PREMIUM PESCAN.IO - Analysis Report

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 260,50 KB
SHA-256 Hash: 4F9821E06FA12ADD46BD2D26EB49EDD0D714986BAB0C282029E7002611EE1EA7
SHA-1 Hash: 24DDB460569D5F9BB3E03597088C4D995DC0DE8A
MD5 Hash: BF6FD70D618AA2255597491E680246EE
Imphash: DAE02F32A21E03CE65412F6E56942DAA
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): 41C3E
SizeOfHeaders: 200
SizeOfImage: 46000
ImageBase: 10000000
Architecture: x86
ImportTable: 41BEC
IAT: 2000
Characteristics: 2102
TimeDateStamp: 6AE1BB71
Date: 28/10/2026 9:08:01
File Type: DLL
Number Of Sections: 3
ASLR: Enabled
Section Names: .text, .rsrc, .reloc
Number Of Executable Sections: 1
Subsystem: Windows Console
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 200 3FE00 2000 3FC50
6.1752
3230088.21
.rsrc
0x40000040
Initialized Data
Readable
 40000 1000 42000 FEC
5.0396
56218.13
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
 41000 200 44000 C
0.1019
128015
Description
OriginalFilename: DotSetup.dll
LegalCopyright: Copyright
ProductName: DotSetup
FileVersion: 4.53.2.1
ProductVersion: 4.53.2.1
Language: Unknown (ID=0x0)
CodePage: Unicode (UTF-16 LE) (0x4B0)
Entry Point
The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - 3FE3E
Code -> FF2500200010000000002000470048007A000000000000000000000000000000000000000000000000000000000000000000
Assembler
|JMP DWORD PTR [0X10002000]
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|AND BYTE PTR [EAX], AL
|INC EDI
|ADD BYTE PTR [EAX], CL
|JP 0X10041C50
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
|ADD BYTE PTR [EAX], AL
Signatures
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Compiler: Microsoft Visual .NET - (You can use a decompiler for this...)
• AnyCPU: False
• Version: v4.0
Detect It Easy (die)
• PE: library: .NET(v4.0.30319)[-]
• PE: compiler: VB.NET(-)[-]
• PE: linker: Microsoft Linker(48.0)[-]
• Entropy: 6.15955
Suspicious Functions
Library Function Description
KERNEL32.DLL LoadLibraryW Loads the specified module into the address space of the calling process.
KERNEL32.DLL CreateToolhelp32Snapshot Creates a snapshot of the specified processes, heaps, threads, and modules.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL CloseHandle Closes an open object handle.
KERNEL32.DLL GetVersion Retrieves the operating system version.
Windows REG (UNICODE)
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
System\CentralProcessor\0
File Access
mscoree.dll
DotSetup.dll
ntdll.dll
powrprof.dll
user32.dll
Shell32.dll
kernel32.dll
advapi32.dll
wtsapi32.dll
Temp
ProgramFiles
AppData
UserProfile
File Access (UNICODE)
DotSetup.dll
kernel32.dll
MsftEdit.dll
iSwitch.Sys
dotsetup-ci.log
Temp
Interest's Words
<button
<title
<main
exec
unescape
attrib
start
shutdown
systeminfo
ping
expand
replace
Interest's Words (UNICODE)
<main
exec
shell.application
attrib
start
route
URLs
http://www.w3.org/2001/XMLSchema
http://schemas.microsoft.com/SMI/2005/WindowsSettings
https://d1ex533g6avnxs.cloudfront.net</CDN
IP Addresses
17.0.0.0
15.9.0.0
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii Encryption (FromBase64String)
Text Ascii Encryption (ToBase64String)
Text Ascii Keyboard Key (LBUTTON)
Text Ascii Keyboard Key (Scroll)
Text Ascii Software that records user activity (Logger)
Text Ascii Unauthorized movement of funds or data (Transfer)
Text Ascii Malicious rerouting of traffic to an attacker-controlled site (Redirect)
Entry Point Hex Pattern Gem VDI Image graphics file
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ 8.0
Entry Point Hex Pattern TrueVision Targa Graphics format
Resources
Path DataRVA Size FileOffset CodeText
\VERSION\1\0 42090 306 40090 060334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001003500..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O.............5.
\24\2\0 423A8 C40 403A8 EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D227574662D38223F3E0D0A3C617373656D62...<?xml version="1.0" encoding="utf-8"?>..<assemb
Intelligent String
• 4.53.2.1
• DotSetup.dll
• MsftEdit.dll
• 7remote_response_example.xml
• response_schema.xsd
• }DotSetup.Professional.RemoteConfig.remote_response_example.xml
• wDotSetup.Professional.RemoteConfig.remote_response_demo.xml
• .ico
• .zip
• .exe
• %Global\_MSIExecute
• .xml
• dotsetup-ci.log
• /yyyy-MM-dd HH:mm:ss.fff
• .ttf
• .msi
• kernel32.dll
• <xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema" elementFormDefault="qualified">
• <CDN>https://d1ex533g6avnxs.cloudfront.net</CDN>
• _CorDllMainmscoree.dll
• <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
Flow Anomalies
Offset FlowVA Section Description
3FE3E 10002000 .text JMP [static] | Indirect jump to absolute memory address
Extra Analysis
Metric Value Percentage
Ascii Code 174923 65,5751%
Null Byte Code 55779 20,9104%
© 2026 All rights reserved.