PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,55 MBSHA-256 Hash: 6A6CA2CBDF409557EA99CDD04CFBC89CB1791D675905893DEDD24A54AA3B3155 SHA-1 Hash: 55E17D9884DFC9F13E97F55865A6E68B1F766727 MD5 Hash: EB0CCCDBF817841F740422ADC2FEACC2 Imphash: 46CE5C12B293FEBBEB513B196AA7F843 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00293ED1 EntryPoint (rva): 369F SizeOfHeaders: 400 SizeOfImage: A0000 ImageBase: 400000 Architecture: x86 ImportTable: 84FC IAT: 8000 Characteristics: 10F TimeDateStamp: 67CCCD30 Date: 08/03/2025 23:05:20 File Type: EXE Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .ndata, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 6800 | 1000 | 6711 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
6C00 | 1400 | 8000 | 1358 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
8000 | 600 | A000 | 1FB78 |
|
|
| .ndata | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 0 | 2A000 | 2E000 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
8600 | 47600 | 58000 | 47518 |
|
|
| Description |
| LegalCopyright: Copyright 2024 HackerAI ProductName: HackerAI FileVersion: 0.0.16 FileDescription: HackerAI ProductVersion: 0.0.16 Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 1,92 MB |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 2A9F Code -> 81ECF80300005556576A205F33ED6801800000896C2420C744241830A24000896C2414FF159C8040008B35A08040008D4424 Assembler |SUB ESP, 0X3F8 |PUSH EBP |PUSH ESI |PUSH EDI |PUSH 0X20 |POP EDI |XOR EBP, EBP |PUSH 0X8001 |MOV DWORD PTR [ESP + 0X20], EBP |MOV DWORD PTR [ESP + 0X18], 0X40A230 |MOV DWORD PTR [ESP + 0X14], EBP |CALL DWORD PTR [0X40809C] |MOV ESI, DWORD PTR [0X4080A0] |
| Signatures |
| Rich Signature Analyzer: Code -> AD312081E9504ED2E9504ED2E9504ED22A5F11D2EB504ED2E9504FD24A504ED22A5F13D2E6504ED2BD737ED2E3504ED22E5648D2E8504ED252696368E9504ED2 Footprint md5 Hash -> 082F1D2C935AFD7F2772501AF0260BC8 • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Compiler: Nullsoft Install System - Version: v3.11 Detect It Easy (die) • PE: installer: Nullsoft Scriptable Install System(3.11)[lzma,solid] • PE: linker: Microsoft Linker(6.0*)[-] • PE: overlay: NSIS data(-)[-] • Entropy: 7.71915 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CopyFileW | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| ADVAPI32.DLL | RegDeleteKeyExW | Deletes a registry key. |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| Software\Microsoft\Windows\CurrentVersion |
| File Access |
| Nullsoft.NSIS.exe KERNEL32.dll GDI32.dll USER32.dll COMCTL32.dll ole32.dll SHELL32.dll ADVAPI32.dll @.dat Temp |
| File Access (UNICODE) |
| %s%S.dll Temp |
| Interest's Words |
| exec attrib shutdown ping expand |
| Interest's Words (UNICODE) |
| shutdown |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings http://schemas.microsoft.com/SMI/2016/WindowsSettings http://www.microsoft.com/pkiops/crl/Microsoft%20ID%20Verified%20CS%20AOC%20CA%2002.crl http://www.microsoft.com/pkiops/certs/Microsoft%20ID%20Verified%20CS%20AOC%20CA%2002.crt http://oneocsp.microsoft.com/ocsp0f http://www.microsoft.com/pkiops/Docs/Repository.htm http://www.microsoft.com/pkiops/crl/Microsoft%20ID%20Verified%20Code%20Signing%20PCA%202021.crl http://www.microsoft.com/pkiops/certs/Microsoft%20ID%20Verified%20Code%20Signing%20PCA%202021.crt http://oneocsp.microsoft.com/ocsp0 http://www.microsoft.com/pkiops/crl/Microsoft%20Identity%20Verification%20Root%20Certificate%20Authority%202020.crl http://www.microsoft.com/pkiops/certs/Microsoft%20Identity%20Verification%20Root%20Certificate%20Authority%202020.crt http://www.microsoft.com/pkiops/crl/Microsoft%20Public%20RSA%20Timestamping%20CA%202020.crl http://www.microsoft.com/pkiops/certs/Microsoft%20Public%20RSA%20Timestamping%20CA%202020.crt |
| URLs (UNICODE) |
| http://nsis.sf.net/NSIS_Error |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 58358 | 42028 | 8958 | 28000000000100000002000001002000000000000000000000000000000000000000000000000000141414FF141414FF1414 | (............. ................................... |
| \ICON\2\1033 | 9A380 | 25A8 | 4A980 | 28000000300000006000000001002000000000000000000000000000000000000000000000000000141414FF141414FF1414 | (...0........ ................................... |
| \ICON\3\1033 | 9C928 | 10A8 | 4CF28 | 28000000200000004000000001002000000000000000000000000000000000000000000000000000141414FF141414FF1414 | (... ...@..... ................................... |
| \ICON\4\1033 | 9D9D0 | 568 | 4DFD0 | 28000000100000002000000001002000000000000000000000000000000000000000000000000000141414FF141414FF1414 | (....... ..... ................................... |
| \ICON\5\1033 | 9DF38 | 468 | 4E538 | 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | .................................................. |
| \ICON\6\1033 | 9E3A0 | 2E8 | 4E9A0 | 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | .................................................. |
| \ICON\7\1033 | 9E688 | 128 | 4EC88 | 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 | .................................................. |
| \DIALOG\103\1033 | 9E7B0 | 120 | 4EDB0 | 0100FFFF0000000000000000480400400700000000002C018C000000000000000800000000014D0053002000530068006500 | ............H..@......,...............M.S. .S.h.e. |
| \DIALOG\105\1033 | 9E8D0 | 202 | 4EED0 | 0100FFFF00000000000000004808CA800E00000000004B01DE000000000000000800000000014D0053002000530068006500 | ............H.........K...............M.S. .S.h.e. |
| \DIALOG\106\1033 | 9EAD8 | F8 | 4F0D8 | 0100FFFF0000000000000000480400400400000000002C018C000000000000000800000000014D0053002000530068006500 | ............H..@......,...............M.S. .S.h.e. |
| \DIALOG\107\1033 | 9EBD0 | A0 | 4F1D0 | 0100FFFF0000000000000000480400400300000000002C018C000000000000000800000000014D0053002000530068006500 | ............H..@......,...............M.S. .S.h.e. |
| \DIALOG\111\1033 | 9EC70 | EE | 4F270 | 0100FFFF0000000000000000C8080080030000000000A7002B000000000000000800000000014D0053002000530068006500 | ........................+.............M.S. .S.h.e. |
| \GROUP_ICON\103\1033 | 9ED60 | 68 | 4F360 | 0000010004003030000001002000A825000002002020000001002000A8100000030010100000010020006804000004000000 | ......00.... ..%.... .... ............. .h....... |
| \VERSION\1\1033 | 9EDC8 | 204 | 4F3C8 | 040234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 9EFD0 | 548 | 4F5D0 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • COMCTL32.dll • USER32.dll • http://nsis.sf.net/NSIS_Error • ~nsu%X.tmp • .exe • %s%S.dll • .jKJ |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 42C | 40825C | .text | CALL [static] | Indirect call to absolute memory address |
| 447 | 408260 | .text | CALL [static] | Indirect call to absolute memory address |
| 45B | 408264 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CF | 408058 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E4 | 408268 | .text | CALL [static] | Indirect call to absolute memory address |
| 505 | 40805C | .text | CALL [static] | Indirect call to absolute memory address |
| 526 | 408060 | .text | CALL [static] | Indirect call to absolute memory address |
| 530 | 408064 | .text | CALL [static] | Indirect call to absolute memory address |
| 556 | 40826C | .text | CALL [static] | Indirect call to absolute memory address |
| 56E | 408270 | .text | CALL [static] | Indirect call to absolute memory address |
| 7E4 | 408148 | .text | CALL [static] | Indirect call to absolute memory address |
| 7F4 | 408258 | .text | CALL [static] | Indirect call to absolute memory address |
| 8AD | 408220 | .text | CALL [static] | Indirect call to absolute memory address |
| 8EA | 4080D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 8F8 | 408224 | .text | CALL [static] | Indirect call to absolute memory address |
| 9D3 | 4080D8 | .text | CALL [static] | Indirect call to absolute memory address |
| A46 | 4080DC | .text | CALL [static] | Indirect call to absolute memory address |
| A79 | 4080E0 | .text | CALL [static] | Indirect call to absolute memory address |
| AC2 | 4080E4 | .text | CALL [static] | Indirect call to absolute memory address |
| B0E | 4080E8 | .text | CALL [static] | Indirect call to absolute memory address |
| B56 | 4080EC | .text | CALL [static] | Indirect call to absolute memory address |
| B75 | 4080F0 | .text | CALL [static] | Indirect call to absolute memory address |
| C01 | 4080F4 | .text | CALL [static] | Indirect call to absolute memory address |
| CF6 | 4080F8 | .text | CALL [static] | Indirect call to absolute memory address |
| CFF | 4080FC | .text | CALL [static] | Indirect call to absolute memory address |
| E42 | 408100 | .text | CALL [static] | Indirect call to absolute memory address |
| E54 | 408104 | .text | CALL [static] | Indirect call to absolute memory address |
| E6F | 408108 | .text | CALL [static] | Indirect call to absolute memory address |
| E82 | 408104 | .text | CALL [static] | Indirect call to absolute memory address |
| FB9 | 40822C | .text | CALL [static] | Indirect call to absolute memory address |
| 1037 | 40810C | .text | CALL [static] | Indirect call to absolute memory address |
| 1049 | 408110 | .text | CALL [static] | Indirect call to absolute memory address |
| 10DF | 408230 | .text | CALL [static] | Indirect call to absolute memory address |
| 10F7 | 408258 | .text | CALL [static] | Indirect call to absolute memory address |
| 1129 | 408234 | .text | CALL [static] | Indirect call to absolute memory address |
| 114E | 408238 | .text | CALL [static] | Indirect call to absolute memory address |
| 117E | 40823C | .text | CALL [static] | Indirect call to absolute memory address |
| 11A2 | 408240 | .text | CALL [static] | Indirect call to absolute memory address |
| 11C6 | 40823C | .text | CALL [static] | Indirect call to absolute memory address |
| 1211 | 408264 | .text | CALL [static] | Indirect call to absolute memory address |
| 1241 | 408244 | .text | CALL [static] | Indirect call to absolute memory address |
| 1255 | 408258 | .text | CALL [static] | Indirect call to absolute memory address |
| 1265 | 408054 | .text | CALL [static] | Indirect call to absolute memory address |
| 127D | 408248 | .text | CALL [static] | Indirect call to absolute memory address |
| 1297 | 408048 | .text | CALL [static] | Indirect call to absolute memory address |
| 129F | 408148 | .text | CALL [static] | Indirect call to absolute memory address |
| 12B0 | 40824C | .text | CALL [static] | Indirect call to absolute memory address |
| 12FF | 40805C | .text | CALL [static] | Indirect call to absolute memory address |
| 1328 | 408228 | .text | CALL [static] | Indirect call to absolute memory address |
| 1333 | 408250 | .text | CALL [static] | Indirect call to absolute memory address |
| 1417 | 4080FC | .text | CALL [static] | Indirect call to absolute memory address |
| 148B | 408110 | .text | CALL [static] | Indirect call to absolute memory address |
| 152F | 408114 | .text | CALL [static] | Indirect call to absolute memory address |
| 1540 | 408118 | .text | CALL [static] | Indirect call to absolute memory address |
| 15BD | 40811C | .text | CALL [static] | Indirect call to absolute memory address |
| 1655 | 408290 | .text | CALL [static] | Indirect call to absolute memory address |
| 179F | 408180 | .text | CALL [static] | Indirect call to absolute memory address |
| 1815 | 408120 | .text | CALL [static] | Indirect call to absolute memory address |
| 1851 | 408124 | .text | CALL [static] | Indirect call to absolute memory address |
| 1882 | 408014 | .text | CALL [static] | Indirect call to absolute memory address |
| 188B | 408010 | .text | CALL [static] | Indirect call to absolute memory address |
| 1941 | 40800C | .text | CALL [static] | Indirect call to absolute memory address |
| 1987 | 408008 | .text | CALL [static] | Indirect call to absolute memory address |
| 19FD | 408004 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A10 | 408000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A29 | 408010 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AC1 | 408128 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B84 | 408130 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BE2 | 408134 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CA4 | 408134 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CDB | 408134 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CFF | 408138 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D1E | 40813C | .text | CALL [static] | Indirect call to absolute memory address |
| 1D46 | 408140 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E32 | 40810C | .text | CALL [static] | Indirect call to absolute memory address |
| 1E45 | 40810C | .text | CALL [static] | Indirect call to absolute memory address |
| 1E61 | 4080FC | .text | CALL [static] | Indirect call to absolute memory address |
| 1E74 | 408144 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FF0 | 40829C | .text | CALL [static] | Indirect call to absolute memory address |
| 201A | 4082A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2040 | 408258 | .text | CALL [static] | Indirect call to absolute memory address |
| 2050 | 408254 | .text | CALL [static] | Indirect call to absolute memory address |
| 2329 | 408000 | .text | CALL [static] | Indirect call to absolute memory address |
| 237E | 408010 | .text | CALL [static] | Indirect call to absolute memory address |
| 2395 | 408018 | .text | CALL [static] | Indirect call to absolute memory address |
| 23A0 | 408010 | .text | CALL [static] | Indirect call to absolute memory address |
| 23DD | 408218 | .text | CALL [static] | Indirect call to absolute memory address |
| 2411 | 40822C | .text | CALL [static] | Indirect call to absolute memory address |
| 2421 | 40821C | .text | CALL [static] | Indirect call to absolute memory address |
| 2453 | 408148 | .text | CALL [static] | Indirect call to absolute memory address |
| 2475 | 408210 | .text | CALL [static] | Indirect call to absolute memory address |
| 2493 | 4080D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 24C1 | 40822C | .text | CALL [static] | Indirect call to absolute memory address |
| 24E5 | 408214 | .text | CALL [static] | Indirect call to absolute memory address |
| 24F3 | 408228 | .text | CALL [static] | Indirect call to absolute memory address |
| 2513 | 4080D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 252F | 4080C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 253C | 4080C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 255D | 4080D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 259A | 4080C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FC00 | N/A | *Overlay* | 00000000EFBEADDE4E756C6C736F6674496E7374 | ........NullsoftInst |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1795094 | 67,163% |
| Null Byte Code | 29945 | 1,1204% |
© 2026 All rights reserved.