PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Icon: Icon
Size: 802,50 KB
SHA-256 Hash: 21F6F42282198DD5D031D5A6044FBAC051CE73C3788B724872D4763714830415
SHA-1 Hash: 6F773925B546C0E5FF76B7EF29D0671033B53CFE
MD5 Hash: 9CD16366CA3486523FCBBDA63BC8C16B
Imphash: F34D5F2D4577ED6D9CEEC516C1F5A744
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): B6C92
SizeOfHeaders: 200
SizeOfImage: CE000
ImageBase: 0000000000400000
Architecture: x64
ImportTable: B6C38
IAT: 2000
Characteristics: 2E
TimeDateStamp: 63053A5B
Date: 23/08/2022 20:36:43
File Type: DLL
Number Of Sections: 3
ASLR: Disabled
Section Names (Optional Header): .text, .rsrc, .reloc
Number Of Executable Sections: 0
Subsystem: Windows GUI
UAC Execution Level Manifest: asInvoker
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 200 B4E00 2000 B4C9E
6.2725
9264775.92
.rsrc
0x40000040
Initialized Data
Readable
 B5000 13800 B8000 1361C
3.2932
5739108.78
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 C8800 200 CC000 C
0.1019
128015
Description
OriginalFilename: sfvip player.exe
LegalCopyright: Copyright 2020 salezli
ProductName: sfvip player
FileVersion: 1.2.5.7
FileDescription: sfvip player
ProductVersion: 1.2.5.7
Comments: Free sfvip player - Watch IPTV channels based on popular mpv player
Language: Unknown (ID=0x0)
CodePage: Unicode (UTF-16 LE) (0x4B0)
Entry Point
The section number (1) have the Entry Point
Information -> EntryPoint (calculated) - B4E92
Code -> 48A10020400000000000FFE00000000000000000000000000000000000000000000000000000000000000000000000000000
Assembler
|MOVABS RAX, QWORD PTR [0X402000]
|JMP RAX
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
Signatures
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Compiler: Microsoft Visual .NET - (You can use a decompiler for this...)
• AnyCPU: False
• Version: v4.0
Detect It Easy (die)
• PE+(64): library: .NET(v4.0.30319)[-]
• PE+(64): linker: Microsoft Linker(6.0)[-]
• Entropy: 6.08343
File Access
sfvip player.exe
mscoree.dll
mpv-2.dll
.Sys
sfvip_player.Classes.Dat
System.Windows.Dat
.System.Windows.Controls.Dat
+System.Windows.Controls.Dat
/System.Windows.Controls.Dat
&System.Windows.Controls.Dat
System.Windows.Controls.Dat
)libthemes.Helpers.Dat
%libthemes.Helpers.Dat
sfvip_player.Log
Temp
File Access (UNICODE)
sfvip player.exe
Interest's Words
PADDINGX
BitCoin
PassWord
<head
<button
<link
<title
<header
<main
exec
attrib
start
pause
shutdown
systeminfo
ping
replace
route
URLs
http://schemas.microsoft.com/winfx/2006/xaml
http://schemas.microsoft.com/winfx/2006/xaml/presentation
http://IP:PORT/c/
http://IP:PORT
http://IP:PORT/get.php?username
http://IP:PORT/playlist?deviceUser
http://IP:PORT/playlist?deviceMac
http://fontforge.sf.net)
http://www.keshikan.net
http://www.keshikan.net),
http://scripts.sil.org/OFL
http://127.0.0.1:3128
http://.
https://www.php.net/manual/en/timezones.europe.php?
https://www.php.net/manual/en/timezones.europe.php
https://serbianforum.org/forums/internet-radio-i-tv.386/?
https://choosealicense.com/licenses/isc/?
https://choosealicense.com/licenses/mit/?
https://github.com/mpv-player/mpvlicense?
URLs (UNICODE)
http://fontforge.sf.net)
http://www.keshikan.net
http://scripts.sil.org/OFL
IP Addresses
127.0.0.1
14.0.0.0
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii WinAPI Sockets (connect)
Text Ascii WinAPI Sockets (send)
Text Ascii File (GetTempPath)
Text Ascii Encryption (FromBase64String)
Text Ascii Execution (ShellExecute)
Text Ascii Keyboard Key (Scroll)
Text Ascii Keyboard Key (RightArrow)
Text Ascii Keyboard Key (Backspace)
Text Ascii Keyboard Key (Ctrl+D)
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ 8.0
Entry Point Hex Pattern TrueVision Targa Graphics format
Resources
Path DataRVA Size FileOffset CodeText
\ICON\1\0 B8220 1772 B5220 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000017394944415478DAED5DCD711BC9D2.PNG........IHDR.............\r.f...9IDATx..].q...
\ICON\2\0 B9994 94A8 B6994 2800000060000000C00000000100200000000000000000000000000000000000000000000000000000000000000000000000(............ ...................................
\ICON\3\0 C2E3C 4228 BFE3C 2800000040000000800000000100200000000000000000000000000000000000000000000000000000000000000000000000(...@......... ...................................
\ICON\4\0 C7064 25A8 C4064 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000(...0........ ...................................
\ICON\5\0 C960C 10A8 C660C 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000(... ...@..... ...................................
\ICON\6\0 CA6B4 988 C76B4 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000(.......0..... ...................................
\GROUP_ICON\32512\0 CB03C 5A C803C 00000100060000000000010020007217000001006060000001002000A8940000020040400000010020002842000003003030000001002000A825000004002020000001002000A810000005001818000001002000880900000600............ .r......... .......@@.... .(B....00.... ..%.... .... ............. .......
\VERSION\1\0 CB098 3D0 C8098 D00334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000200..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\24\1\0 CB468 1B4 C8468 EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D227574662D3822207374616E64616C6F6E65...<?xml version="1.0" encoding="utf-8" standalone
Intelligent String
• 1.2.5.7
• sfvip player.exe
• http://scripts.sil.org/OFL
• with FontForge 2.0 (http://fontforge.sf.net)
• Csfvip player, Version=1.2.5.7, Culture=neutral, PublicKeyToken=nullE'clr-namespace:sfvip_player.Controls.Epgsfvip_player.Controls.Epg
• http://schemas.microsoft.com/winfx/2006/xaml/presentation
• RNWindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35WSPresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\XPresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35RNSystem.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089?llli11,http://schemas.microsoft.com/winfx/2006/xaml
• $|vExample:
• http://IP:PORT/get.php?username
• http://IP:PORT/playlist?deviceUser
• http://www.keshikan.net
• KeyboardUserInfo KeyboardToggleClockInfo KeyboardToggleInterlacing KeyboardToggleStreamInfo KeyboardTogglePlaylist KeyboardPlay KeyboardPauseResume KeyboardStop KeyboardVolume KeyboardToggleMute KeyboardTogglePiP KeyboardToggleFullscreen KeyboardEsc KeyboardScreenshot KeyboardFrame KeyboardPlaylistUpDown KeyboardBackspace KeyboardResetFilters KeyboardContrast KeyboardBrightness KeyboardSaturation KeyboardHue KeyboardSubtitleDownloader !KeyboardSubtitleSize "KeyboardSubtitleMove KeyboardSubtitleStep $KeyboardSubtitleDelay %KeyboardSubtitleResetDelay?llli11,http://schemas.microsoft.com/winfx/2006/xaml
• https://serbianforum.org/forums/internet-radio-i-tv.386/?.$SerbianForum.-
• E'clr-namespace:sfvip_player.Controls.Epgsfvip_player.Controls.Epg
• _CorExeMainmscoree.dll
Flow Anomalies
Offset RVA Section Description
671A2 N/A .text JMP QWORD PTR [RIP+0x71B16963]
77883 N/A .text CALL QWORD PTR [RIP+0x7265764F]
8C3B0 N/A .text JMP QWORD PTR [RIP+0x440047]
8C42E N/A .text JMP QWORD PTR [RIP+0x55005E]
8D4DC N/A .text JMP QWORD PTR [RIP+0x13F0047]
8D576 N/A .text JMP QWORD PTR [RIP+0x151005E]
Extra Analysis
Metric Value Percentage
Ascii Code 482020 58,657%
Null Byte Code 196814 23,9503%
© 2026 All rights reserved.