z/c13.php • KERNEL32.dll • PWS2_32.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 87C | 631E5544 | .text | CALL [static] | Indirect call to absolute memory address |
| 8FB | 631E5518 | .text | CALL [static] | Indirect call to absolute memory address |
| 974 | 631E54E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 99A | 631E56F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 9C7 | 631E5770 | .text | CALL [static] | Indirect call to absolute memory address |
| 9EA | 631E5624 | .text | CALL [static] | Indirect call to absolute memory address |
| A1B | 631E563C | .text | CALL [static] | Indirect call to absolute memory address |
| CD4 | 631E3AD4 | .text | CALL [static] | Indirect call to absolute memory address |
| D14 | 631E3ACC | .text | CALL [static] | Indirect call to absolute memory address |
| D21 | 631E3AC8 | .text | CALL [static] | Indirect call to absolute memory address |
| D41 | 631E3AC8 | .text | CALL [static] | Indirect call to absolute memory address |
| E7D | 631E3AB8 | .text | CALL [static] | Indirect call to absolute memory address |
| EB5 | 631E3AC0 | .text | CALL [static] | Indirect call to absolute memory address |
| F51 | 631E3ABC | .text | CALL [static] | Indirect call to absolute memory address |
| F5D | 631E3AC4 | .text | CALL [static] | Indirect call to absolute memory address |
| 38BC | 631E5624 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DB7 | 631E5444 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DF4 | 631E5548 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F46 | 631E5548 | .text | CALL [static] | Indirect call to absolute memory address |
| 4270 | 631E54BC | .text | CALL [static] | Indirect call to absolute memory address |
| 427E | 631E54B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4306 | 631E54BC | .text | CALL [static] | Indirect call to absolute memory address |
| 432F | 631E5514 | .text | CALL [static] | Indirect call to absolute memory address |
| 438C | 631E5768 | .text | CALL [static] | Indirect call to absolute memory address |
| 439E | 631E575C | .text | CALL [static] | Indirect call to absolute memory address |
| 43CE | 631E5778 | .text | CALL [static] | Indirect call to absolute memory address |
| 442B | 631E573C | .text | CALL [static] | Indirect call to absolute memory address |
| 4437 | 631E578C | .text | CALL [static] | Indirect call to absolute memory address |
| 446B | 631E5784 | .text | CALL [static] | Indirect call to absolute memory address |
| 4475 | 631E5748 | .text | CALL [static] | Indirect call to absolute memory address |
| 45B4 | 631E5534 | .text | CALL [static] | Indirect call to absolute memory address |
| 4613 | 631E5730 | .text | CALL [static] | Indirect call to absolute memory address |
| 4696 | 631E54C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 473F | 631E563C | .text | CALL [static] | Indirect call to absolute memory address |
| 4771 | 631E563C | .text | CALL [static] | Indirect call to absolute memory address |
| 47C0 | 631E5624 | .text | CALL [static] | Indirect call to absolute memory address |
| 4827 | 631E5624 | .text | CALL [static] | Indirect call to absolute memory address |
| 4964 | 631E5630 | .text | CALL [static] | Indirect call to absolute memory address |
| 498E | 631E5630 | .text | CALL [static] | Indirect call to absolute memory address |
| 49CB | 631E5728 | .text | CALL [static] | Indirect call to absolute memory address |
| 4BD4 | 631E56EC | .text | CALL [static] | Indirect call to absolute memory address |
| 4BE3 | 631E56EC | .text | CALL [static] | Indirect call to absolute memory address |
| 4C5D | 631E54E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CF4 | 631E561C | .text | CALL [static] | Indirect call to absolute memory address |
| 4D3A | 631E561C | .text | CALL [static] | Indirect call to absolute memory address |
| 4D5B | 631E54E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4DB1 | 631E54DC | .text | CALL [static] | Indirect call to absolute memory address |
| 4DE1 | 631E56EC | .text | CALL [static] | Indirect call to absolute memory address |
| 4DF2 | 631E56EC | .text | CALL [static] | Indirect call to absolute memory address |
| 4EBD | 631E3AB8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4F04 | 631E3AC0 | .text | CALL [static] | Indirect call to absolute memory address |
| 503F | 631E3ABC | .text | CALL [static] | Indirect call to absolute memory address |
| 504E | 631E3AC4 | .text | CALL [static] | Indirect call to absolute memory address |
| 50D4 | 631E5624 | .text | CALL [static] | Indirect call to absolute memory address |
| 5349 | 631E3AD8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5355 | 631E3ADC | .text | CALL [static] | Indirect call to absolute memory address |
| 5396 | 631E3AD8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5418 | 631E5624 | .text | CALL [static] | Indirect call to absolute memory address |
| 5AB9 | 631E5624 | .text | CALL [static] | Indirect call to absolute memory address |
| 5EF0 | 631E54E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 607F | 631E54E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 6098 | 631E54DC | .text | CALL [static] | Indirect call to absolute memory address |
| 615A | 631E3AB8 | .text | CALL [static] | Indirect call to absolute memory address |
| 6193 | 631E3AB4 | .text | CALL [static] | Indirect call to absolute memory address |
| 61B6 | 631E3AB0 | .text | CALL [static] | Indirect call to absolute memory address |
| 61D6 | 631E3AAC | .text | CALL [static] | Indirect call to absolute memory address |
| 61F3 | 631E3AAC | .text | CALL [static] | Indirect call to absolute memory address |
| 6210 | 631E3AAC | .text | CALL [static] | Indirect call to absolute memory address |
| 62B8 | 631E3AA8 | .text | CALL [static] | Indirect call to absolute memory address |
| 62C7 | 631E3AC4 | .text | CALL [static] | Indirect call to absolute memory address |
| 633B | 631E54E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 6402 | 631E54E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 641B | 631E54DC | .text | CALL [static] | Indirect call to absolute memory address |
| 65ED | 631E3AF8 | .text | CALL [static] | Indirect call to absolute memory address |
| 6853 | 631E5798 | .text | CALL [static] | Indirect call to absolute memory address |
| 6868 | 631E5794 | .text | CALL [static] | Indirect call to absolute memory address |
| 68BF | 631E57B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 68D7 | 631E57A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 68F2 | 631E57A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 6917 | 631E57A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 6940 | 631E579C | .text | CALL [static] | Indirect call to absolute memory address |
| 69AD | 631E57B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 69D7 | 631E57AC | .text | CALL [static] | Indirect call to absolute memory address |
| 6A55 | 631E57B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 6AA6 | 631E5784 | .text | CALL [static] | Indirect call to absolute memory address |
| 6AB0 | 631E5748 | .text | CALL [static] | Indirect call to absolute memory address |
| 6ACD | 631E5514 | .text | CALL [static] | Indirect call to absolute memory address |
| 6ADF | 631E5544 | .text | CALL [static] | Indirect call to absolute memory address |
| 6B05 | 631E5780 | .text | CALL [static] | Indirect call to absolute memory address |
| 6B20 | 631E5788 | .text | CALL [static] | Indirect call to absolute memory address |
| 6C5C | 631E5544 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D3F | 631E5544 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D5E | 631E5518 | .text | CALL [static] | Indirect call to absolute memory address |
| 6DDD | 631E3B08 | .text | CALL [static] | Indirect call to absolute memory address |
| 6E12 | 631E3B00 | .text | CALL [static] | Indirect call to absolute memory address |
| 6E25 | 631E3AFC | .text | CALL [static] | Indirect call to absolute memory address |
| 6E34 | 631E3AFC | .text | CALL [static] | Indirect call to absolute memory address |
| 6EA6 | 631E3B08 | .text | CALL [static] | Indirect call to absolute memory address |
| 6EF7 | 631E3AFC | .text | CALL [static] | Indirect call to absolute memory address |
| 6F06 | 631E3AFC | .text | CALL [static] | Indirect call to absolute memory address |
| 162A18 | 261A0 | .CRT | TLS Callback | Pointer to 630A61A0 - 0x255A0 .text |
| 162A1C | 26150 | .CRT | TLS Callback | Pointer to 630A6150 - 0x25550 .text |
| 162A20 | 33550 | .CRT | TLS Callback | Pointer to 630B3550 - 0x32950 .text |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 615958 | 42,3756% |
| Null Byte Code | 656845 | 45,1885% |
| NOP Cave Found | 0x9090909090 | Block Count: 209 | Total: 0,0359% |
© 2026 All rights reserved.