PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Icon: Icon
Size: 176,50 KB
SHA-256 Hash: 569D66627D28B8778262933F22389D1A5B9360E58B1BCB07670FAC8C1D9E438E
SHA-1 Hash: 658327E52B2E6E123428DC10ABC87102FD1EBABD
MD5 Hash: CDD9050255F61CF63B5862003B0B478C
Imphash: 87BED5A7CBA00C7E1F4015F1BDAE2183
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): 0
SizeOfHeaders: 400
SizeOfImage: 81000
ImageBase: 400000
Architecture: x86
ImportTable: 1000
Characteristics: 10F
TimeDateStamp: 3B7D8410
Date: 17/08/2001 20:52:32
File Type: EXE
Number Of Sections: 2
ASLR: Disabled
Section Names: .text, .rsrc
Number Of Executable Sections: 0
Subsystem: Windows GUI
[Incomplete Binary or Compressor Packer - 339,50 KB Missing]
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0xC0000040
Initialized Data
Readable
Writeable
 1000 2A000 1000 7E000
7.9594
14318.49
.rsrc
0xC0000040
Initialized Data
Readable
Writeable
 2B000 1200 7F000 2000
4.7245
168629.22
Entry Point
Information -> EntryPoint (calculated) - 3FF25D
Signatures
Rich Signature Analyzer:
Code -> 87451664C3247837C3247837C324783739073837C624783719076437C8247837C3247837C2247837C32479374424783739076137CE24783754073D37C224783719076537DF24783739074537C224783752696368C3247837
Footprint md5 Hash -> B160531035089F6B018DF15FF86B5D60
• The Rich header apparently has not been modified
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Detect It Easy (die)
• PE: linker: Microsoft Linker(7.160*)[-]
• PE: archive: Resources(-)[-]
• Entropy: 7.88955
Suspicious Functions
Library Function Description
KERNEL32.DLL LoadLibraryA Loads the specified module into the address space of the calling process.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
File Access
Kernel32.dll
Interest's Words
exec
URLs
http://www.ntkrnl.com
Resources
Path DataRVA Size FileOffset CodeText
\ICON\1\1031 7F190 8A8 2B190 2800000020000000400000000100080000000000800400000000000000000000000100000000000000000000FFFFFF0031A5(... ...@.......................................1.
\GROUP_ICON\104\1031 7FA38 14 2BA38 0000010001002020000001000800A80800000100...... ............
\24\1\1033 7FA4C 38B 2BA4C 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279<?xml version="1.0" encoding="UTF-8" standalone="y
\63\1\0 7FDD7 DD 2BDD7 4E546B726E6C20536563757265205375697465200A56657273696F6E20302E31200A4D6574616D6F72706869736D20506F72NTkrnl Secure Suite .Version 0.1 .Metamorphism Por
\63\2\0 7FEB4 F7 2BEB4 4E546B726E6C204765626F7267656E65205A657567200A56657273696F6E20302E31200A4D6574616D6F72706869736D7573NTkrnl Geborgene Zeug .Version 0.1 .Metamorphismus
\63\3\0 7FFAB F2 2BFAB 4E546B726E6C2053696375726F205365677569746F200A56657273696F6E20302E31200A4D6574616D6F72706869736D2050NTkrnl Sicuro Seguito .Version 0.1 .Metamorphism P
Intelligent String
• Kernel32.dll
• Homepage: http://www.ntkrnl.com
• HauseSeite: http://www.ntkrnl.com
• Casa pagina: http://www.ntkrnl.com

Flow Anomalies
Offset FlowVA Section Description
13C0C 7FFAB .text CALL [static] | Indirect call to absolute memory address
21CD4 34D47408 .text CALL [static] | Indirect call to absolute memory address
28E6B 34D47408 .text JMP [static] | Indirect jump to absolute memory address
Extra Analysis
Metric Value Percentage
Ascii Code 121209 67,0641%
Null Byte Code 6640 3,6739%
© 2026 All rights reserved.