PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 84,50 KB SHA-256 Hash: 94C4B3EBFB335A8E715F6AE9765278932F4300F34EE7168B9A5B4FCD2B9BC685 SHA-1 Hash: F9C8ADB9891C704AA36F60AFDD3C0A17274F446F MD5 Hash: B20E1A2E82FB3573778A9456C665188C Imphash: 12D25CDDDE8C4943E2A5758893CEE804 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 3F13 SizeOfHeaders: 400 SizeOfImage: 19000 ImageBase: 10000000 Architecture: x86 ExportTable: 13D00 ImportTable: 13E18 IAT: E000 Characteristics: 2102 TimeDateStamp: 6978B269 Date: 27/01/2026 12:41:13 File Type: DLL Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows Console UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | CC00 | 1000 | CBD8 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
D000 | 6600 | E000 | 6444 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
13600 | A00 | 15000 | 1390 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
14000 | 200 | 17000 | 1E0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
14200 | 1000 | 18000 | FBC |
|
|
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 3313 Code -> 558BEC837D0C017505E890050000FF7510FF750CFF7508E8AEFEFFFF83C40C5DC20C00558BECF6450801568BF1C70648E600 Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X10003F21 |CALL 0X100044B1 |PUSH DWORD PTR [EBP + 0X10] |PUSH DWORD PTR [EBP + 0XC] |PUSH DWORD PTR [EBP + 8] |CALL 0X10003DDD |ADD ESP, 0XC |POP EBP |RET 0XC |PUSH EBP |MOV EBP, ESP |TEST BYTE PTR [EBP + 8], 1 |PUSH ESI |MOV ESI, ECX |
| Signatures |
| Rich Signature Analyzer: Code -> 563639CB1257579812575798125757987731549918575798773152999A5757987731539900575798402253991D5757984022549900575798402252993457579877315699115757981257569846575798D022529910575798D022579913575798D022A89813575798D0225599135757985269636812575798 Footprint md5 Hash -> AF20D273654208194681B953B0B03F3A • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: linker: Microsoft Linker(14.29**)[-] • Entropy: 6.2944 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| ET Functions (carving) |
| Original Name -> plugin.dll brand_free_buffer brand_get_value brand_group_mutex_name brand_has_value brand_registry_root brand_set_value brand_window_class brand_window_title |
| Windows REG |
| SOFTWARE\DaciaAutomotive\Toolbox4 |
| File Access |
| KERNEL32.dll plugin.dll .dat @.dat resources/preinstalled_resources.txt |
| File Access (UNICODE) |
| mscoree.dll kernel32.dll api-ms-win-core-synch-l1-2-0.dll |
| Interest's Words |
| exec start |
| URLs |
| https://zippy.naviextras.com/services/index/rest https://zippy.naviextras.com/services/selfie/rest/1/update |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 17060 | 17D | 14060 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • https://zippy.naviextras.com/services/index/rest • naviextras.com • appnameresources/preinstalled_resources.txt • https://zippy.naviextras.com/services/selfie/rest/1/update • api-ms-win-core-synch-l1-2-0.dll • kernel32.dll • mscoree.dll • .tls • .bss |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 2BCB | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E21 | 1000E00C | .text | CALL [static] | Indirect call to absolute memory address |
| 2E2C | 1000E024 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E3D | 1000E024 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E4F | 1000E028 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E5D | 1000E028 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E80 | 1000E020 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E9C | 1000E010 | .text | CALL [static] | Indirect call to absolute memory address |
| 2EAC | 1000E000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2EBD | 1000E004 | .text | CALL [static] | Indirect call to absolute memory address |
| 2EF0 | 1000E008 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F08 | 1000E004 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F45 | 1000E008 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F61 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F71 | 1000E014 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F7D | 1000E018 | .text | CALL [static] | Indirect call to absolute memory address |
| 2FA2 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 2FB2 | 1000E008 | .text | CALL [static] | Indirect call to absolute memory address |
| 2FC3 | 1000E01C | .text | CALL [static] | Indirect call to absolute memory address |
| 2FCA | 1000E004 | .text | CALL [static] | Indirect call to absolute memory address |
| 30F3 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 3306 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 33D0 | 1000E030 | .text | CALL [static] | Indirect call to absolute memory address |
| 33D9 | 1000E02C | .text | CALL [static] | Indirect call to absolute memory address |
| 33E4 | 1000E034 | .text | CALL [static] | Indirect call to absolute memory address |
| 33EB | 1000E038 | .text | CALL [static] | Indirect call to absolute memory address |
| 33FE | 1000E03C | .text | CALL [static] | Indirect call to absolute memory address |
| 3503 | 1000E03C | .text | CALL [static] | Indirect call to absolute memory address |
| 36DA | 1000E03C | .text | CALL [static] | Indirect call to absolute memory address |
| 37A6 | 1000E040 | .text | CALL [static] | Indirect call to absolute memory address |
| 37C6 | 1000E030 | .text | CALL [static] | Indirect call to absolute memory address |
| 37D0 | 1000E02C | .text | CALL [static] | Indirect call to absolute memory address |
| 3876 | 1000E054 | .text | CALL [static] | Indirect call to absolute memory address |
| 3885 | 1000E050 | .text | CALL [static] | Indirect call to absolute memory address |
| 388E | 1000E04C | .text | CALL [static] | Indirect call to absolute memory address |
| 389B | 1000E048 | .text | CALL [static] | Indirect call to absolute memory address |
| 3907 | 1000E058 | .text | CALL [static] | Indirect call to absolute memory address |
| 3962 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 398E | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FE2 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4012 | 1000E05C | .text | CALL [static] | Indirect call to absolute memory address |
| 41CC | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 42A7 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4490 | 1000E060 | .text | CALL [static] | Indirect call to absolute memory address |
| 451B | 1000E064 | .text | CALL [static] | Indirect call to absolute memory address |
| 4594 | 1000E068 | .text | CALL [static] | Indirect call to absolute memory address |
| 463F | 1000E010 | .text | CALL [static] | Indirect call to absolute memory address |
| 479F | 1000E06C | .text | CALL [static] | Indirect call to absolute memory address |
| 482B | 1000E084 | .text | CALL [static] | Indirect call to absolute memory address |
| 4837 | 1000E064 | .text | CALL [static] | Indirect call to absolute memory address |
| 485E | 1000E084 | .text | CALL [static] | Indirect call to absolute memory address |
| 4887 | 1000E080 | .text | CALL [static] | Indirect call to absolute memory address |
| 48C2 | 1000E028 | .text | CALL [static] | Indirect call to absolute memory address |
| 4902 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 490F | 1000E070 | .text | JMP [static] | Indirect jump to absolute memory address |
| 493D | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4947 | 1000E07C | .text | CALL [static] | Indirect call to absolute memory address |
| 4978 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4982 | 1000E074 | .text | CALL [static] | Indirect call to absolute memory address |
| 49B6 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 49C0 | 1000E078 | .text | CALL [static] | Indirect call to absolute memory address |
| 49F7 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4A07 | 1000E00C | .text | CALL [static] | Indirect call to absolute memory address |
| 4B38 | 1000E040 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B42 | 1000E030 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B4F | 1000E02C | .text | CALL [static] | Indirect call to absolute memory address |
| 4BB4 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4C1D | 1000E03C | .text | CALL [static] | Indirect call to absolute memory address |
| 4C40 | 1000E034 | .text | CALL [static] | Indirect call to absolute memory address |
| 4C47 | 1000E038 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CCE | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E89 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E9F | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 4F4E | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 506A | 1000E034 | .text | CALL [static] | Indirect call to absolute memory address |
| 5071 | 1000E038 | .text | CALL [static] | Indirect call to absolute memory address |
| 5083 | 1000E088 | .text | CALL [static] | Indirect call to absolute memory address |
| 508C | 1000E024 | .text | CALL [static] | Indirect call to absolute memory address |
| 50E2 | 1000E08C | .text | CALL [static] | Indirect call to absolute memory address |
| 50F5 | 1000E028 | .text | CALL [static] | Indirect call to absolute memory address |
| 5106 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 5118 | 1000E080 | .text | CALL [static] | Indirect call to absolute memory address |
| 55CE | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 58B1 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 5B58 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 5B84 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 5BD9 | 1000E114 | .text | CALL [static] | Indirect call to absolute memory address |
| 5C13 | 1000E03C | .text | CALL [static] | Indirect call to absolute memory address |
| 60ED | 1000E064 | .text | CALL [static] | Indirect call to absolute memory address |
| 618B | 1000E068 | .text | CALL [static] | Indirect call to absolute memory address |
| 6244 | 1000E064 | .text | CALL [static] | Indirect call to absolute memory address |
| 62E2 | 1000E068 | .text | CALL [static] | Indirect call to absolute memory address |
| 6416 | 1000E004 | .text | CALL [static] | Indirect call to absolute memory address |
| 6436 | 1000E010 | .text | CALL [static] | Indirect call to absolute memory address |
| 645E | 1000E008 | .text | CALL [static] | Indirect call to absolute memory address |
| 6498 | 1000E094 | .text | CALL [static] | Indirect call to absolute memory address |
| 6528 | 1000E094 | .text | CALL [static] | Indirect call to absolute memory address |
| 655A | 1000E098 | .text | CALL [static] | Indirect call to absolute memory address |
| 656C | 1000E064 | .text | CALL [static] | Indirect call to absolute memory address |
| 65FA | 1000E064 | .text | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 48180 | 55,6814% |
| Null Byte Code | 19172 | 22,157% |
© 2026 All rights reserved.