PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 188,00 KBSHA-256 Hash: F6FE01ED965C00C0D9CFCF5059FC06FD009CB100512135A731812F9A03DA79DF SHA-1 Hash: 2E4F6799532215C30116C76F007A7D827C90101F MD5 Hash: BD681F5970878D2078CF1C17B8F34028 Imphash: 9A9430FD50C973A696F7CF43618A2D22 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 000312AB EntryPoint (rva): 1000 SizeOfHeaders: 200 SizeOfImage: 74000 ImageBase: 400000 Architecture: x86 ImportTable: 7288C Characteristics: 10F TimeDateStamp: 41FC91C5 Date: 30/01/2005 7:50:29 File Type: EXE Number Of Sections: 2 ASLR: Disabled Section Names: .text, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI [Incomplete Binary or Compressor Packer - 276,00 KB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0xE0000020 Code Executable Readable Writeable |
200 | 26000 | 1000 | 6A000 |
|
|
| .rsrc | 0xE0000020 Code Executable Readable Writeable |
26200 | 8E00 | 6B000 | 9000 |
|
|
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 200 Code -> B8483B47005064FF35000000006489250000000033C089085045436F6D70616374320035115278A8CAF5F5B1B344A3C284B2 Assembler |MOV EAX, 0X473B48 |PUSH EAX |PUSH DWORD PTR FS:[0] |MOV DWORD PTR FS:[0], ESP |XOR EAX, EAX |MOV DWORD PTR [EAX], ECX |PUSH EAX |INC EBP |INC EBX |OUTSD DX, DWORD PTR [ESI] |INSD DWORD PTR ES:[EDI], DX |JO 0X401080 |ARPL WORD PTR [EDX + ESI], SI |XOR EAX, 0XA8785211 |RETF 0XF5F5 |MOV CL, 0XB3 |INC ESP |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: packer: PECompact(2.98.04)[-] • PE: linker: Microsoft Linker(5.0)[-] • Entropy: 7.8186 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| File Access |
| OLEAUT32.dll ole32.dll oledlg.dll COMCTL32.dll SHELL32.dll ADVAPI32.dll comdlg32.dll GDI32.dll USER32.dll WINMM.dll kernel32.dll |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Entry Point | Hex Pattern | PECompact 2.0x Heuristic Mode - Jeremy Collake |
| Entry Point | Hex Pattern | PeCompact 2.53 DLL - BitSum Technologies |
| Entry Point | Hex Pattern | PECompact 2.x - Jeremy Collake |
| Entry Point | Hex Pattern | PECompact v2.0 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1024 | 6B310 | 668 | 26510 | 2800000030000000600000000100040000000000000000000000000000000000000000000000000000000000000080000080 | (...0............................................ |
| \ICON\2\1024 | 6B978 | 2E8 | 26B78 | 2800000020000000400000000100040000000000000000000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\3\1024 | 6BC60 | 1E8 | 26E60 | 2800000018000000300000000100040000000000000000000000000000000000000000000000000000000000000080000080 | (.......0......................................... |
| \ICON\4\1024 | 6BE48 | 128 | 27048 | 2800000010000000200000000100040000000000000000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\5\1024 | 6BF70 | EA8 | 27170 | 2800000030000000600000000100080000000000000000000000000000000000000000000000000000000000FFFFFF000000 | (...0............................................ |
| \ICON\6\1024 | 6CE18 | 8A8 | 28018 | 2800000020000000400000000100080000000000000000000000000000000000000000000000000000000000FFFFFF000000 | (... ...@......................................... |
| \ICON\7\1024 | 6D6C0 | 6C8 | 288C0 | 2800000018000000300000000100080000000000000000000000000000000000000000000000000000000000FFFFFF000000 | (.......0......................................... |
| \ICON\8\1024 | 6DD88 | 568 | 28F88 | 2800000010000000200000000100080000000000000000000000000000000000000000000000000000000000FFFFFF000000 | (....... ......................................... |
| \ICON\9\1024 | 6E2F0 | 25A8 | 294F0 | 2800000030000000600000000100200000000000000000000000000000000000000000000000000000000000000000000000 | (...0........ ................................... |
| \ICON\10\1024 | 70898 | 10A8 | 2BA98 | 2800000020000000400000000100200000000000000000000000000000000000000000000000000000000000FFFFFF0FFFFF | (... ...@..... ................................... |
| \ICON\11\1024 | 71940 | 988 | 2CB40 | 2800000018000000300000000100200000000000000000000000000000000000000000000000000000000000FFFFFF5FFFFF | (.......0..... ................................_.. |
| \ICON\12\1024 | 722C8 | 468 | 2D4C8 | 28000000100000002000000001002000000000000000000000000000000000000000000000000000FFFFFF2FFFFFFFDFFFFF | (....... ..... ............................/...... |
| \RCDATA\A6F2D1FB\1024 | 63000 | ED | 62200 | 28000000100000002000000001002000000000000000000000000000000000000000000000000000FFFFFF2FFFFFFFDFFFFF | (....... ..... ............................/...... |
| \GROUP_ICON\101\1024 | 72730 | AE | 2D930 | 000001000C0030301000010004006806000001002020100001000400E802000002001818100001000400E801000003001010 | ......00......h..... ............................ |
| Intelligent String |
| • kernel32.dll • WINMM.dll • USER32.dll • GDI32.dll • comdlg32.dll • WINSPOOL.DRV • ADVAPI32.dll • SHELL32.dll • COMCTL32.dll • oledlg.dll • ole32.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 28EA | 1C110F5A | .text | JMP [static] | Indirect jump to absolute memory address |
| B9CA | 65477F2C | .text | CALL [static] | Indirect call to absolute memory address |
| E1F4 | 47D2EDED | .text | JMP [static] | Indirect jump to absolute memory address |
| E584 | 47D2EDED | .text | CALL [static] | Indirect call to absolute memory address |
| 165AC | 47D2EDED | .text | JMP [static] | Indirect jump to absolute memory address |
| 1CC6A | 48014D19 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FBE9 | 3DDC95D | .text | JMP [static] | Indirect jump to absolute memory address |
| 20158 | 5C95133C | .text | CALL [static] | Indirect call to absolute memory address |
| 296AF | 7FF9D30 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 29783 | 15FFAF33 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 29787 | 16FFAF34 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2979B | 15FFB134 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2979F | 15FFB034 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 297A3 | 14FFB034 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 29837 | 18FFBE37 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 298EF | 19FFCB39 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2990F | 25FFCF47 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 29913 | 24FFCE47 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 299BB | 28FFD749 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 29ABB | 23FFE251 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 29CA3 | 1DFFDE3D | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 29E27 | 2DFFE04A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2A00F | 22FFEA59 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2A123 | 32FFE04A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2A33B | 14FFDD44 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2A4C3 | 11FFC83C | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2A647 | DFFB536 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2A707 | EFFB537 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2A877 | 25FFE04F | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2A87B | 23FFDB4E | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2A93F | 20FFD24A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2A9D3 | 23FFE34F | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2AA93 | 24FFE24D | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2AB57 | 24FFE24C | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2B0C3 | 1CFFC345 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2B3BF | 1DFFCF47 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2B3C7 | BFFAE33 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2B603 | EFFBE37 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2B74F | 25FFE04B | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2B753 | 25FFE04A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2B757 | 25FFE04A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2B75B | 25FFE04A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2B75F | 20FFE04A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2BBFB | 13FFB837 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2BC5F | 25FFCE46 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2BC63 | 24FFCE47 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2BCFF | 22FFDF50 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2BD4F | 2BFFDF4A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2BF47 | 33FFE04A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2BFC3 | 29FFDE3E | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2C393 | 22FFE450 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2C3AF | 1DFFD34A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2C637 | 1DFFD34A | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2C8AF | 18FFD047 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2CC8F | 1EFFD63C | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2D023 | 21FFE451 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2D093 | 28FFE34F | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2D3EF | 1FFFE04A | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 2D597 | DFFE047 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 2D723 | 1DFFDE4E | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 26200-2EFFF | 6B000 | .rsrc | Executable section anomaly, first bytes: 00000000C591FC41 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 123183 | 63,9872% |
| Null Byte Code | 8061 | 4,1873% |
© 2026 All rights reserved.