PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 248,50 KB SHA-256 Hash: FD42DDCC1B4107863EE362D48CF68262176995C88C65969C957F2A16FB7C22E0 SHA-1 Hash: 3E773669A151375E55B8EDA1E4C1F3B3286496C6 MD5 Hash: E2D2ADEBEABC58B42C56D76E3F5B18DB Imphash: 6541F72CBD1AD3F210A7C5376655DFB8 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 123E5 SizeOfHeaders: 400 SizeOfImage: 45000 ImageBase: 10000000 Architecture: x86 ExportTable: 34A80 ImportTable: 34AC8 Characteristics: 2102 TimeDateStamp: 6A21B238 Date: 04/06/2026 17:13:28 File Type: DLL Number Of Sections: 6 ASLR: Enabled Section Names: .text, .rdata, .data, .fptable, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 29C00 | 1000 | 2A000 |
|
|
| .rdata | 0xC0000040 Initialized Data Readable Writeable |
2A000 | B600 | 2B000 | C000 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
35600 | 6400 | 37000 | 9000 |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
3BA00 | 0 | 40000 | 1000 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
3BA00 | 200 | 41000 | 1000 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
3BC00 | 2600 | 42000 | 3000 |
|
|
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 117E5 Code -> 558BEC837D0C017505E81C050000FF7510FF750CFF7508E8ABFEFFFF83C40C5DC20C00558BEC830D907003100183EC28C705 Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X100E |CALL 0X152A |PUSH DWORD PTR [EBP + 0X10] |PUSH DWORD PTR [EBP + 0XC] |PUSH DWORD PTR [EBP + 8] |CALL 0XEC7 |ADD ESP, 0XC |POP EBP |RET 0XC |PUSH EBP |MOV EBP, ESP |OR DWORD PTR [0X10037090], 1 |SUB ESP, 0X28 |
| Signatures |
| Rich Signature Analyzer: Code -> 019F76D245FE188145FE188145FE18813C7F1B804EFE18813C7F1D80DEFE18813C7F1E8047FE18813C7F1F8044FE1881C2771B8053FE1881C2771C8054FE1881C2771D806EFE18813C7F1C805DFE18813C7F19805EFE188145FE19817FFF1881DC77118057FE1881DC77188044FE1881DC77E78144FE1881DC771A8044FE18815269636845FE1881 Footprint md5 Hash -> 9FA33B2A870FDF9E0803816BB6FA1892 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: linker: Microsoft Linker(14.44**)[-] • Entropy: 6.25859 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| Ws2_32.DLL | connect | Possible Call API By Name | Establish a connection to a specified socket. |
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CopyFileW | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | CreateRemoteThread | Creates a thread in the address space of another process. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| ET Functions (carving) |
| Original Name -> .dll run |
| Windows REG (UNICODE) |
| Software\Tencent\Plugin\VAS SOFTWARE\Microsoft\Windows NT\CurrentVersion Software\Microsoft\Windows\CurrentVersion\Run Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| File Access |
| Windows\System32\svchost.exe Windows\SysWOW64\svchost.exe DINPUT8.dll dxgi.dll gdiplus.dll SHLWAPI.dll WINMM.dll WS2_32.dll OLEAUT32.dll ole32.dll SHELL32.dll ADVAPI32.dll GDI32.dll USER32.dll KERNEL32.dll .dll NtDll.dll .dat Temp |
| File Access (UNICODE) |
| %s\Microsoft\Crypto\RSA\certstore.exe %s\Microsoft\Windows\WinMgr.exe UnThreat.exe K7TSecurity.exe ad-watch.exe PSafeSysTray.exe vsserv.exe remupd.exe hQrtvscan.exe \~OashDisp.exe avcenter.exe TMBMSRV.exe knsdtray.exe TaUegui.exe Mcshield.exe avpui.exe avp.exe f-secure.exe avgwdsvc.exe V3Svc.exe acs.exe SPIDer.exe cfp.exe mssecess.exe QUHLPSVC.EXE RavMonD.exe XKvMonXP.exe BaiduSd.exe HipsDaemon.exe HipsMain.exe HipsTray.exe QQRepair.exe QQPCTray.exe QQPCRealTimeSpeedup.exe QQPCPatch.exe QMPersonalCenter.exe QMDL.exe QQPCRTP.exe kxescore.exe kwsprotect64.exe kscan.exe KSafeTray.exe kxetray.exe 360sd.exe ZhuDongFangYu.exe 360tray.exe 360Tray.exe y&{360Safe.exe ExitProcessWinExecWaitForSingleObject%swininet.dll GetNativeSystemInfontdll.dll kernel32.dll mscoree.dll %s\Microsoft\Windows\WinMgrDrv.sys \DisplaySessionContainers.log winos_login_v2.log winos_login.log AppData |
| Interest's Words |
| lockbit exec attrib start shutdown systeminfo expand |
| Interest's Words (UNICODE) |
| start shutdown at.exe |
| Anti-VM/Sandbox/Debug Tricks (UNICODE) |
| LabTools - wireshark |
| AV Services (UNICODE) |
| avp.exe - (Kaspersky AntiVirus) vsserv.exe - (BitDefender) avgwdsvc.exe - (AVG Watchdog) egui.exe - (ESET) ad-watch.exe - (Ad-Aware) avcenter.exe - (Avira) ashdisp.exe - (Avast) tmbmsrv.exe - (Trend Micro) 360safe.exe 360tray.exe 360sd.exe zhudongfangyu.exe qqpcrtp.exe baidusd.exe ravmond.exe kvmonxp.exe kxetray.exe |
| IP Addresses |
| 43.160.193.90 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (connect) |
| Text | Ascii | WinAPI Sockets (recv) |
| Text | Unicode | WinAPI Sockets (send) |
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CopyFile) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Service (OpenSCManager) |
| Hex | Hex Pattern | PEB AntiDebug (Flag BeingDebugged) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GlobalMemoryStatusEx) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (GetThreadContext) |
| Text | Ascii | Stealth (SetThreadContext) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (IsBadReadPtr) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Stealth (CreateRemoteThread) |
| Text | Ascii | Execution (CreateProcessA) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (WinExec) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (OpenEventW) |
| Text | Ascii | Execution (CreateEventA) |
| Text | Ascii | Execution (CreateEventW) |
| Text | Unicode | Antivirus Software (BitDefender) |
| Text | Unicode | Antivirus Software (F-Secure AV) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Unicode | Keyboard Key ([F1]) |
| Text | Unicode | Keyboard Key ([F2]) |
| Text | Unicode | Keyboard Key ([F3]) |
| Text | Unicode | Keyboard Key ([F4]) |
| Text | Unicode | Keyboard Key ([F5]) |
| Text | Unicode | Keyboard Key ([F6]) |
| Text | Unicode | Keyboard Key ([F7]) |
| Text | Unicode | Keyboard Key ([F8]) |
| Text | Unicode | Keyboard Key ([F9]) |
| Text | Unicode | Keyboard Key ([F10]) |
| Text | Unicode | Keyboard Key ([F11]) |
| Text | Unicode | Keyboard Key ([F12]) |
| Entry Point | Hex Pattern | fasm - Tomasz Grysztar |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \24\2\1033 | 41060 | 17D | 3BA60 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version='1.0' encoding='UTF-8' standalone='y |
| Intelligent String |
| • 43.160.193.90 • mscoree.dll • kernel32.dll • 360Safe.exe • 360Tray.exe • 360tray.exe • ZhuDongFangYu.exe • 360sd.exe • kxetray.exe • KSafeTray.exe • kscan.exe • kwsprotect64.exe • kxescore.exe • QQPCRTP.exe • QMDL.exe • QMPersonalCenter.exe • QQPCPatch.exe • QQPCRealTimeSpeedup.exe • QQPCTray.exe • QQRepair.exe • HipsTray.exe • HipsMain.exe • HipsDaemon.exe • BaiduSd.exe • KvMonXP.exe • RavMonD.exe • QUHLPSVC.EXE • mssecess.exe • cfp.exe • SPIDer.exe • DR.WEB • acs.exe • V3Svc.exe • AYAgent.aye • avgwdsvc.exe • f-secure.exe • avp.exe • avpui.exe • Mcshield.exe • egui.exe • knsdtray.exe • TMBMSRV.exe • avcenter.exe • ashDisp.exe • rtvscan.exe • remupd.exe • vsserv.exe • PSafeSysTray.exe • ad-watch.exe • K7TSecurity.exe • UnThreat.exe • winos_login.log • Windows\SysWOW64\svchost.exe • Windows\System32\svchost.exe • OpenProcessKernel32.dll • wininet.dll • winos_login_v2.log • [LOGIN] Connect FAILED to %s:%s • [LOGIN] Connect OK to %s:%s, sending LOGININFO (sizeof=%lu)... • [LOGIN] sendLoginInfo OK, waiting for TOKEN_ACTIVED... • Global\WinMgrWatchdog • Global\WinMgrResurrect • %s\Microsoft\Windows\WinMgrDrv.sys • %s\Microsoft\Windows\WinMgr.exe • %s\WindowsMgr.cmd • [%02d:%02d:%02d.%03d] LOGIN: %s • %s\Microsoft\Crypto\RSA\certstore.exe • \DisplaySessionContainers.log • .tls • .bss |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 41E | 1002B3E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 460 | 1002B160 | .text | CALL [static] | Indirect call to absolute memory address |
| 4C5 | 1002B2B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CF | 1002B2AC | .text | CALL [static] | Indirect call to absolute memory address |
| 4FB | 1002B2A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 520 | 1002B274 | .text | CALL [static] | Indirect call to absolute memory address |
| 55F | 1002B2A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 57B | 1002B2B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 5AA | 1002B29C | .text | CALL [static] | Indirect call to absolute memory address |
| 603 | 1002B294 | .text | CALL [static] | Indirect call to absolute memory address |
| 80B | 1002B2BC | .text | CALL [static] | Indirect call to absolute memory address |
| 845 | 1002B2BC | .text | CALL [static] | Indirect call to absolute memory address |
| 965 | 1002B2B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 997 | 1002B2BC | .text | CALL [static] | Indirect call to absolute memory address |
| A3E | 1002B2B8 | .text | CALL [static] | Indirect call to absolute memory address |
| A6F | 1002B2BC | .text | CALL [static] | Indirect call to absolute memory address |
| AA1 | 1002B298 | .text | CALL [static] | Indirect call to absolute memory address |
| C37 | 1002B274 | .text | CALL [static] | Indirect call to absolute memory address |
| C82 | 1002B29C | .text | CALL [static] | Indirect call to absolute memory address |
| C91 | 1002B290 | .text | CALL [static] | Indirect call to absolute memory address |
| D22 | 1002B284 | .text | CALL [static] | Indirect call to absolute memory address |
| E06 | 1002B2A4 | .text | CALL [static] | Indirect call to absolute memory address |
| F05 | 1002B274 | .text | CALL [static] | Indirect call to absolute memory address |
| 2379 | 1002B270 | .text | CALL [static] | Indirect call to absolute memory address |
| 24C6 | 1002B3E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 24D4 | 1002B250 | .text | CALL [static] | Indirect call to absolute memory address |
| 252F | 1002B27C | .text | CALL [static] | Indirect call to absolute memory address |
| 2559 | 1002B3D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 267B | 1002B408 | .text | CALL [static] | Indirect call to absolute memory address |
| 2684 | 1002B258 | .text | CALL [static] | Indirect call to absolute memory address |
| 268D | 1002B3DC | .text | CALL [static] | Indirect call to absolute memory address |
| 269D | 1002B278 | .text | CALL [static] | Indirect call to absolute memory address |
| 26EE | 1002B3C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 270D | 1002B3F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2728 | 1002B254 | .text | CALL [static] | Indirect call to absolute memory address |
| 2758 | 1002B254 | .text | CALL [static] | Indirect call to absolute memory address |
| 2770 | 1002B3E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 27B1 | 1002B408 | .text | CALL [static] | Indirect call to absolute memory address |
| 27BA | 1002B258 | .text | CALL [static] | Indirect call to absolute memory address |
| 27C3 | 1002B3DC | .text | CALL [static] | Indirect call to absolute memory address |
| 27F1 | 1002B400 | .text | CALL [static] | Indirect call to absolute memory address |
| 2824 | 1002B404 | .text | CALL [static] | Indirect call to absolute memory address |
| 2833 | 1002B3F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2842 | 1002B40C | .text | CALL [static] | Indirect call to absolute memory address |
| 28B8 | 1002B3E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 28CC | 1002B3D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2901 | 1002B3FC | .text | CALL [static] | Indirect call to absolute memory address |
| 293A | 1002B408 | .text | CALL [static] | Indirect call to absolute memory address |
| 2943 | 1002B258 | .text | CALL [static] | Indirect call to absolute memory address |
| 294C | 1002B3DC | .text | CALL [static] | Indirect call to absolute memory address |
| 29FB | 1002B3D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2A17 | 1002B278 | .text | CALL [static] | Indirect call to absolute memory address |
| 2A1F | 1002B27C | .text | CALL [static] | Indirect call to absolute memory address |
| 2B68 | 1002B3E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B7F | 1002B3D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B94 | 1002B3F8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2BA0 | 1002B40C | .text | CALL [static] | Indirect call to absolute memory address |
| 2C3D | 1002B27C | .text | CALL [static] | Indirect call to absolute memory address |
| 2C61 | 1002B3C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CC9 | 1002B264 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E31 | 1002B3EC | .text | CALL [static] | Indirect call to absolute memory address |
| 2E3D | 1002B40C | .text | CALL [static] | Indirect call to absolute memory address |
| 2F0D | 1002B3EC | .text | CALL [static] | Indirect call to absolute memory address |
| 2F19 | 1002B40C | .text | CALL [static] | Indirect call to absolute memory address |
| 2F77 | 1002B264 | .text | CALL [static] | Indirect call to absolute memory address |
| 2FD3 | 1002B27C | .text | CALL [static] | Indirect call to absolute memory address |
| 2FF2 | 1002B270 | .text | CALL [static] | Indirect call to absolute memory address |
| 3011 | 1002B270 | .text | CALL [static] | Indirect call to absolute memory address |
| 306A | 1002B27C | .text | CALL [static] | Indirect call to absolute memory address |
| 3121 | 1002B3C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 324F | 1002B23C | .text | CALL [static] | Indirect call to absolute memory address |
| 3334 | 1002B24C | .text | CALL [static] | Indirect call to absolute memory address |
| 335C | 1002B1C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3368 | 1002B40C | .text | CALL [static] | Indirect call to absolute memory address |
| 3376 | 1002B1C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3398 | 1002B2AC | .text | CALL [static] | Indirect call to absolute memory address |
| 33A8 | 1002B1C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 33E4 | 1002B3F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3415 | 1002B3D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 3445 | 1002B418 | .text | CALL [static] | Indirect call to absolute memory address |
| 3457 | 1002B254 | .text | CALL [static] | Indirect call to absolute memory address |
| 3484 | 1002B254 | .text | CALL [static] | Indirect call to absolute memory address |
| 3499 | 1002B3E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 34BC | 1002B400 | .text | CALL [static] | Indirect call to absolute memory address |
| 34DB | 1002B410 | .text | CALL [static] | Indirect call to absolute memory address |
| 34EF | 1002B3F4 | .text | CALL [static] | Indirect call to absolute memory address |
| 34FE | 1002B40C | .text | CALL [static] | Indirect call to absolute memory address |
| 3553 | 1002B264 | .text | CALL [static] | Indirect call to absolute memory address |
| 358A | 1002B240 | .text | CALL [static] | Indirect call to absolute memory address |
| 35EE | 1002B424 | .text | CALL [static] | Indirect call to absolute memory address |
| 3691 | 1002B1C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3697 | 1002B2AC | .text | CALL [static] | Indirect call to absolute memory address |
| 36B5 | 1002B40C | .text | CALL [static] | Indirect call to absolute memory address |
| 36E6 | 1002B264 | .text | CALL [static] | Indirect call to absolute memory address |
| 3734 | 1002B3CC | .text | CALL [static] | Indirect call to absolute memory address |
| 377D | 1002B428 | .text | CALL [static] | Indirect call to absolute memory address |
| 37EF | 1002B410 | .text | CALL [static] | Indirect call to absolute memory address |
| 3818 | 1002B3C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3858 | 1002B3C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3889 | 1002B3EC | .text | CALL [static] | Indirect call to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 135133 | 53,105% |
| Null Byte Code | 58262 | 22,896% |
© 2026 All rights reserved.