PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Icon: Icon
Size: 1,08 MB
SHA-256 Hash: 5F765B67F4083B0D2B1705D9D4C07F1B51177A4C2280180DAB1D18563BE88C5F
SHA-1 Hash: D1FA2492B6AD51E50E11520DDDA17D4300476B24
MD5 Hash: BACBA93E72ED75851A55A9B97D57CFFD
Imphash: F34D5F2D4577ED6D9CEEC516C1F5A744
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): 101AC2
SizeOfHeaders: 200
SizeOfImage: 118000
ImageBase: 0000000000400000
Architecture: x64
ImportTable: 101A68
IAT: 2000
Characteristics: 2E
TimeDateStamp: 60103D7A
Date: 26/01/2021 16:04:10
File Type: DLL
Number Of Sections: 3
ASLR: Disabled
Section Names (Optional Header): .text, .rsrc, .reloc
Number Of Executable Sections: 0
Subsystem: Windows GUI
UAC Execution Level Manifest: asInvoker
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 200 FFC00 2000 FFACE
6.1867
13963158.38
.rsrc
0x40000040
Initialized Data
Readable
 FFE00 13600 102000 135A4
3.257
5761871.1
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 113400 200 116000 C
0.098
128016
Description
OriginalFilename: sfvip player.exe
LegalCopyright: Copyright salezli 2020
ProductName: sfvip player
FileVersion: 1.2.1.33
FileDescription: sfvip player
ProductVersion: 1.2.1.33
Language: Unknown (ID=0x0)
CodePage: Unicode (UTF-16 LE) (0x4B0)
Entry Point
The section number (1) have the Entry Point
Information -> EntryPoint (calculated) - FFCC2
Code -> 48A10020400000000000FFE00000000000000000000000000000000000000000000000000000000000000000000000000000
Assembler
|MOVABS RAX, QWORD PTR [0X402000]
|JMP RAX
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
|ADD BYTE PTR [RAX], AL
Signatures
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Compiler: Microsoft Visual .NET - (You can use a decompiler for this...)
• AnyCPU: False
• Version: v4.0
Detect It Easy (die)
• PE+(64): library: .NET(v4.0.30319)[-]
• PE+(64): linker: Microsoft Linker(6.0)[-]
• Entropy: 6.06288
File Access
sfvip player.exe
mscoree.dll
kernel32.dll
user32.dll
,,,/Themes/Controls.Scr
.Sys
System.Windows.Dat
.Dat
System.Windows.Controls.Dat
4System.Windows.Controls.Primitives.Dat
ASystem.Windows.Controls.Primitives.Dat
1System.Windows.Controls.Dat
$System.Windows.Controls.Dat
System.Windows.Controls.Dat
7System.Windows.Controls.Primitives.Dat
,,,/Themes/Controls.Dat
.System.Windows.Controls.Dat
+System.Windows.Controls.Dat
&System.Windows.Controls.Dat
,sfvip_player.Helpers.Dat
(sfvip_player.Helpers.Dat
Temp
File Access (UNICODE)
sfvip player.exe
Interest's Words
PADDINGX
BitCoin
PassWord
<head
<button
<link
<title
<header
<main
exec
attrib
start
pause
shutdown
ping
replace
route
Interest's Words (UNICODE)
PassWord
start
URLs
http://schemas.microsoft.com/winfx/2006/xaml
http://schemas.microsoft.com/winfx/2006/xaml/presentation
http://IP:PORT/c/
http://IP:PORT/c/
http://IP:PORT/server/
http://IP:PORT/stalker_portal/
http://IP:PORT
http://IP:PORT/get.php?username
http://IP:PORT/playlist?deviceUser
http://IP:PORT/playlist?deviceMac
http://fontforge.sf.net)
http://www.keshikan.net
http://www.keshikan.net),
http://scripts.sil.org/OFL
https://www.php.net/manual/en/timezones.europe.php?
https://www.php.net/manual/en/timezones.europe.php
https://serbianforum.org/forums/internet-radio-i-tv.386/?
https://choosealicense.com/licenses/isc/?
https://choosealicense.com/licenses/mit/?
https://github.com/mpv-player/mpvlicense?
URLs (UNICODE)
http://fontforge.sf.net)
http://www.keshikan.net
http://scripts.sil.org/OFL
IP Addresses
1.2.1.33
14.0.0.0
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii WinAPI Sockets (connect)
Text Ascii WinAPI Sockets (send)
Text Ascii File (GetTempPath)
Text Ascii Execution (ShellExecute)
Text Ascii Keyboard Key (Scroll)
Text Ascii Keyboard Key (DownArrow)
Text Ascii Keyboard Key (RightArrow)
Text Ascii Keyboard Key (UpArrow)
Text Ascii Keyboard Key (PageDown)
Text Ascii Keyboard Key (PageUp)
Text Ascii Keyboard Key (Backspace)
Text Ascii Keyboard Key (Ctrl+D)
Text Ascii Malicious rerouting of traffic to an attacker-controlled site (Redirect)
Text Ascii Technique used to capture communications between systems (Intercept)
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ 8.0
Entry Point Hex Pattern TrueVision Targa Graphics format
Resources
Path DataRVA Size FileOffset CodeText
\ICON\1\0 102220 1772 100020 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000017394944415478DAED5DCD711BC9D2.PNG........IHDR.............\r.f...9IDATx..].q...
\ICON\2\0 103994 94A8 101794 2800000060000000C00000000100200000000000000000000000000000000000000000000000000000000000000000000000(............ ...................................
\ICON\3\0 10CE3C 4228 10AC3C 2800000040000000800000000100200000000000000000000000000000000000000000000000000000000000000000000000(...@......... ...................................
\ICON\4\0 111064 25A8 10EE64 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000(...0........ ...................................
\ICON\5\0 11360C 10A8 11140C 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000000000000000(... ...@..... ...................................
\ICON\6\0 1146B4 988 1124B4 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000000000000000(.......0..... ...................................
\GROUP_ICON\32512\0 11503C 5A 112E3C 00000100060000000000010020007217000001006060000001002000A8940000020040400000010020002842000003003030000001002000A825000004002020000001002000A810000005001818000001002000880900000600............ .r......... .......@@.... .(B....00.... ..%.... .... ............. .......
\VERSION\1\0 115098 356 112E98 560334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000200V.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\24\1\0 1153F0 1B4 1131F0 EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D227574662D3822207374616E64616C6F6E65...<?xml version="1.0" encoding="utf-8" standalone
Intelligent String
• 1.2.1.33
• sfvip player.exe
• http://schemas.microsoft.com/winfx/2006/xaml/presentation
• http://schemas.microsoft.com/winfx/2006/xaml
• "ListBoxItemSelectedForegroundBrush &"ListBoxItemSelectedBackgroundBrush "ListBoxItemSelectedBorderBrush>lii1l,http://schemas.microsoft.com/winfx/2006/xaml
• ListBoxItemBorderBrush &"ListBoxItemSelectedForegroundBrush &"ListBoxItemSelectedBackgroundBrush "ListBoxItemSelectedBorderBrush>lii1l,http://schemas.microsoft.com/winfx/2006/xaml
• RNWindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35WSPresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\XPresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35RNSystem.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089>lii1l,http://schemas.microsoft.com/winfx/2006/xaml
• http://scripts.sil.org/OFL
• with FontForge 2.0 (http://fontforge.sf.net)
• RNWindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35WSPresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\XPresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35RNSystem.Xaml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089>lii1l,http://schemas.microsoft.com/winfx/2006/xaml
• $wqEnter the Portal Address.
• http://IP:PORT/c/
• http://IP:PORT/server/
• Enter the Portal Address.
• http://IP:PORT/get.php?username
• http://IP:PORT/playlist?deviceUser
• http://www.keshikan.net
• https://serbianforum.org/forums/internet-radio-i-tv.386/?.$SerbianForum.-
• NamePaddingJOpacityMaskConverterParameterConverterElementNamePathRelativeSource>lii1l,http://schemas.microsoft.com/winfx/2006/xaml
• MetroButtonTextBox?BasedOn ChromelessButtonTemplate SearchMetroTextBox@JClipAStretch>lii1l,http://schemas.microsoft.com/winfx/2006/xaml
• appbar_hue )appbar_reload *appbar_equalizer +appbar_folder ,appbar_search -appbar_exit .appbar_reveal /appbar_reveal_hide 0appbar_bitcoin 1appbar_bitcointext 2appbar_find 3appbar_download 4appbar_playlistshow>lii1l,http://schemas.microsoft.com/winfx/2006/xaml
• _CorExeMainmscoree.dll
Flow Anomalies
Offset RVA Section Description
45874 N/A .text CALL QWORD PTR [RIP+0x6C727443]
492B5 N/A .text CALL QWORD PTR [RIP+0x20646441]
671A1 N/A .text JMP QWORD PTR [RIP+0x71B16963]
869F6 N/A .text CALL QWORD PTR [RIP+0x7265764F]
8DA7D N/A .text CALL QWORD PTR [RIP+0x7265764F]
8EBE8 N/A .text CALL QWORD PTR [RIP+0x7265764F]
8EC99 N/A .text CALL QWORD PTR [RIP+0x7265764F]
8F6F3 N/A .text CALL QWORD PTR [RIP+0x7265764F]
B71AA N/A .text CALL QWORD PTR [RIP+0xE8B0000]
DBFCF-DC122 N/A .text Potential obfuscated jump sequence detected, count: 170
E050F-E0568 N/A .text Potential obfuscated jump sequence detected, count: 45
Extra Analysis
Metric Value Percentage
Ascii Code 679631 60,2544%
Null Byte Code 269935 23,9318%
© 2026 All rights reserved.