PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 54,51 KB SHA-256 Hash: 312428AF38F9ECFAF684FD2BCB8FFDDE2FE4AD639D86232A1F4611F39E606726 SHA-1 Hash: A370D08FEFA924ED0BBFB6D25EBF4560E508CE34 MD5 Hash: AB2E273AF41D9AEF88AE9CE31DAF0895 Imphash: 66F8EE0FDF8E871E7EFB81695FD6BF2A MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00011B3B EntryPoint (rva): 13F0 SizeOfHeaders: 600 SizeOfImage: 13000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 8000 IAT: 8290 Characteristics: 26 TimeDateStamp: 6A6E4B5A Date: 01/08/2026 19:39:06 File Type: DLL Number Of Sections: 16 ASLR: Disabled Section Names (Optional Header): .text, .data, .rdata, .pdata, .xdata, .bss, .idata, .tls, .reloc, /4, /19, /31, /45, /57, /70, /81 Number Of Executable Sections: 1 Subsystem: Windows Console [Incomplete Binary or Compressor Packer - 21,49 KB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
600 | 1C00 | 1000 | 1A10 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
2200 | 200 | 3000 | 100 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
2400 | 800 | 4000 | 618 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
2C00 | 400 | 5000 | 27C |
|
|
| .xdata | 0x40000040 Initialized Data Readable |
3000 | 200 | 6000 | 1F0 |
|
|
| .bss | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 0 | 7000 | 180 |
|
|
| .idata | 0x40000040 Initialized Data Readable |
3200 | A00 | 8000 | 96C |
|
|
| .tls | 0xC0000040 Initialized Data Readable Writeable |
3C00 | 200 | 9000 | 10 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
3E00 | 200 | A000 | 88 |
|
|
| /4 | 0x42000040 Initialized Data GP-Relative Readable |
4000 | 200 | B000 | 50 |
|
|
| /19 | 0x42000040 Initialized Data GP-Relative Readable |
4200 | 1200 | C000 | 1064 |
|
|
| /31 | 0x42000040 Initialized Data GP-Relative Readable |
5400 | 200 | E000 | AF |
|
|
| /45 | 0x42000040 Initialized Data GP-Relative Readable |
5600 | 200 | F000 | A4 |
|
|
| /57 | 0x42000040 Initialized Data GP-Relative Readable |
5800 | 200 | 10000 | 48 |
|
|
| /70 | 0x42000040 Initialized Data GP-Relative Readable |
5A00 | 200 | 11000 | A3 |
|
|
| /81 | 0x42000040 Initialized Data GP-Relative Readable |
5C00 | 200 | 12000 | 1F8 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 9F0 Code -> 4883EC28488B0525300000C70000000000E87AFDFFFF90904883C428C30F1F004883EC28E8271300004883F80119C04883C4 Assembler |SUB RSP, 0X28 |MOV RAX, QWORD PTR [RIP + 0X3025] |MOV DWORD PTR [RAX], 0 |CALL 0X140001180 |NOP |NOP |ADD RSP, 0X28 |RET |NOP DWORD PTR [RAX] |SUB RSP, 0X28 |CALL 0X140002740 |CMP RAX, 1 |SBB EAX, EAX |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • Entropy: 4.4823 |
| File Access |
| api-ms-win-crt-time-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-private-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-environment-l1-1-0.dll KERNEL32.dll .dat |
| Interest's Words |
| exec start expand |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Stealth (VirtualProtect) |
| Entry Point | Hex Pattern | ASProtect vx.x |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Intelligent String |
| • .bss • @.bss • @.tls • KERNEL32.dll • api-ms-win-crt-environment-l1-1-0.dll • api-ms-win-crt-heap-l1-1-0.dll • api-ms-win-crt-math-l1-1-0.dll • api-ms-win-crt-private-l1-1-0.dll • api-ms-win-crt-runtime-l1-1-0.dll • api-ms-win-crt-string-l1-1-0.dll • api-ms-win-crt-time-l1-1-0.dll • C:/buildroot/src/gcc-14.2.0/libgcc/config/i386\cygwin.SC:\buildroot\x86_64-1420-win32-seh-ucrt-rt_v12-rev2\build\gcc-14.2.0\x86_64-w64-mingw32\libgccGNU AS 2.42 • .tls |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 82B | N/A | .text | CALL QWORD PTR [RIP+0x7087] |
| E7B | N/A | .text | CALL QWORD PTR [RIP+0x6A57] |
| EDE | N/A | .text | CALL QWORD PTR [RIP+0x69EC] |
| EE8 | N/A | .text | CALL QWORD PTR [RIP+0x69B2] |
| 14D4 | N/A | .text | CALL QWORD PTR [RIP+0x63BE] |
| 152A | N/A | .text | JMP QWORD PTR [RIP+0x6380] |
| 1577 | N/A | .text | CALL QWORD PTR [RIP+0x631B] |
| 1592 | N/A | .text | CALL QWORD PTR [RIP+0x6318] |
| 15CA | N/A | .text | CALL QWORD PTR [RIP+0x62C8] |
| 1606 | N/A | .text | CALL QWORD PTR [RIP+0x62A4] |
| 16E5 | N/A | .text | CALL QWORD PTR [RIP+0x61A5] |
| 1717 | N/A | .text | CALL QWORD PTR [RIP+0x618B] |
| 1E80 | N/A | .text | JMP QWORD PTR [RIP+0x5BAA] |
| 1E88 | N/A | .text | JMP QWORD PTR [RIP+0x5BAA] |
| 1E90 | N/A | .text | JMP QWORD PTR [RIP+0x5BAA] |
| 1EA0 | N/A | .text | JMP QWORD PTR [RIP+0x5B72] |
| 1EA8 | N/A | .text | JMP QWORD PTR [RIP+0x5B72] |
| 1EB0 | N/A | .text | JMP QWORD PTR [RIP+0x5B2A] |
| 1EB8 | N/A | .text | JMP QWORD PTR [RIP+0x5B2A] |
| 1EC0 | N/A | .text | JMP QWORD PTR [RIP+0x5B2A] |
| 1EC8 | N/A | .text | JMP QWORD PTR [RIP+0x5B2A] |
| 1ED0 | N/A | .text | JMP QWORD PTR [RIP+0x5B2A] |
| 1ED8 | N/A | .text | JMP QWORD PTR [RIP+0x5B2A] |
| 1EE0 | N/A | .text | JMP QWORD PTR [RIP+0x5A6A] |
| 1EE8 | N/A | .text | JMP QWORD PTR [RIP+0x5A6A] |
| 1EF0 | N/A | .text | JMP QWORD PTR [RIP+0x5A6A] |
| 1EF8 | N/A | .text | JMP QWORD PTR [RIP+0x5A6A] |
| 1F00 | N/A | .text | JMP QWORD PTR [RIP+0x5A6A] |
| 1F08 | N/A | .text | JMP QWORD PTR [RIP+0x5A6A] |
| 1F10 | N/A | .text | JMP QWORD PTR [RIP+0x5A6A] |
| 1F18 | N/A | .text | JMP QWORD PTR [RIP+0x5A6A] |
| 1F20 | N/A | .text | JMP QWORD PTR [RIP+0x5A72] |
| 1F28 | N/A | .text | JMP QWORD PTR [RIP+0x5A72] |
| 1F30 | N/A | .text | JMP QWORD PTR [RIP+0x5A72] |
| 1F38 | N/A | .text | JMP QWORD PTR [RIP+0x5A72] |
| 1F40 | N/A | .text | JMP QWORD PTR [RIP+0x5A72] |
| 1F48 | N/A | .text | JMP QWORD PTR [RIP+0x5A72] |
| 1F50 | N/A | .text | JMP QWORD PTR [RIP+0x5A7A] |
| 1F60 | N/A | .text | JMP QWORD PTR [RIP+0x59D2] |
| 1F68 | N/A | .text | JMP QWORD PTR [RIP+0x59D2] |
| 1F70 | N/A | .text | JMP QWORD PTR [RIP+0x59B2] |
| 1F80 | N/A | .text | JMP QWORD PTR [RIP+0x597A] |
| 1F88 | N/A | .text | JMP QWORD PTR [RIP+0x597A] |
| 1F90 | N/A | .text | JMP QWORD PTR [RIP+0x597A] |
| 1F98 | N/A | .text | JMP QWORD PTR [RIP+0x597A] |
| 1FA0 | N/A | .text | JMP QWORD PTR [RIP+0x5942] |
| 1FA8 | N/A | .text | JMP QWORD PTR [RIP+0x5942] |
| 1FB0 | N/A | .text | JMP QWORD PTR [RIP+0x5922] |
| 1FB8 | N/A | .text | JMP QWORD PTR [RIP+0x5912] |
| 1FC0 | N/A | .text | JMP QWORD PTR [RIP+0x5902] |
| 1FC8 | N/A | .text | JMP QWORD PTR [RIP+0x58F2] |
| 1FD0 | N/A | .text | JMP QWORD PTR [RIP+0x58E2] |
| 1FD8 | N/A | .text | JMP QWORD PTR [RIP+0x58D2] |
| 1FE0 | N/A | .text | JMP QWORD PTR [RIP+0x58C2] |
| 1FE8 | N/A | .text | JMP QWORD PTR [RIP+0x58B2] |
| 1FF0 | N/A | .text | JMP QWORD PTR [RIP+0x58A2] |
| 1FF8 | N/A | .text | JMP QWORD PTR [RIP+0x5892] |
| BAD4 | N/A | *padding* | CALL QWORD PTR [RIP+0x30000] |
| 1722-173F | N/A | .text | Unusual NOPS Space, count: 30 |
| 29F0 | 1400015B0 | .rdata | TLS Callback | Pointer to 15B0 - 0xBB0 .text |
| 29F8 | 140001580 | .rdata | TLS Callback | Pointer to 1580 - 0xB80 .text |
| 2C00 | 140001000 | .pdata | ExceptionHook | Pointer to 1000 - 0x600 .text + UnwindInfo: .xdata |
| 2C0C | 140001010 | .pdata | ExceptionHook | Pointer to 1010 - 0x610 .text + UnwindInfo: .xdata |
| 2C18 | 140001130 | .pdata | ExceptionHook | Pointer to 1130 - 0x730 .text + UnwindInfo: .xdata |
| 2C24 | 140001180 | .pdata | ExceptionHook | Pointer to 1180 - 0x780 .text + UnwindInfo: .xdata |
| 2C30 | 1400013D0 | .pdata | ExceptionHook | Pointer to 13D0 - 0x9D0 .text + UnwindInfo: .xdata |
| 2C3C | 1400013F0 | .pdata | ExceptionHook | Pointer to 13F0 - 0x9F0 .text + UnwindInfo: .xdata |
| 2C48 | 140001410 | .pdata | ExceptionHook | Pointer to 1410 - 0xA10 .text + UnwindInfo: .xdata |
| 2C54 | 140001430 | .pdata | ExceptionHook | Pointer to 1430 - 0xA30 .text + UnwindInfo: .xdata |
| 2C60 | 140001440 | .pdata | ExceptionHook | Pointer to 1440 - 0xA40 .text + UnwindInfo: .xdata |
| 2C6C | 140001450 | .pdata | ExceptionHook | Pointer to 1450 - 0xA50 .text + UnwindInfo: .xdata |
| 2C78 | 140001490 | .pdata | ExceptionHook | Pointer to 1490 - 0xA90 .text + UnwindInfo: .xdata |
| 2C84 | 1400014D0 | .pdata | ExceptionHook | Pointer to 14D0 - 0xAD0 .text + UnwindInfo: .xdata |
| 2C90 | 140001550 | .pdata | ExceptionHook | Pointer to 1550 - 0xB50 .text + UnwindInfo: .xdata |
| 2C9C | 140001570 | .pdata | ExceptionHook | Pointer to 1570 - 0xB70 .text + UnwindInfo: .xdata |
| 2CA8 | 140001580 | .pdata | ExceptionHook | Pointer to 1580 - 0xB80 .text + UnwindInfo: .xdata |
| 2CB4 | 1400015B0 | .pdata | ExceptionHook | Pointer to 15B0 - 0xBB0 .text + UnwindInfo: .xdata |
| 2CC0 | 140001640 | .pdata | ExceptionHook | Pointer to 1640 - 0xC40 .text + UnwindInfo: .xdata |
| 2CCC | 140001650 | .pdata | ExceptionHook | Pointer to 1650 - 0xC50 .text + UnwindInfo: .xdata |
| 2CD8 | 140001750 | .pdata | ExceptionHook | Pointer to 1750 - 0xD50 .text + UnwindInfo: .xdata |
| 2CE4 | 140001760 | .pdata | ExceptionHook | Pointer to 1760 - 0xD60 .text + UnwindInfo: .xdata |
| 2CF0 | 1400017D0 | .pdata | ExceptionHook | Pointer to 17D0 - 0xDD0 .text + UnwindInfo: .xdata |
| 2CFC | 140001940 | .pdata | ExceptionHook | Pointer to 1940 - 0xF40 .text + UnwindInfo: .xdata |
| 2D08 | 140001CB0 | .pdata | ExceptionHook | Pointer to 1CB0 - 0x12B0 .text + UnwindInfo: .xdata |
| 2D14 | 140001CF0 | .pdata | ExceptionHook | Pointer to 1CF0 - 0x12F0 .text + UnwindInfo: .xdata |
| 2D20 | 140001D00 | .pdata | ExceptionHook | Pointer to 1D00 - 0x1300 .text + UnwindInfo: .xdata |
| 2D2C | 140001EC0 | .pdata | ExceptionHook | Pointer to 1EC0 - 0x14C0 .text + UnwindInfo: .xdata |
| 2D38 | 140001F30 | .pdata | ExceptionHook | Pointer to 1F30 - 0x1530 .text + UnwindInfo: .xdata |
| 2D44 | 140001FA0 | .pdata | ExceptionHook | Pointer to 1FA0 - 0x15A0 .text + UnwindInfo: .xdata |
| 2D50 | 140002030 | .pdata | ExceptionHook | Pointer to 2030 - 0x1630 .text + UnwindInfo: .xdata |
| 2D5C | 140002140 | .pdata | ExceptionHook | Pointer to 2140 - 0x1740 .text + UnwindInfo: .xdata |
| 2D68 | 140002150 | .pdata | ExceptionHook | Pointer to 2150 - 0x1750 .text + UnwindInfo: .xdata |
| 2D74 | 140002160 | .pdata | ExceptionHook | Pointer to 2160 - 0x1760 .text + UnwindInfo: .xdata |
| 2D80 | 140002190 | .pdata | ExceptionHook | Pointer to 2190 - 0x1790 .text + UnwindInfo: .xdata |
| 2D8C | 1400021E0 | .pdata | ExceptionHook | Pointer to 21E0 - 0x17E0 .text + UnwindInfo: .xdata |
| 2D98 | 140002280 | .pdata | ExceptionHook | Pointer to 2280 - 0x1880 .text + UnwindInfo: .xdata |
| 2DA4 | 140002300 | .pdata | ExceptionHook | Pointer to 2300 - 0x1900 .text + UnwindInfo: .xdata |
| 2DB0 | 140002340 | .pdata | ExceptionHook | Pointer to 2340 - 0x1940 .text + UnwindInfo: .xdata |
| 2DBC | 1400023C0 | .pdata | ExceptionHook | Pointer to 23C0 - 0x19C0 .text + UnwindInfo: .xdata |
| 2DC8 | 140002400 | .pdata | ExceptionHook | Pointer to 2400 - 0x1A00 .text + UnwindInfo: .xdata |
| 2DD4 | 140002490 | .pdata | ExceptionHook | Pointer to 2490 - 0x1A90 .text + UnwindInfo: .xdata |
| 2DE0 | 1400025A0 | .pdata | ExceptionHook | Pointer to 25A0 - 0x1BA0 .text + UnwindInfo: .xdata |
| 2DEC | 1400025C0 | .pdata | ExceptionHook | Pointer to 25C0 - 0x1BC0 .text + UnwindInfo: .xdata |
| 2DF8 | 140002610 | .pdata | ExceptionHook | Pointer to 2610 - 0x1C10 .text + UnwindInfo: .xdata |
| 2E04 | 140002650 | .pdata | ExceptionHook | Pointer to 2650 - 0x1C50 .text + UnwindInfo: .xdata |
| 2E10 | 140002660 | .pdata | ExceptionHook | Pointer to 2660 - 0x1C60 .text + UnwindInfo: .xdata |
| 2E1C | 1400026D0 | .pdata | ExceptionHook | Pointer to 26D0 - 0x1CD0 .text + UnwindInfo: .xdata |
| 2E28 | 140002740 | .pdata | ExceptionHook | Pointer to 2740 - 0x1D40 .text + UnwindInfo: .xdata |
| 2E34 | 140002760 | .pdata | ExceptionHook | Pointer to 2760 - 0x1D60 .text + UnwindInfo: .xdata |
| 2E40 | 140002780 | .pdata | ExceptionHook | Pointer to 2780 - 0x1D80 .text + UnwindInfo: .xdata |
| 2E4C | 1400027C0 | .pdata | ExceptionHook | Pointer to 27C0 - 0x1DC0 .text + UnwindInfo: .xdata |
| 2E58 | 140002800 | .pdata | ExceptionHook | Pointer to 2800 - 0x1E00 .text + UnwindInfo: .xdata |
| 2E64 | 140002840 | .pdata | ExceptionHook | Pointer to 2840 - 0x1E40 .text + UnwindInfo: .xdata |
| 2E70 | 140002A00 | .pdata | ExceptionHook | Pointer to 2A00 - 0x2000 .text + UnwindInfo: .xdata |
| 5E00 | N/A | *Overlay* | 2E66696C650000004D000000FEFF000067016372 | .file...M.......g.cr |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 24915 | 44,6345% |
| Null Byte Code | 25653 | 45,9566% |
| NOP Cave Found | 0x9090909090 | Block Count: 34 | Total: 0,1523% |
© 2026 All rights reserved.