PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 3,89 MB SHA-256 Hash: 364D4E21AB46AB0AD21A02E5CF709177428A5E29B044522EACEC9BA987861ADF SHA-1 Hash: FD47246D4AF6D51DCCB3F8CCBA4066E89D5E5DF1 MD5 Hash: EEC3C73C662BE27228D156B765C53690 Imphash: A5A9C65C55B31C94540C9AD3E915FEE0 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 521462 SizeOfHeaders: 400 SizeOfImage: 671000 ImageBase: 0000000180000000 Architecture: x64 ExportTable: 29C3A8 ImportTable: 4D56D8 IAT: 4CF000 Characteristics: 2022 TimeDateStamp: 62ABD896 Date: 17/06/2022 1:27:50 File Type: DLL Number Of Sections: 10 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .detourc, .detourd, .UPX0, .UPX1, .reloc, .rsrc Number Of Executable Sections: 3 Subsystem: Windows GUI [Incomplete Binary or Compressor Packer - 2,55 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
0 | 0 | 1000 | 7DDD |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
0 | 0 | 9000 | 2CBC |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
0 | 0 | C000 | 1820 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
0 | 0 | E000 | 5AC |
|
|
| .detourc | 0x40000040 Initialized Data Readable |
0 | 0 | F000 | 21F0 |
|
|
| .detourd | 0xC0000040 Initialized Data Readable Writeable |
0 | 0 | 12000 | 18 |
|
|
| .UPX0 | 0x60000060 Code Initialized Data Executable Readable |
0 | 0 | 13000 | 2769FA |
|
|
| .UPX1 | 0x68000060 Code Initialized Data Shared Executable Readable |
400 | 3E4400 | 28A000 | 3E43C8 |
|
|
| .reloc | 0x40000040 Initialized Data Readable |
3E4800 | 200 | 66F000 | E4 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
3E4A00 | 600 | 670000 | 449 |
|
|
| Description |
| OriginalFilename: winmm.dll CompanyName: Www.ChinaPYG.CoM LegalCopyright: Copyright (C) 2022 ProductName: winmm HiJack Dynamic Link Library FileVersion: 1, 0, 0, 1001 FileDescription: Generated by Process HiJack64 ProductVersion: 1, 0, 0, 1001 Language: Chinese (Peoples Republic of China) (ID=0x804) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (8) have the Entry Point Information -> EntryPoint (calculated) - 297862 Code -> 681A7B1BB1E8C2880200DB2036DB95B38B5C27D03609C9245FD777C5241EDFADA5D89B8B425527B7B13EF324BD1AE6C92417 Assembler |PUSH -0X4EE484E6 |CALL 0X180549D2E |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compression: UPX Detect It Easy (die) • PE+(64): linker: Microsoft Linker(14.32)[-] • Entropy: 7.83962 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | GetThreadContext | Retrieves a thread execution context. |
| KERNEL32.DLL | SetThreadContext | Modifies a thread execution context. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| KERNEL32.DLL | VirtualProtectEx | Changes the protection on a region of memory in another process. |
| File Access |
| VCRUNTIME140.dll jKGaGe|api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll WTSAPI32.dll USER32.dll KERNEL32.dll winmm.dll SHLWAPI.dll api-ms-win-crt-runtime-l1-1-0.dll @.dat |
| File Access (UNICODE) |
| winmm.dll |
| Interest's Words |
| exec start pause systeminfo |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\2052 | 6700A0 | 318 | 3E4AA0 | 180334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\2\1033 | 6703B8 | 91 | 3E4DB8 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y |
| Intelligent String |
| • api-ms-win-crt-string-l1-1-0.dll • )jKGaGe|api-ms-win-crt-heap-l1-1-0.dll • Www.ChinaPYG.CoM • winmm.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| CAF7 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xE9B891CC] |
| CCB6 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xBADBA8C0] |
| CD2A | N/A | .UPX1 | CALL QWORD PTR [RIP+0x63A7685] |
| 1403C | N/A | .UPX1 | CALL QWORD PTR [RIP+0x423374D] |
| 261A3 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x4C7FFD5C] |
| 283F3 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x492FF62] |
| 28F8A | N/A | .UPX1 | CALL QWORD PTR [RIP+0x80CF7098] |
| 31025 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x1EF7E1EE] |
| 3208A | N/A | .UPX1 | CALL QWORD PTR [RIP+0xA04D97A5] |
| 367FA | N/A | .UPX1 | CALL QWORD PTR [RIP+0x7873D973] |
| 37927 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x405A6C96] |
| 3A802 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x310C5BC5] |
| 3CF55 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xF21085B4] |
| 409A6 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x2E4400A0] |
| 40EE1 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xE246FB90] |
| 41A0C | N/A | .UPX1 | CALL QWORD PTR [RIP+0x82B50A9C] |
| 42D2E | N/A | .UPX1 | CALL QWORD PTR [RIP+0x30489633] |
| 4DC6E | N/A | .UPX1 | CALL QWORD PTR [RIP+0x63C26264] |
| 56FD5 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x965AF2A6] |
| 5BFAD | N/A | .UPX1 | CALL QWORD PTR [RIP+0xA3EEA73A] |
| 5F8AB | N/A | .UPX1 | JMP QWORD PTR [RIP+0x16AA5F5E] |
| 612BA | N/A | .UPX1 | CALL QWORD PTR [RIP+0x4312C6F1] |
| 61537 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xA3EFD57E] |
| 652BC | N/A | .UPX1 | JMP QWORD PTR [RIP+0xDBFBA61A] |
| 6AC59 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x791B3AA9] |
| 6EF67 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xCC0EBF03] |
| 6FADC | N/A | .UPX1 | JMP QWORD PTR [RIP+0xFDB0895A] |
| 72885 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x41568A65] |
| 74E0D | N/A | .UPX1 | JMP QWORD PTR [RIP+0x97BDCD51] |
| 8D6F4 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xC93A7811] |
| 9E2C4 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xB45B310D] |
| BB3A7 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x44DC514A] |
| C2011 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x97288449] |
| C4568 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xB7B172D7] |
| C7CCB | N/A | .UPX1 | CALL QWORD PTR [RIP+0xB98A2CAF] |
| D6F9F | N/A | .UPX1 | CALL QWORD PTR [RIP+0xAD8C4C96] |
| E3F36 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x2F7D3455] |
| E5DCA | N/A | .UPX1 | CALL QWORD PTR [RIP+0x7B431ED3] |
| E71DE | N/A | .UPX1 | CALL QWORD PTR [RIP+0xB8B82EB7] |
| F53F2 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xF190F34F] |
| 105B75 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x969BAD3A] |
| 111A69 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x5FDCB766] |
| 112174 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x60061A70] |
| 1140EB | N/A | .UPX1 | CALL QWORD PTR [RIP+0x15403217] |
| 114CBC | N/A | .UPX1 | CALL QWORD PTR [RIP+0x6E786392] |
| 12A057 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x9B08CD81] |
| 12EAFF | N/A | .UPX1 | CALL QWORD PTR [RIP+0x62E53EBF] |
| 130091 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x71D7DE1B] |
| 132968 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xB419D468] |
| 13367B | N/A | .UPX1 | JMP QWORD PTR [RIP+0xEF2272EF] |
| 1350E0 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xBD64B13] |
| 136615 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x8B4861D4] |
| 138E96 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xCDE18B83] |
| 1397E2 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x8CBBA360] |
| 1398DE | N/A | .UPX1 | CALL QWORD PTR [RIP+0xA4323EC5] |
| 13E1A8 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xC05C0487] |
| 13EB40 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x7535EA03] |
| 141920 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xE08CFFDE] |
| 148221 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xCE9ECA75] |
| 1549DB | N/A | .UPX1 | JMP QWORD PTR [RIP+0x5F23B864] |
| 171A8F | N/A | .UPX1 | JMP QWORD PTR [RIP+0x25B130D9] |
| 171FE1 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xA538E722] |
| 1751EE | N/A | .UPX1 | CALL QWORD PTR [RIP+0xD7E67DD4] |
| 188670 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x4EAC3EA] |
| 1886D6 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xE6214234] |
| 1998F3 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x640076FC] |
| 1AAB51 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x256B0C0A] |
| 1B6016 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xC3FD7DD7] |
| 1B6992 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xBA17C5CE] |
| 1C6D02 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x97525C03] |
| 1C8E62 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xF913DEA9] |
| 1D2793 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xF6BF6B8F] |
| 1DEE95 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x8F7949BB] |
| 1E549A | N/A | .UPX1 | CALL QWORD PTR [RIP+0x14742AC3] |
| 1F4537 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xE3486095] |
| 1F983D | N/A | .UPX1 | CALL QWORD PTR [RIP+0x13DA639D] |
| 1F9A6C | N/A | .UPX1 | CALL QWORD PTR [RIP+0xDB428833] |
| 1FA37A | N/A | .UPX1 | CALL QWORD PTR [RIP+0x688EBA33] |
| 20C4F6 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xB5A83201] |
| 20CCA0 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x73470DE8] |
| 218A41 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x2CF6CFC3] |
| 21AED9 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xFCBA4150] |
| 21CCA0 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xA96BCBA8] |
| 226CF5 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xA65EAAFA] |
| 22889A | N/A | .UPX1 | JMP QWORD PTR [RIP+0x91CF8CAE] |
| 22CF47 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x8B11AF76] |
| 2341AF | N/A | .UPX1 | JMP QWORD PTR [RIP+0xA6E75448] |
| 237189 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x680F0227] |
| 23DEC3 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xCD91B83C] |
| 24156C | N/A | .UPX1 | JMP QWORD PTR [RIP+0x3ED1C399] |
| 247E7E | N/A | .UPX1 | CALL QWORD PTR [RIP+0x8273F8F0] |
| 249B08 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x87D4CB6] |
| 24E2A4 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xEB143B57] |
| 24ECDF | N/A | .UPX1 | CALL QWORD PTR [RIP+0x8554BB67] |
| 24EDCD | N/A | .UPX1 | JMP QWORD PTR [RIP+0xAAD7871D] |
| 24F6D1 | N/A | .UPX1 | JMP QWORD PTR [RIP+0xC6B896CD] |
| 251A94 | N/A | .UPX1 | CALL QWORD PTR [RIP+0xEA096BC8] |
| 264A4E | N/A | .UPX1 | CALL QWORD PTR [RIP+0xDD2F8220] |
| 2690F0 | N/A | .UPX1 | CALL QWORD PTR [RIP+0x9B31EC0E] |
| 26DCA7 | N/A | .UPX1 | JMP QWORD PTR [RIP+0x6815F9AE] |
| 400-3E47FF | 28A000 | .UPX1 | Executable section anomaly, first bytes: E103707CE14D6414 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 2786762 | 68,2409% |
| Null Byte Code | 103427 | 2,5327% |
© 2026 All rights reserved.