PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header

Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Icon: Icon
Size: 1,43 MB
SHA-256 Hash: E3C139102460DB764ED0C0A7070DFDCCE3B34C965D19238FF0B895A3E47EE28A
SHA-1 Hash: 4BA8CD8545DB0E727FC16C44432950736C9DF929
MD5 Hash: EE0A26272F3A1EE27C2C821F20829648
Imphash: 63E594B5B2A9839C292C6794C726545A
MajorOSVersion: 4
MinorOSVersion: 0
CheckSum: 00000000
EntryPoint (rva): D14CF
SizeOfHeaders: 1000
SizeOfImage: 176000
ImageBase: 10000000
Architecture: x86
ExportTable: 12AE40
ImportTable: 1282C0
IAT: 100000
Characteristics: 210E
TimeDateStamp: 4B8A7813
Date: 28/02/2010 14:05:07
File Type: DLL
Number Of Sections: 5
ASLR: Disabled
Section Names: .text, .rdata, .data, .rsrc, .reloc
Number Of Executable Sections: 1
Subsystem: Windows GUI

Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
1000 FF000 1000 FE655
6.611
5317418.95
.rdata
0x40000040
Initialized Data
Readable
100000 2B000 100000 2AEE4
5.8
4090575.69
.data
0xC0000040
Initialized Data
Readable
Writeable
12B000 2C000 12B000 33BB4
4.5094
10228193.8
.rsrc
0x40000040
Initialized Data
Readable
157000 4000 15F000 39F0
3.8265
1108708.63
.reloc
0x42000040
Initialized Data
GP-Relative
Readable
15B000 13000 163000 12C90
5.5961
1571556.68
Description
OriginalFilename: PDFView.OCX
CompanyName: YCANPDF
LegalCopyright: Copyright (C) 2008
ProductName: YCANPDF PDFView ActiveX Control Module
FileDescription: PDFView ActiveX Control Module
Language: English (United States) (ID=0x409)
CodePage: Unicode (UTF-16 LE) (0x4B0)

Entry Point
The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - D14CF
Code -> 558BEC538B5D08568B750C578B7D1085F67509833DE4CF151000EB2683FE01740583FE027522A17CDB151085C07409575653
Assembler
|PUSH EBP
|MOV EBP, ESP
|PUSH EBX
|MOV EBX, DWORD PTR [EBP + 8]
|PUSH ESI
|MOV ESI, DWORD PTR [EBP + 0XC]
|PUSH EDI
|MOV EDI, DWORD PTR [EBP + 0X10]
|TEST ESI, ESI
|JNE 0X100D14EB
|CMP DWORD PTR [0X1015CFE4], 0
|JMP 0X100D1511
|CMP ESI, 1
|JE 0X100D14F5
|CMP ESI, 2
|JNE 0X100D1517
|MOV EAX, DWORD PTR [0X1015DB7C]
|TEST EAX, EAX
|JE 0X100D1507
|PUSH EDI
|PUSH ESI
|PUSH EBX
Signatures
Rich Signature Analyzer:
Code -> CFFD64B38B9C0AE08B9C0AE08B9C0AE0E48300E08A9C0AE0E48301E08C9C0AE0F08006E08E9C0AE08B9C0AE0B49C0AE0088004E0A29C0AE08B9C0BE00D9E0AE0489357E0949C0AE0BDBA00E0DC9D0AE0BDBA01E0599C0AE04C9A0CE08A9C0AE074BC0EE08A9C0AE0526963688B9C0AE0
Footprint md5 Hash -> 20F28642D7AF2F40D284E8D39169766C
• The Rich header apparently has not been modified
Certificate - Digital Signature Not Found:
• The file is not signed

Packer/Compiler
Compiler: Microsoft Visual C ++
Compiler: Microsoft Visual C ++ 6 DLL
Detect It Easy (die)
PE: compiler: EP:Microsoft Visual C/C++(6.0 (1720-8966))[DLL32]
PE: compiler: Microsoft Visual C/C++(6.0)[libcmt]
PE: linker: Microsoft Linker(6.0)[-]
Entropy: 6.49184

Suspicious Functions
Library Function Description
KERNEL32.DLL GetModuleFileNameA Retrieve the fully qualified path for the executable file of a specified module.
KERNEL32.DLL VirtualAlloc Reserve, commit, or both, a region of memory within the virtual address space of a process.
KERNEL32.DLL CopyFileA Copies an existing file to a new file.
KERNEL32.DLL WriteFile Writes data to a specified file or input/output (I/O) device.
KERNEL32.DLL LoadLibraryA Loads the specified module into the address space of the calling process.
KERNEL32.DLL GetModuleHandleA Retrieves a handle to the specified module.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL CreateFileA Creates or opens a file or I/O device.
KERNEL32.DLL DeleteFileA Deletes an existing file.
KERNEL32.DLL GetTempPathA Retrieves the temporary directory path.
KERNEL32.DLL ReadFile Reads data from a file.
KERNEL32.DLL FindFirstFileA Starts file and directory enumeration.
KERNEL32.DLL FindNextFileA Continues file and directory enumeration.
KERNEL32.DLL FindClose Closes a file search handle.
KERNEL32.DLL ExitThread Terminates the current thread.
KERNEL32.DLL CloseHandle Closes an open object handle.
KERNEL32.DLL IsBadReadPtr Checks whether memory is readable.
KERNEL32.DLL WinExec Launches a specified application.
KERNEL32.DLL ResumeThread Resumes a suspended thread.
KERNEL32.DLL CreateEventA Creates or opens an event object.
KERNEL32.DLL GetVersion Retrieves the operating system version.
USER32.DLL CallWindowProcA Invokes the window procedure for the specified window and messages.
URLMON.DLL URLDownloadToFileA Download a file from the internet and save it to a local file.
ADVAPI32.DLL RegCreateKeyExA Creates a new registry key or opens an existing one.
ADVAPI32.DLL RegDeleteKeyA Used to delete a subkey and its values from the Windows registry.
ADVAPI32.DLL RegSetValueExA Sets the data and type of a specified value under a registry key.
ADVAPI32.DLL RegCreateKeyExA Creates or opens a registry key.
ADVAPI32.DLL RegOpenKeyExA Opens an existing registry key.
WININET.DLL InternetConnectA Opens an File Transfer Protocol (FTP) or HTTP session for a given site.
WININET.DLL InternetOpenA Initializes an application’s use of the WinINet functions.
WININET.DLL InternetReadFile Reads data from an Internet resource.
File Access
shell32.dll
WININET.dll
urlmon.dll
OLEAUT32.dll
OLEPRO32.DLL
ole32.dll
COMCTL32.dll
ADVAPI32.dll
comdlg32.dll
GDI32.dll
USER32.dll
KERNEL32.dll
gdiplus.dll
CRYPT32.dll
WININET.DLL
@.dat
\YCanPDF\YCPConfig.ini
\YCPConfig.ini
h.INI
PDF Files(*.PDF
.PDF
PDFVIEW.PDF
Temp

Interest's Words
JFIF
Encrypt
PassWord
exec
attrib
start
shutdown
systeminfo
ping
replace

Interest's Words (UNICODE)
PassWord

URLs
http://www.ycanpdf.cn

Known IP/Domains
gmail.com

Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii Keyboard Key (Scroll)
Entry Point Hex Pattern Armadillov1xxv2xx
Entry Point Hex Pattern Microsoft Visual C++ 6.0
Entry Point Hex Pattern Microsoft Visual C++ v6.0 DLL
Resources
Path DataRVA Size FileOffset CodeText
\TYPELIB\1\1033 1612C0 155C 1592C0 4D53465402000100000000000904000000000000510000000100000002000000030000001000000000000000000000005200MSFT................Q...........................R.
\CURSOR\3\1033 1609A0 134 1589A0 0A0007002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\CURSOR\4\1033 160AF0 134 158AF0 0B000C002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\CURSOR\5\1033 160C40 134 158C40 050005002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\CURSOR\6\1033 160D90 134 158D90 050005002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\CURSOR\7\1033 160EE0 134 158EE0 050000002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF....(... ...@.....................................
\BITMAP\1\1033 15FE60 E0 157E60 28000000100000000F0000000100040000000000780000000000000000000000000000000000000000000000000080000080(...................x.............................
\BITMAP\214\1033 15FF40 328 157F40 2800000010000000100000000100180000000000000300000000000000000000000000000000000080808080808080808080(.................................................
\BITMAP\215\1033 160268 328 158268 2800000010000000100000000100180000000000000300000000000000000000000000000000000080808080808080808080(.................................................
\ICON\1\1033 15FA28 2E8 157A28 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080(... ...@.........................................
\ICON\2\1033 15FD10 128 157D10 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080(....... .........................................
\MENU\205\1033 161030 216 159030 0000000090005200690067006800740000000000048046006900720073007400200050006100670065000000000005805000......R.i.g.h.t.......F.i.r.s.t. .P.a.g.e.......P.
\MENU\213\1033 161248 78 159248 000000009000530065006C00650063007400200054006F006F006C00000000001680530065006C0065006300740020005400......S.e.l.e.c.t. .T.o.o.l.......S.e.l.e.c.t. .T.
\DIALOG\1\1033 160590 146 158590 C000C880000000000400220016000401370000000000410062006F0075007400200050004400460056006900650077002000..........".....7.....A.b.o.u.t. .P.D.F.V.i.e.w. .
\DIALOG\135\1033 160808 104 158808 C000C88000000000040000000000B50045000000000050006C006500610073006500200065006E0074006500720020007400................E.....P.l.e.a.s.e. .e.n.t.e.r. .t.
\DIALOG\200\1033 1606D8 A6 1586D8 400000400000000003000000000009019E0000000000000008004D0053002000530061006E00730020005300650072006900@..@......................M.S. .S.a.n.s. .S.e.r.i.
\DIALOG\206\1033 160780 86 158780 C008008000000000010000000000F1001E0000000000000008004D0053002000530061006E00730020005300650072006900..........................M.S. .S.a.n.s. .S.e.r.i.
\DIALOG\207\1033 160910 8E 158910 C008008000000000020000000000BB00390000000000000008004D0053002000530061006E00730020005300650072006900................9.........M.S. .S.a.n.s. .S.e.r.i.
\STRING\1\1033 162820 68 15A820 00000F005000440046005600690065007700200043006F006E00740072006F006C0015005000440046005600690065007700....P.D.F.V.i.e.w. .C.o.n.t.r.o.l...P.D.F.V.i.e.w.
\STRING\13\1033 162888 2E 15A888 000000000000000000000000000000000700470065006E006500720061006C000000000000000000000000000000..................G.e.n.e.r.a.l...............
\STRING\2050\1033 1628B8 134 15A8B8 0000000000000000000000003400440072006100670020006F00720020006D00610072007100750065006500200073006500............4.D.r.a.g. .o.r. .m.a.r.q.u.e.e. .s.e.
\GROUP_CURSOR\203\1033 160AD8 14 158AD8 0000020001002000400001000100340100000300...... .@.....4.....
\GROUP_CURSOR\204\1033 160C28 14 158C28 0000020001002000400001000100340100000400...... .@.....4.....
\GROUP_CURSOR\209\1033 160D78 14 158D78 0000020001002000400001000100340100000500...... .@.....4.....
\GROUP_CURSOR\210\1033 160EC8 14 158EC8 0000020001002000400001000100340100000600...... .@.....4.....
\GROUP_CURSOR\212\1033 161018 14 159018 0000020001002000400001000100340100000700...... .@.....4.....
\GROUP_ICON\1\1033 15FE38 22 157E38 0000010002002020100001000400E802000001001010100001000400280100000200...... ....................(.....
\VERSION\1\1033 15F650 3D4 157650 D40334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000800..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
Intelligent String
• SimKai.ttf
• SimFang.ttf
• COMCTL32.DLL
• .HLP
• CLSID\%1\InprocHandler32ole32.dll
• KERNEL32.DLL
• GetParentDestroyWindowRCreateDialogIndirectParamA
• WINSPOOL.DRV
• COMCTL32.dll
• OLEAUT32.dll
• urlmon.dll
• \shell\open\command.htm
• http://www.ycanpdf.cn
• PDF*.PDF
• .ttf
• .ps.pfb
• .pfa
• SimHei.ttf
• SimSun.ttc
• SimLi.ttf
• yes%src.cab
• d050000l.pfb
• times.ttf
• n021003l.pfb
• timesi.ttf
• n021023l.pfb
• timesbi.ttfn021024l.pfb
• timesbd.ttfn021004l.pfb
• s050000l.pfb
• ariali.ttf
• n019023l.pfb
• arialbi.ttfn019024l.pfb
• arialbd.ttfn019004l.pfb
• arial.ttf
• n019003l.pfb
• couri.ttf
• n022023l.pfb
• courbi.ttf
• n022024l.pfb
• courbd.ttf
• n022004l.pfb
• cour.ttf
• n022003l.pfb
• %s\batang.ttf
• %s\batang.ttc
• %s\msmincho.ttf%s\msmincho.ttc%s\mingliu.ttf
• %s\mingliu.ttc
• %s\simsun.ttf
• %s\simsun.ttc
• shell32.dll
• >> /CCITTFaxDecode filter
• << >> /FlateDecode filter
• l:YCanPDF@gmail.comhttp://www.YCanPDF.cn
• \YCPConfig.ini
• \YCanPDF\YCPConfig.ini
• .PAX
• PDFView.OCX

Flow Anomalies
Offset FlowVA Section Description
1021 101007B0 .text CALL [static] | Indirect call to absolute memory address
10DF 101007B0 .text CALL [static] | Indirect call to absolute memory address
11B6 10100604 .text CALL [static] | Indirect call to absolute memory address
11C6 10100604 .text CALL [static] | Indirect call to absolute memory address
138C 10100600 .text CALL [static] | Indirect call to absolute memory address
16A0 101005F0 .text CALL [static] | Indirect call to absolute memory address
1953 10100420 .text CALL [static] | Indirect call to absolute memory address
1B30 101005E8 .text CALL [static] | Indirect call to absolute memory address
1BE0 101005EC .text CALL [static] | Indirect call to absolute memory address
1E28 101005EC .text CALL [static] | Indirect call to absolute memory address
1EC9 101003C0 .text CALL [static] | Indirect call to absolute memory address
1F8B 10100420 .text CALL [static] | Indirect call to absolute memory address
2055 101003B8 .text CALL [static] | Indirect call to absolute memory address
21FF 101005EC .text CALL [static] | Indirect call to absolute memory address
23A5 101003B4 .text CALL [static] | Indirect call to absolute memory address
2579 101003AC .text CALL [static] | Indirect call to absolute memory address
270E 101003B4 .text CALL [static] | Indirect call to absolute memory address
27F2 101005E8 .text CALL [static] | Indirect call to absolute memory address
280E 10100088 .text CALL [static] | Indirect call to absolute memory address
2838 10100084 .text CALL [static] | Indirect call to absolute memory address
2888 10100080 .text CALL [static] | Indirect call to absolute memory address
28E5 101005EC .text CALL [static] | Indirect call to absolute memory address
29B9 101003AC .text CALL [static] | Indirect call to absolute memory address
29C8 101003B4 .text CALL [static] | Indirect call to absolute memory address
2A4A 10100184 .text CALL [static] | Indirect call to absolute memory address
2AAB 10100184 .text CALL [static] | Indirect call to absolute memory address
2C0C 101005EC .text CALL [static] | Indirect call to absolute memory address
2C3F 10100184 .text CALL [static] | Indirect call to absolute memory address
2C5F 101003AC .text CALL [static] | Indirect call to absolute memory address
2CA7 101003B4 .text CALL [static] | Indirect call to absolute memory address
2EDE 101005EC .text CALL [static] | Indirect call to absolute memory address
2F11 10100184 .text CALL [static] | Indirect call to absolute memory address
2F85 10100184 .text CALL [static] | Indirect call to absolute memory address
2FF5 101005F0 .text CALL [static] | Indirect call to absolute memory address
3029 101005E0 .text CALL [static] | Indirect call to absolute memory address
3030 101005E4 .text CALL [static] | Indirect call to absolute memory address
3066 101005E8 .text CALL [static] | Indirect call to absolute memory address
32C3 101005EC .text CALL [static] | Indirect call to absolute memory address
32E7 101005D0 .text CALL [static] | Indirect call to absolute memory address
3331 101005D8 .text CALL [static] | Indirect call to absolute memory address
3342 101005DC .text CALL [static] | Indirect call to absolute memory address
34B9 101005D0 .text CALL [static] | Indirect call to absolute memory address
3582 101005E8 .text CALL [static] | Indirect call to absolute memory address
35EF 101005EC .text CALL [static] | Indirect call to absolute memory address
35F9 101005CC .text CALL [static] | Indirect call to absolute memory address
369F 10100184 .text CALL [static] | Indirect call to absolute memory address
36B4 101005C0 .text CALL [static] | Indirect call to absolute memory address
36BC 101005DC .text CALL [static] | Indirect call to absolute memory address
37EA 10100600 .text CALL [static] | Indirect call to absolute memory address
37F8 101005EC .text CALL [static] | Indirect call to absolute memory address
387D 101005B0 .text CALL [static] | Indirect call to absolute memory address
3893 101005B4 .text CALL [static] | Indirect call to absolute memory address
38B7 101005B0 .text CALL [static] | Indirect call to absolute memory address
38CD 101005B4 .text CALL [static] | Indirect call to absolute memory address
3B3D 101005BC .text CALL [static] | Indirect call to absolute memory address
3D31 101005EC .text CALL [static] | Indirect call to absolute memory address
3D61 101005EC .text CALL [static] | Indirect call to absolute memory address
3D91 101005EC .text CALL [static] | Indirect call to absolute memory address
3E7F 101005C4 .text CALL [static] | Indirect call to absolute memory address
3E9C 101005AC .text CALL [static] | Indirect call to absolute memory address
3ECB 101003AC .text CALL [static] | Indirect call to absolute memory address
3EF8 101005EC .text CALL [static] | Indirect call to absolute memory address
3F07 101003AC .text CALL [static] | Indirect call to absolute memory address
3FCA 101005C4 .text CALL [static] | Indirect call to absolute memory address
3FE7 101005AC .text CALL [static] | Indirect call to absolute memory address
4016 101003AC .text CALL [static] | Indirect call to absolute memory address
4043 101005EC .text CALL [static] | Indirect call to absolute memory address
405B 101003AC .text CALL [static] | Indirect call to absolute memory address
40F8 101003B4 .text CALL [static] | Indirect call to absolute memory address
4181 101005E8 .text CALL [static] | Indirect call to absolute memory address
420E 101003B4 .text CALL [static] | Indirect call to absolute memory address
4256 101003AC .text CALL [static] | Indirect call to absolute memory address
4265 101003B4 .text CALL [static] | Indirect call to absolute memory address
42E4 101005EC .text CALL [static] | Indirect call to absolute memory address
43E4 101005EC .text CALL [static] | Indirect call to absolute memory address
4560 101005A8 .text CALL [static] | Indirect call to absolute memory address
45E0 101005A8 .text CALL [static] | Indirect call to absolute memory address
4748 101005EC .text CALL [static] | Indirect call to absolute memory address
47F6 101005EC .text CALL [static] | Indirect call to absolute memory address
48B5 101005EC .text CALL [static] | Indirect call to absolute memory address
4A86 10100598 .text CALL [static] | Indirect call to absolute memory address
4AA0 101005E8 .text CALL [static] | Indirect call to absolute memory address
4B39 101005C4 .text CALL [static] | Indirect call to absolute memory address
4B7E 1010059C .text CALL [static] | Indirect call to absolute memory address
4B87 101005A0 .text CALL [static] | Indirect call to absolute memory address
4B8D 101005A4 .text CALL [static] | Indirect call to absolute memory address
4BD3 101005E8 .text CALL [static] | Indirect call to absolute memory address
4CBB 10100598 .text CALL [static] | Indirect call to absolute memory address
4CD0 1010039C .text CALL [static] | Indirect call to absolute memory address
4CD9 101003A0 .text CALL [static] | Indirect call to absolute memory address
4CED 1010059C .text CALL [static] | Indirect call to absolute memory address
4CF4 101003A4 .text CALL [static] | Indirect call to absolute memory address
4CFD 101005A0 .text CALL [static] | Indirect call to absolute memory address
4D03 101005A4 .text CALL [static] | Indirect call to absolute memory address
4D0A 101003A8 .text CALL [static] | Indirect call to absolute memory address
4D48 101005EC .text CALL [static] | Indirect call to absolute memory address
4E8C 101005E8 .text CALL [static] | Indirect call to absolute memory address
4F97 10100394 .text CALL [static] | Indirect call to absolute memory address
4FBD 10100398 .text CALL [static] | Indirect call to absolute memory address
542E 101003D0 .text CALL [static] | Indirect call to absolute memory address
1105C5-1105D2 N/A .rdata Potential obfuscated jump sequence detected, count: 7
Extra Analysis
Metric Value Percentage
Ascii Code 864807 57,687%
Null Byte Code 273957 18,2743%
NOP Cave Found 0x9090909090 Block Count: 3479 | Total: 0,5802%
© 2026 All rights reserved.