PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 4,17 MB SHA-256 Hash: F698F7919B026700CC2A2A9166258B8770AB9412122207F7B955FB97D249B8B9 SHA-1 Hash: 45FA87DD72C6AC9B8819B21838BF69165B72F809 MD5 Hash: A0C487A2DDC4074675DFFEB708AC4EBF Imphash: 846C60B7415E38D769A8B7A0468ED919 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00432F9D EntryPoint (rva): 13B0 SizeOfHeaders: 400 SizeOfImage: 433000 ImageBase: 70F00000 Architecture: x86 ExportTable: 324000 ImportTable: 325000 IAT: 3250F0 Characteristics: 230E TimeDateStamp: 6A4BC0F8 Date: 06/07/2026 14:51:36 File Type: DLL Number Of Sections: 9 ASLR: Enabled Section Names: .text, .data, .rdata, .bss, .edata, .idata, .CRT, .tls, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60600060 Code Initialized Data Executable Readable |
400 | 47600 | 1000 | 47544 |
|
|
| .data | 0xC0600040 Initialized Data Readable Writeable |
47A00 | 2D8400 | 49000 | 2D82A0 |
|
|
| .rdata | 0x40600040 Initialized Data Readable |
31FE00 | 1000 | 322000 | E98 |
|
|
| .bss | 0xC0600080 Uninitialized Data Readable Writeable |
0 | 0 | 323000 | A30 |
|
|
| .edata | 0x40300040 Initialized Data Readable |
320E00 | 200 | 324000 | 46 |
|
|
| .idata | 0xC0300040 Initialized Data Readable Writeable |
321000 | 600 | 325000 | 4C8 |
|
|
| .CRT | 0xC0300040 Initialized Data Readable Writeable |
321600 | 200 | 326000 | 2C |
|
|
| .tls | 0xC0300040 Initialized Data Readable Writeable |
321800 | 200 | 327000 | 8 |
|
|
| .reloc | 0x42300040 Initialized Data GP-Relative Readable |
321A00 | 10AE00 | 328000 | 10AD1C |
|
|
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 7B0 Code -> 83EC0CC7052C302271000000008B4C24188B5424148B442410E852FEFFFF83C40CC20C008DB426000000008D7426009083EC Assembler |SUB ESP, 0XC |MOV DWORD PTR [0X7122302C], 0 |MOV ECX, DWORD PTR [ESP + 0X18] |MOV EDX, DWORD PTR [ESP + 0X14] |MOV EAX, DWORD PTR [ESP + 0X10] |CALL 0XE70 |ADD ESP, 0XC |RET 0XC |LEA ESI, [ESI] |LEA ESI, [ESI] |NOP |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: MinGW(GCC: (GNU) 10.3.0)[-] • PE: linker: GNU linker ld (GNU Binutils)(2.36)[-] • Entropy: 5.00442 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| ET Functions (carving) |
| Original Name -> payload.dll gaseq33 |
| File Access |
| msvcrt.dll KERNEL32.dll payload.dll .dat |
| File Access (UNICODE) |
| msvcrt.dll |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Intelligent String |
| • @@.bss • .CRT • .tls • msvcrt.dll • P2KERNEL32.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 457 | 7122511C | .text | CALL [static] | Indirect call to absolute memory address |
| 4100B | 71225130 | .text | CALL [static] | Indirect call to absolute memory address |
| 41073 | 7122512C | .text | CALL [static] | Indirect call to absolute memory address |
| 41080 | 71225100 | .text | CALL [static] | Indirect call to absolute memory address |
| 4134E | 712250FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4139C | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 413F2 | 712250FC | .text | CALL [static] | Indirect call to absolute memory address |
| 41410 | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 41457 | 712250FC | .text | CALL [static] | Indirect call to absolute memory address |
| 41497 | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4156C | 712250F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 41597 | 7122510C | .text | CALL [static] | Indirect call to absolute memory address |
| 419CC | 71225128 | .text | JMP [static] | Indirect jump to absolute memory address |
| 419D4 | 71225120 | .text | JMP [static] | Indirect jump to absolute memory address |
| 419DC | 7122511C | .text | JMP [static] | Indirect jump to absolute memory address |
| 419E4 | 712250F4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 419EC | 712250F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 45E28 | 712250FC | .text | CALL [static] | Indirect call to absolute memory address |
| 45F38 | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 45FF7 | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4617D | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 46441 | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 464D9 | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 46B90 | 7122519C | .text | JMP [static] | Indirect jump to absolute memory address |
| 46B98 | 71225198 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BA0 | 71225194 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BA8 | 71225190 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BB0 | 7122518C | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BB8 | 7122517C | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BC0 | 71225178 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BC8 | 71225174 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BD0 | 71225170 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BD8 | 7122516C | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BE0 | 71225168 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BE8 | 71225164 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BF0 | 71225160 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46BF8 | 71225158 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46C00 | 71225148 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46C08 | 71225144 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46C10 | 71225140 | .text | JMP [static] | Indirect jump to absolute memory address |
| 46C72 | 71225110 | .text | CALL [static] | Indirect call to absolute memory address |
| 46CB5 | 71225118 | .text | CALL [static] | Indirect call to absolute memory address |
| 46D6B | 71225118 | .text | CALL [static] | Indirect call to absolute memory address |
| 47193 | 71225134 | .text | CALL [static] | Indirect call to absolute memory address |
| 4736E | 712250FC | .text | CALL [static] | Indirect call to absolute memory address |
| 473DE | 71225114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4748C | 71225104 | .text | CALL [static] | Indirect call to absolute memory address |
| 47500 | 70F4904C | .text | JMP [static] | Indirect jump to absolute memory address |
| 47510 | 71225188 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47518 | 71225184 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47520 | 71225180 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47528 | 7122515C | .text | JMP [static] | Indirect jump to absolute memory address |
| 47530 | 71225154 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47538 | 71225150 | .text | JMP [static] | Indirect jump to absolute memory address |
| 477D5 | 712250F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 477F2 | 712250F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 47802 | 71225120 | .text | CALL [static] | Indirect call to absolute memory address |
| 47831 | 71225128 | .text | CALL [static] | Indirect call to absolute memory address |
| 47855 | 7122511C | .text | CALL [static] | Indirect call to absolute memory address |
| 478C9 | 70F4903C | .text | CALL [static] | Indirect call to absolute memory address |
| 47905 | 7122511C | .text | CALL [static] | Indirect call to absolute memory address |
| 321618 | 41A70 | .CRT | TLS Callback | Pointer to 70F41A70 - 0x40E70 .text |
| 32161C | 41A20 | .CRT | TLS Callback | Pointer to 70F41A20 - 0x40E20 .text |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 2943775 | 67,2621% |
| Null Byte Code | 1091831 | 24,9472% |
| NOP Cave Found | 0x9090909090 | Block Count: 35 | Total: 0,002% |
© 2026 All rights reserved.