PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 5,46 MBSHA-256 Hash: D53EDC7EDE03FA5EAA241F9F0513AC1D4E6E5C55DAA31111833478F8ED8BF5E7 SHA-1 Hash: 2DA1A52573E29B6C1AEF52ED4AB492E238C1039C MD5 Hash: C703AC852178E0B319BC0941A3AECAA2 Imphash: 9636E0E07239870014DBDEBCB5D2EC29 MajorOSVersion: 5 MinorOSVersion: 2 CheckSum: 0057F38C EntryPoint (rva): 912058 SizeOfHeaders: 400 SizeOfImage: DEB000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 12E104 Characteristics: 22 TimeDateStamp: 6900BA45 Date: 28/10/2025 12:42:45 File Type: EXE Number Of Sections: 10 ASLR: Disabled Section Names (Optional Header): (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20), (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20), (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20), (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20), (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20), (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20), .idata, .rsrc, .Baymax, .boot Number Of Executable Sections: 3 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator [Incomplete Binary or Compressor Packer - 8,46 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | 0x60000020 Code Executable Readable |
400 | 58E00 | 1000 | CC79E |
|
|
| (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | 0x40000040 Initialized Data Readable |
59200 | 13200 | CE000 | 30956 |
|
|
| (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | 0xC0000040 Initialized Data Readable Writeable |
6C400 | E00 | FF000 | 5678 |
|
|
| (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | 0x40000040 Initialized Data Readable |
6D200 | 7400 | 105000 | C6C0 |
|
|
| (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | 0x40000040 Initialized Data Readable |
74600 | 15A00 | 112000 | 193D8 |
|
|
| (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | 0x40000040 Initialized Data Readable |
8A000 | 600 | 12C000 | 1268 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
8A600 | 400 | 12E000 | 1000 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
8AA00 | 12400 | 12F000 | 12400 |
|
|
| .Baymax | 0xE0000060 Code Initialized Data Executable Readable Writeable |
9CE00 | 0 | 142000 | 7D0000 |
|
|
| .boot | 0x60000060 Code Initialized Data Executable Readable |
9CE00 | 4D8800 | 912000 | 4D8800 |
|
|
| Description |
| OriginalFilename: Baymax64.exe LegalCopyright: Copyright 2015 ProductName: Baymax64 FileVersion: 3, 0, 1, 1013 FileDescription: Baymax Patch Tools x64 ProductVersion: 3, 0, 1, 1013 Comments: Www.ChinaPYG.CoM Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) Unusual Chars Found In Description File - (Polymorphic patterns or unicode characters) |
| Entry Point |
The section number (10) have the Entry Point Information -> EntryPoint (calculated) - 9CE58 Code -> E88201000041524989E24152498B7210498B7A20FCB2808A0648FFC6880748FFC7BB0200000000D275078A1648FFC610D273 Assembler |CALL 0X1409121DF |PUSH R10 |MOV R10, RSP |PUSH R10 |MOV RSI, QWORD PTR [R10 + 0X10] |MOV RDI, QWORD PTR [R10 + 0X20] |CLD |MOV DL, 0X80 |MOV AL, BYTE PTR [RSI] |INC RSI |MOV BYTE PTR [RDI], AL |INC RDI |MOV EBX, 2 |ADD DL, DL |JNE 0X140912089 |MOV DL, BYTE PTR [RSI] |INC RSI |ADC DL, DL |
| Signatures |
| Rich Signature Analyzer: Code -> 2768E3DA63098D8963098D8963098D896A71188972098D89FC01F68961098D8944CFE08960098D8944CF0D8962098D8944CFF68976098D8963098C8948088D896A710E89AF098D896A71098900098D897D5B198962098D896A711C8962098D895269636863098D89 Footprint md5 Hash -> 3AEAD2E78BE82D1A69D4F8BA8275B4E1 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Duplicate Sections |
| Section (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) duplicate 6 times |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(2008)[-] • PE+(64): linker: Microsoft Linker(9.0)[-] • Entropy: 7.96241 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| File Access |
| COMCTL32.dll SHLWAPI.dll OLEAUT32.dll ole32.dll SHELL32.dll ADVAPI32.dll COMDLG32.dll GDI32.dll USER32.dll kernel32.dll |
| File Access (UNICODE) |
| Baymax64.exe |
| Interest's Words |
| exec |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 12F258 | 668 | 8AC58 | 2800000030000000600000000100040000000000800400000000000000000000000000000000000000000000000080000080 | (...0............................................ |
| \ICON\2\1033 | 12F8D0 | 2E8 | 8B2D0 | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\3\1033 | 12FBC8 | 128 | 8B5C8 | 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \ICON\4\1033 | 12FD00 | EA8 | 8B700 | 280000003000000060000000010008000000000000090000000000000000000000010000000100000000000052453F005856 | (...0......................................RE?.XV |
| \ICON\5\1033 | 130BB8 | 8A8 | 8C5B8 | 28000000200000004000000001000800000000000004000000000000000000000001000000010000000000007A6A5C007C6C | (... ...@...................................zj\.|l |
| \ICON\6\1033 | 131470 | 568 | 8CE70 | 2800000010000000200000000100080000000000000100000000000000000000000100000001000000000000736D68007871 | (....... ...................................smh.xq |
| \ICON\7\1033 | 1319E8 | B716 | 8D3E8 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000097048597300000EC300000EC301 | .PNG........IHDR.............\r.f....pHYs......... |
| \ICON\8\1033 | 13D110 | 25A8 | 98B10 | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\9\1033 | 13F6C8 | 10A8 | 9B0C8 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\10\1033 | 140780 | 468 | 9C180 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000 | (....... ..... .....@............................. |
| \STRING\9\1033 | 140BF8 | 2C | 9C5F8 | 06004200610079006D0061007800000000000000000000000000000000000000000000000000000000000000 | ..B.a.y.m.a.x............................... |
| \GROUP_ICON\128\1033 | 140C34 | 92 | 9C634 | 000001000A0030301000010004006806000001002020100001000400E8020000020010101000010004002801000003003030 | ......00......h..... ....................(.....00 |
| \VERSION\1\2052 | 140CD8 | 318 | 9C6D8 | 180334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 141000 | 27B | 9CA00 | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122 | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" |
| Intelligent String |
| • Baymax64.exe • kernel32.dll • Www.ChinaPYG.CoM • eU@K |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| C237 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0x80C077E] |
| FDE8 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0xDE9943A7] |
| 12F5A | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0x2A839A95] |
| 1630E | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0xE5BFC5AB] |
| 1703D | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0x8541D527] |
| 1B656 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xD9E56F18] |
| 2092A | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0x3CBD8E04] |
| 2681B | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0x4ECD8B21] |
| 2690A | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0x73751A45] |
| 278F3 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xB7F8A75E] |
| 28506 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xE5DFA686] |
| 2BD67 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0xEC8DE50F] |
| 2F5C4 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0x938C24D1] |
| 4A32A | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xCFC2F6E] |
| 4A8AF | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0x78906C11] |
| 4F5EF | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xB5EB4733] |
| 4FE16 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xBB77EF45] |
| 530A2 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xB92B77B5] |
| 60CA8 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xF9B4D6A4] |
| 6D0ED | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xB5474FDD] |
| 6E4CB | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0xD637D03B] |
| 794A7 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0xCC7E8EF2] |
| 7B253 | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | JMP QWORD PTR [RIP+0x65A0E29A] |
| 8A34C | N/A | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | CALL QWORD PTR [RIP+0x2D9DD1CF] |
| 92614 | N/A | .rsrc | JMP QWORD PTR [RIP+0x58181C58] |
| B2015 | N/A | .boot | CALL QWORD PTR [RIP+0x41122ED5] |
| B7153 | N/A | .boot | JMP QWORD PTR [RIP+0x2A6981F6] |
| B9BB6 | N/A | .boot | CALL QWORD PTR [RIP+0x9977A75F] |
| C045A | N/A | .boot | JMP QWORD PTR [RIP+0x406E2018] |
| C5987 | N/A | .boot | JMP QWORD PTR [RIP+0xEDCE9C5E] |
| C62B1 | N/A | .boot | JMP QWORD PTR [RIP+0xE7E540C3] |
| D1501 | N/A | .boot | JMP QWORD PTR [RIP+0xF0C576E4] |
| D4C5D | N/A | .boot | JMP QWORD PTR [RIP+0x729772D2] |
| E30F3 | N/A | .boot | JMP QWORD PTR [RIP+0x32640CB9] |
| F2289 | N/A | .boot | JMP QWORD PTR [RIP+0x452C305A] |
| FD3CF | N/A | .boot | JMP QWORD PTR [RIP+0x473DAB3B] |
| 10EA56 | N/A | .boot | JMP QWORD PTR [RIP+0x1A2D52C5] |
| 1144C2 | N/A | .boot | CALL QWORD PTR [RIP+0x200601FD] |
| 1187FD | N/A | .boot | JMP QWORD PTR [RIP+0xF7A5BA77] |
| 11E511 | N/A | .boot | CALL QWORD PTR [RIP+0xB35A59DA] |
| 12116A | N/A | .boot | JMP QWORD PTR [RIP+0x32092EEA] |
| 123677 | N/A | .boot | JMP QWORD PTR [RIP+0x1C51CBF4] |
| 126121 | N/A | .boot | JMP QWORD PTR [RIP+0x6BDF873A] |
| 129A20 | N/A | .boot | CALL QWORD PTR [RIP+0x24CAEFC8] |
| 131D9C | N/A | .boot | CALL QWORD PTR [RIP+0xEF5BB5CC] |
| 13B66C | N/A | .boot | JMP QWORD PTR [RIP+0x975514EF] |
| 153FF9 | N/A | .boot | JMP QWORD PTR [RIP+0xD1B240EE] |
| 154F7A | N/A | .boot | JMP QWORD PTR [RIP+0x5EE3E2B] |
| 166D2A | N/A | .boot | JMP QWORD PTR [RIP+0xD6CC06CF] |
| 16DAC4 | N/A | .boot | JMP QWORD PTR [RIP+0xACB2DBE9] |
| 16DC1E | N/A | .boot | CALL QWORD PTR [RIP+0x964C2FF0] |
| 172DD3 | N/A | .boot | CALL QWORD PTR [RIP+0xFFD7FDE1] |
| 175779 | N/A | .boot | JMP QWORD PTR [RIP+0x9A55F029] |
| 1802B0 | N/A | .boot | JMP QWORD PTR [RIP+0x58DDE8D4] |
| 183EA9 | N/A | .boot | JMP QWORD PTR [RIP+0x755CE801] |
| 1866E3 | N/A | .boot | JMP QWORD PTR [RIP+0x1A8BCC08] |
| 18881C | N/A | .boot | JMP QWORD PTR [RIP+0xE74FB87F] |
| 18A50A | N/A | .boot | CALL QWORD PTR [RIP+0xAB5E446F] |
| 18DAA2 | N/A | .boot | JMP QWORD PTR [RIP+0xE56757E5] |
| 18FCB4 | N/A | .boot | JMP QWORD PTR [RIP+0x4592DFC5] |
| 19386C | N/A | .boot | JMP QWORD PTR [RIP+0x2FC696FD] |
| 194515 | N/A | .boot | JMP QWORD PTR [RIP+0xD6D7820E] |
| 195DD2 | N/A | .boot | JMP QWORD PTR [RIP+0x19EEE754] |
| 1978F5 | N/A | .boot | JMP QWORD PTR [RIP+0x9D36AD01] |
| 19C365 | N/A | .boot | JMP QWORD PTR [RIP+0xD0EC7DCB] |
| 1B0359 | N/A | .boot | JMP QWORD PTR [RIP+0xA77C5929] |
| 1BC77C | N/A | .boot | JMP QWORD PTR [RIP+0x3AC2670D] |
| 1BCE5E | N/A | .boot | JMP QWORD PTR [RIP+0x7C7B912A] |
| 1BDF7B | N/A | .boot | JMP QWORD PTR [RIP+0x776A42FD] |
| 1BE183 | N/A | .boot | JMP QWORD PTR [RIP+0x7ED446FD] |
| 1BE560 | N/A | .boot | JMP QWORD PTR [RIP+0x33A8E8C4] |
| 1BEA1A | N/A | .boot | JMP QWORD PTR [RIP+0x77BBCFFB] |
| 1D4B9C | N/A | .boot | JMP QWORD PTR [RIP+0xF84C1997] |
| 1DC8FB | N/A | .boot | JMP QWORD PTR [RIP+0x25AC3F7D] |
| 1DE867 | N/A | .boot | JMP QWORD PTR [RIP+0x473A7DD8] |
| 1E288A | N/A | .boot | CALL QWORD PTR [RIP+0x4CC82847] |
| 1E4910 | N/A | .boot | JMP QWORD PTR [RIP+0x59B4BD0E] |
| 1FAC8F | N/A | .boot | JMP QWORD PTR [RIP+0xD1B92A60] |
| 1FE028 | N/A | .boot | JMP QWORD PTR [RIP+0xEAF3BA05] |
| 247FBB | N/A | .boot | JMP QWORD PTR [RIP+0x2950D889] |
| 24857D | N/A | .boot | CALL QWORD PTR [RIP+0x1970BDD5] |
| 24B9FB | N/A | .boot | JMP QWORD PTR [RIP+0xDCB8949E] |
| 24DEB4 | N/A | .boot | JMP QWORD PTR [RIP+0x9A2DF56] |
| 2580F5 | N/A | .boot | JMP QWORD PTR [RIP+0x9490F27] |
| 25A66E | N/A | .boot | JMP QWORD PTR [RIP+0x5CEA7571] |
| 2649F5 | N/A | .boot | JMP QWORD PTR [RIP+0xF58EFB27] |
| 264DA9 | N/A | .boot | JMP QWORD PTR [RIP+0x455D0631] |
| 268CE3 | N/A | .boot | CALL QWORD PTR [RIP+0xDFF7CF21] |
| 26D8DB | N/A | .boot | CALL QWORD PTR [RIP+0xED746802] |
| 275980 | N/A | .boot | JMP QWORD PTR [RIP+0x370FBE56] |
| 283791 | N/A | .boot | JMP QWORD PTR [RIP+0x41986DB1] |
| 2885E8 | N/A | .boot | JMP QWORD PTR [RIP+0xDD76A131] |
| 2901D5 | N/A | .boot | JMP QWORD PTR [RIP+0x3B77734F] |
| 2A07F5 | N/A | .boot | CALL QWORD PTR [RIP+0x3857D570] |
| 2B8FCB | N/A | .boot | JMP QWORD PTR [RIP+0x7E593254] |
| 2BAC59 | N/A | .boot | JMP QWORD PTR [RIP+0x76FC8D09] |
| 2C8443 | N/A | .boot | JMP QWORD PTR [RIP+0xB95D3CB3] |
| 2E93D7 | N/A | .boot | JMP QWORD PTR [RIP+0xB584E65D] |
| 2EBCB0 | N/A | .boot | CALL QWORD PTR [RIP+0xB7FDCBC9] |
| 2F65F1 | N/A | .boot | CALL QWORD PTR [RIP+0x8080B08] |
| CFFF6-D0006 | N/A | .boot | Potential obfuscated jump sequence detected, count: 7 |
| 400-591FF | 1000 | (0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20)(0x20) | Executable section anomaly, first bytes: 2C255B2893624100 |
| 9CE00-5755FF | 912000 | .boot | Executable section anomaly, first bytes: 24ACE2A6C282353D |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 3929536 | 68,6544% |
| Null Byte Code | 99988 | 1,7469% |
© 2026 All rights reserved.