PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 1,91 MB SHA-256 Hash: 1AE50E3AFA78B7C76CDA2C59001BA9E6E2C49E0F57F03D63FB4D90CDF1C873E4 SHA-1 Hash: 3C77C32C66FAE79560A959F8689EF65AE7D02B96 MD5 Hash: A1C3A7C7EBBC1367517E68B1BDE56830 Imphash: B854D78513D09F7E4CCACE75B47E26D1 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 72D238 SizeOfHeaders: 400 SizeOfImage: 72F000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 596020 Characteristics: 22 TimeDateStamp: 69DD3ED3 Date: 13/04/2026 19:06:59 File Type: EXE Number Of Sections: 9 ASLR: Disabled Section Names (Optional Header): *unnamed*, *unnamed*, *unnamed*, *unnamed*, *unnamed*, *unnamed*, .rsrc, *unnamed*, *unnamed* Number Of Executable Sections: 8 Subsystem: Windows Console UAC Execution Level Manifest: asInvoker [Incomplete Binary or Compressor Packer - 5,27 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| *unnamed* | 0xE0000040 Initialized Data Executable Readable Writeable |
400 | C00 | 1000 | 2000 |
|
|
| *unnamed* | 0xE0000040 Initialized Data Executable Readable Writeable |
1000 | 400 | 3000 | 2000 |
|
|
| *unnamed* | 0xE0000040 Initialized Data Executable Readable Writeable |
1400 | 200 | 5000 | 1000 |
|
|
| *unnamed* | 0xE0000040 Initialized Data Executable Readable Writeable |
1600 | 0 | 6000 | 1000 |
|
|
| *unnamed* | 0xE0000040 Initialized Data Executable Readable Writeable |
1600 | 0 | 7000 | 1000 |
|
|
| *unnamed* | 0xE0000040 Initialized Data Executable Readable Writeable |
1600 | 200 | 8000 | 1000 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1800 | 200 | 9000 | 1000 |
|
|
| *unnamed* | 0xE0000040 Initialized Data Executable Readable Writeable |
1A00 | 4C400 | A000 | 589000 |
|
|
| *unnamed* | 0xE0000040 Initialized Data Executable Readable Writeable |
4DE00 | 19BA00 | 593000 | 19C000 |
|
|
| Entry Point |
The section number (9) have the Entry Point Information -> EntryPoint (calculated) - 1E8038 Code -> EB0800DE0400000000005051525355565741504151415241534154415541564157489C4881EC080000000FAE1C24E8000000 Assembler |JMP 0X14072D242 |ADD DH, BL |ADD AL, 0 |ADD BYTE PTR [RAX], AL |ADD BYTE PTR [RAX], AL |PUSH RAX |PUSH RCX |PUSH RDX |PUSH RBX |PUSH RBP |PUSH RSI |PUSH RDI |PUSH R8 |PUSH R9 |PUSH R10 |PUSH R11 |PUSH R12 |PUSH R13 |PUSH R14 |PUSH R15 |PUSHFQ |SUB RSP, 8 |STMXCSR DWORD PTR [RSP] |
| Signatures |
| Rich Signature Analyzer: Code -> 7002B1FB3463DFA83463DFA83463DFA83D1B4CA83E63DFA88009DEA93663DFA88009DAA92663DFA88009DBA93E63DFA88009DCA93663DFA82008DEA93763DFA83463DEA80E63DFA84008D6A93563DFA8400820A83563DFA84008DDA93563DFA8526963683463DFA8 Footprint md5 Hash -> BE94E30477B779D4A480E8829CBE542E • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is not signed |
| Duplicate Sections |
| Section *unnamed* duplicate 8 times |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): linker: Microsoft Linker(14.20, Visual Studio 2019 16.0*)[-] • Entropy: 7.9343 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| File Access |
| api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll VCRUNTIME140.dll ole32.dll version.dll shell32.dll gdi32.dll oleaut32.dll advapi32.dll user32.dll kernel32.dll |
| Interest's Words |
| exec |
| URLs |
| http://pki-crl.symauth.com/ca_732b6ec148d290c0a071efd1dac8e288/LatestCRL.crl http://pki-ocsp.symauth.com http://pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.crl |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\1\1033 | 9058 | 17D | 1858 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • w.CRW |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| EA59 | N/A | *unnamed* | CALL QWORD PTR [RIP+0xCE256E40] |
| 13AF8 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x816D3C07] |
| 14EF8 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x5B826B7D] |
| 15E92 | N/A | *unnamed* | CALL QWORD PTR [RIP+0xA9049A5D] |
| 1881E | N/A | *unnamed* | CALL QWORD PTR [RIP+0x13033139] |
| 19A88 | N/A | *unnamed* | JMP QWORD PTR [RIP+0xFF535CC7] |
| 2222B | N/A | *unnamed* | JMP QWORD PTR [RIP+0x7E0D5569] |
| 23D4A | N/A | *unnamed* | JMP QWORD PTR [RIP+0xC9CDE40F] |
| 26CA7 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x266B6E5D] |
| 2A176 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x2AC43D0] |
| 2F2D0 | N/A | *unnamed* | CALL QWORD PTR [RIP+0xC3D96B73] |
| 419F7 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x1C014EE7] |
| 46AD1 | N/A | *unnamed* | JMP QWORD PTR [RIP+0xD201A070] |
| 47BF0 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x6F9E8C33] |
| 4D995 | N/A | *unnamed* | CALL QWORD PTR [RIP+0xDCA6E7B5] |
| 51426 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x4A21C422] |
| 79982 | N/A | *unnamed* | JMP QWORD PTR [RIP+0xA227C28D] |
| 7C532 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x105C044F] |
| 87AF4 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x4A40F2D6] |
| 87D25 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x7BE90603] |
| 97E36 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x70CFBD59] |
| 9A4CC | N/A | *unnamed* | CALL QWORD PTR [RIP+0xB4C72848] |
| AF589 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x8DF61ADE] |
| BEE56 | N/A | *unnamed* | CALL QWORD PTR [RIP+0xFBF725BB] |
| D75C1 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x6AFA4037] |
| F2045 | N/A | *unnamed* | CALL QWORD PTR [RIP+0xCDA41A60] |
| 100F51 | N/A | *unnamed* | CALL QWORD PTR [RIP+0xAC8F5D8A] |
| 10842D | N/A | *unnamed* | CALL QWORD PTR [RIP+0xB71C89A2] |
| 115A76 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x38B9574] |
| 124AED | N/A | *unnamed* | CALL QWORD PTR [RIP+0xD83C287D] |
| 125A12 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x518A61BF] |
| 12F716 | N/A | *unnamed* | JMP QWORD PTR [RIP+0xAAFEE575] |
| 12F849 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x2E45C52E] |
| 132335 | N/A | *unnamed* | JMP QWORD PTR [RIP+0xD8970287] |
| 13CDDD | N/A | *unnamed* | CALL QWORD PTR [RIP+0x870C997B] |
| 13CF9D | N/A | *unnamed* | CALL QWORD PTR [RIP+0xB6A7EDE2] |
| 13E2AF | N/A | *unnamed* | CALL QWORD PTR [RIP+0xE2B1A350] |
| 142196 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x6AB76C3E] |
| 143C26 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x728F9B95] |
| 14C10E | N/A | *unnamed* | JMP QWORD PTR [RIP+0x8984AD16] |
| 14F1B1 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x5FE81FF1] |
| 15A9F6 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x7811A843] |
| 169B9D | N/A | *unnamed* | JMP QWORD PTR [RIP+0xAA91F496] |
| 16BCC9 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x1371B10C] |
| 172D75 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x4E9C1C1C] |
| 1840DD | N/A | *unnamed* | CALL QWORD PTR [RIP+0x41F3F2DE] |
| 18AF8D | N/A | *unnamed* | JMP QWORD PTR [RIP+0xCA0F3147] |
| 1995A4 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x6A32DB0E] |
| 19AF2B | N/A | *unnamed* | JMP QWORD PTR [RIP+0xDC402951] |
| 1AE831 | N/A | *unnamed* | CALL QWORD PTR [RIP+0xD18D8628] |
| 1B48E9 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x2E39B017] |
| 1BC34A | N/A | *unnamed* | JMP QWORD PTR [RIP+0xC3517CE4] |
| 1BFD34 | N/A | *unnamed* | JMP QWORD PTR [RIP+0xFD21E529] |
| 1C7F46 | N/A | *unnamed* | CALL QWORD PTR [RIP+0x1BAF5D6E] |
| 1D070A | N/A | *unnamed* | JMP QWORD PTR [RIP+0x1D504EF4] |
| 1D933F | N/A | *unnamed* | CALL QWORD PTR [RIP+0xC658C681] |
| 1D9B84 | N/A | *unnamed* | JMP QWORD PTR [RIP+0xD79530EB] |
| 1DE1F6 | N/A | *unnamed* | JMP QWORD PTR [RIP+0x79289D1B] |
| 400-FFF | 1000 | *unnamed* | Executable section anomaly, first bytes: 03A1B4058D6B334B |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1358760 | 67,7688% |
| Null Byte Code | 60464 | 3,0157% |
© 2026 All rights reserved.