PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Size: 3,36 MB
SHA-256 Hash: BEAA04EE50CC156401AA43AD4A8674797B8A51743A0F47F59AC78BAFFDEC7C5A
SHA-1 Hash: CA7615F768EA0310547720AC4A206C30CBE6EDAB
MD5 Hash: F680B1D8BCEB1B35A2176AB36C6B5116
Imphash: 5866281E215E3423206A9A3F2DD81B7E
MajorOSVersion: 6
MinorOSVersion: 1
CheckSum: 00000000
EntryPoint (rva): 2B0B990
SizeOfHeaders: 200
SizeOfImage: 2B0E000
ImageBase: 00000001EABC0000
Architecture: x64
ExportTable: 2B0D204
ImportTable: 2B0D000
Characteristics: 222E
TimeDateStamp: 0
Date: 01/01/1970
File Type: DLL
Number Of Sections: 3
ASLR: Disabled
Section Names (Optional Header): UPX0, UPX1, UPX2
Number Of Executable Sections: 2
Subsystem: Windows GUI
[Incomplete Binary or Compressor Packer - 39,69 MB Missing]
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
UPX0
0xE0000080
Uninitialized Data
Executable
Readable
Writeable
 200 0 1000 27AF000
N/A
N/A
UPX1
0xE0000040
Initialized Data
Executable
Readable
Writeable
 200 35C800 27B0000 35D000
7.9999
333.9
UPX2
0xC0000040
Initialized Data
Readable
Writeable
 35CA00 400 2B0D000 1000
3.2712
87414
Entry Point
The section number (2) have the Entry Point
Information -> EntryPoint (calculated) - 35BB90
Code -> 48894C240848895424104C8944241880FA010F850C0C000053565755488D357246CAFF488DBEDB0F85FD488D879C8AAE02FF
Assembler
|MOV QWORD PTR [RSP + 8], RCX
|MOV QWORD PTR [RSP + 0X10], RDX
|MOV QWORD PTR [RSP + 0X18], R8
|CMP DL, 1
|JNE 0X1ED6CC5B4
|PUSH RBX
|PUSH RSI
|PUSH RDI
|PUSH RBP
|LEA RSI, [RIP - 0X35B98E]
|LEA RDI, [RSI - 0X27AF025]
|LEA RAX, [RDI + 0X2AE8A9C]
Signatures
Certificate - Digital Signature Not Found:
• The file is not signed
Packer/Compiler
Compression: UPX
Detect It Easy (die)
• PE+(64): packer: UPX(5.11)[LZMA,brute]
• Entropy: 7.9999
Suspicious Functions
Library Function Description
KERNEL32.DLL LoadLibraryA Loads the specified module into the address space of the calling process.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
File Access
test.dll
KERNEL32.DLL
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-private-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
|@0.MSi
Interest's Words
start
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Ascii Stealth (VirtualProtect)
Intelligent String
• 9Aa
• .PDr
• $1o26
Flow Anomalies
Offset FlowVA Section Description
6BB5 N/A UPX1 CALL QWORD PTR [RIP+0x2002D970]
7069 N/A UPX1 CALL QWORD PTR [RIP+0x66AC662D]
ACC2 N/A UPX1 CALL QWORD PTR [RIP+0x98C594E2]
DC9C N/A UPX1 CALL QWORD PTR [RIP+0xC2C3E5B0]
1129C N/A UPX1 CALL QWORD PTR [RIP+0xF35D160E]
176FF N/A UPX1 JMP QWORD PTR [RIP+0xCFE4CD06]
3282E N/A UPX1 CALL QWORD PTR [RIP+0x8558E13D]
338CE N/A UPX1 JMP QWORD PTR [RIP+0x88928803]
49C6E N/A UPX1 JMP QWORD PTR [RIP+0xEAEC7CC0]
4B6AF N/A UPX1 JMP QWORD PTR [RIP+0x4CA72405]
5A56F N/A UPX1 JMP QWORD PTR [RIP+0x3CE7A55A]
5A7AF N/A UPX1 CALL QWORD PTR [RIP+0x4F562B1C]
6026C N/A UPX1 JMP QWORD PTR [RIP+0xBC1BBA29]
7D89C N/A UPX1 JMP QWORD PTR [RIP+0x337DC58C]
90BF7 N/A UPX1 JMP QWORD PTR [RIP+0x1C54F1B9]
92C71 N/A UPX1 JMP QWORD PTR [RIP+0x673272B1]
96452 N/A UPX1 CALL QWORD PTR [RIP+0x8C56F8BC]
A7824 N/A UPX1 JMP QWORD PTR [RIP+0x7D654C45]
A96B3 N/A UPX1 JMP QWORD PTR [RIP+0xE052CED1]
AAACF N/A UPX1 JMP QWORD PTR [RIP+0x93FDAF0B]
AB54C N/A UPX1 JMP QWORD PTR [RIP+0xD1D442E5]
AF312 N/A UPX1 CALL QWORD PTR [RIP+0xE25B22E3]
C76E2 N/A UPX1 JMP QWORD PTR [RIP+0x7C55E47F]
D04E9 N/A UPX1 JMP QWORD PTR [RIP+0x4C186902]
D0F59 N/A UPX1 CALL QWORD PTR [RIP+0x4CF12E9F]
D90F7 N/A UPX1 CALL QWORD PTR [RIP+0x49AB4723]
DFC17 N/A UPX1 JMP QWORD PTR [RIP+0xB2C0A3AE]
E2E83 N/A UPX1 JMP QWORD PTR [RIP+0x21B12356]
E794C N/A UPX1 CALL QWORD PTR [RIP+0x7611C9FB]
EC550 N/A UPX1 CALL QWORD PTR [RIP+0xD603F740]
EFB76 N/A UPX1 CALL QWORD PTR [RIP+0xF3C79F33]
F2F47 N/A UPX1 CALL QWORD PTR [RIP+0xD8509295]
10116E N/A UPX1 JMP QWORD PTR [RIP+0x43CDC8D1]
122E03 N/A UPX1 JMP QWORD PTR [RIP+0xED522175]
124752 N/A UPX1 CALL QWORD PTR [RIP+0x769F0278]
1269C1 N/A UPX1 CALL QWORD PTR [RIP+0x98181173]
12D876 N/A UPX1 JMP QWORD PTR [RIP+0xBA1E5F3A]
130689 N/A UPX1 CALL QWORD PTR [RIP+0x559C5B67]
131CE3 N/A UPX1 CALL QWORD PTR [RIP+0xA36ADE98]
13C322 N/A UPX1 CALL QWORD PTR [RIP+0xBD05E05F]
14786D N/A UPX1 CALL QWORD PTR [RIP+0x27B04A09]
14AF26 N/A UPX1 CALL QWORD PTR [RIP+0x58250B91]
14F4E0 N/A UPX1 JMP QWORD PTR [RIP+0x63A9EE58]
150467 N/A UPX1 CALL QWORD PTR [RIP+0x2CECF299]
155050 N/A UPX1 JMP QWORD PTR [RIP+0x7DA7A596]
156BB6 N/A UPX1 JMP QWORD PTR [RIP+0x94A32D2D]
160B61 N/A UPX1 JMP QWORD PTR [RIP+0x74A5729E]
179614 N/A UPX1 CALL QWORD PTR [RIP+0xAB7987EA]
17D776 N/A UPX1 CALL QWORD PTR [RIP+0x1942CE9F]
17FAC3 N/A UPX1 CALL QWORD PTR [RIP+0x6549D154]
189972 N/A UPX1 CALL QWORD PTR [RIP+0x905D4EC]
18F349 N/A UPX1 CALL QWORD PTR [RIP+0xCD4EDD38]
193590 N/A UPX1 CALL QWORD PTR [RIP+0xC23F042]
197BD4 N/A UPX1 JMP QWORD PTR [RIP+0x8B5D33F7]
1AC4AF N/A UPX1 JMP QWORD PTR [RIP+0xBAB5173A]
1AE2D4 N/A UPX1 CALL QWORD PTR [RIP+0xB11844F0]
1AF339 N/A UPX1 CALL QWORD PTR [RIP+0xD3ADF18B]
1B184A N/A UPX1 JMP QWORD PTR [RIP+0xEA13B46B]
1BDF46 N/A UPX1 CALL QWORD PTR [RIP+0x38FA851C]
1C64B4 N/A UPX1 JMP QWORD PTR [RIP+0x23D7B0E9]
1C8238 N/A UPX1 CALL QWORD PTR [RIP+0xA7C8BB1C]
1CA437 N/A UPX1 JMP QWORD PTR [RIP+0xB39D9632]
1CF8D9 N/A UPX1 JMP QWORD PTR [RIP+0x9E051382]
1DDE8B N/A UPX1 JMP QWORD PTR [RIP+0x1A761AE3]
1E83FD N/A UPX1 JMP QWORD PTR [RIP+0x78B63BE5]
1EEC5F N/A UPX1 CALL QWORD PTR [RIP+0xE6920FF4]
1F86DB N/A UPX1 JMP QWORD PTR [RIP+0x9E9A2D01]
1FBB70 N/A UPX1 JMP QWORD PTR [RIP+0xAE034DD6]
200634 N/A UPX1 CALL QWORD PTR [RIP+0xF3ABD010]
21627E N/A UPX1 CALL QWORD PTR [RIP+0xE74D4BE]
21A7E2 N/A UPX1 CALL QWORD PTR [RIP+0x9EAED23D]
21ECEB N/A UPX1 JMP QWORD PTR [RIP+0xD2305204]
223254 N/A UPX1 JMP QWORD PTR [RIP+0x575ED36E]
2321FB N/A UPX1 JMP QWORD PTR [RIP+0xA0332D84]
23CFF6 N/A UPX1 JMP QWORD PTR [RIP+0xC0C57BCF]
23D5AD N/A UPX1 CALL QWORD PTR [RIP+0xBE1025DE]
24627A N/A UPX1 JMP QWORD PTR [RIP+0x5DED378B]
249259 N/A UPX1 CALL QWORD PTR [RIP+0x198F2BC2]
24FA03 N/A UPX1 JMP QWORD PTR [RIP+0xAE9D2BC4]
25813A N/A UPX1 CALL QWORD PTR [RIP+0xDE29800A]
25D049 N/A UPX1 CALL QWORD PTR [RIP+0x7275F3FB]
263B0C N/A UPX1 CALL QWORD PTR [RIP+0x3A972A99]
264661 N/A UPX1 CALL QWORD PTR [RIP+0x6A11D511]
268FF8 N/A UPX1 JMP QWORD PTR [RIP+0x4E8C7451]
26E84D N/A UPX1 CALL QWORD PTR [RIP+0x5972E824]
26FB21 N/A UPX1 JMP QWORD PTR [RIP+0x8D7DB02D]
272426 N/A UPX1 JMP QWORD PTR [RIP+0xB5CB9DCA]
27B862 N/A UPX1 JMP QWORD PTR [RIP+0x1CA070AE]
281D0B N/A UPX1 JMP QWORD PTR [RIP+0x71045AC3]
2861DB N/A UPX1 CALL QWORD PTR [RIP+0xBF4F7302]
28F69F N/A UPX1 JMP QWORD PTR [RIP+0xAE326FC8]
290809 N/A UPX1 JMP QWORD PTR [RIP+0xF7F0E29E]
2C2A7D N/A UPX1 JMP QWORD PTR [RIP+0x5A8F6C20]
2CA6A8 N/A UPX1 CALL QWORD PTR [RIP+0x6E494A3A]
2D2B3A N/A UPX1 CALL QWORD PTR [RIP+0x15EC041E]
2DAEA7 N/A UPX1 CALL QWORD PTR [RIP+0xCF2C079B]
2DD6E2 N/A UPX1 JMP QWORD PTR [RIP+0x7430768C]
2E6EFB N/A UPX1 CALL QWORD PTR [RIP+0x437552EF]
2EA0A1 N/A UPX1 JMP QWORD PTR [RIP+0xFEB010F3]
2FD7C8 N/A UPX1 JMP QWORD PTR [RIP+0x1FF44095]
35C820 1ED6CC5C8 UPX1 TLS Callback | Pointer to 2B0C5C8 - 0x35C7C8 UPX1
200-35C9FF 27B0000 UPX1 Executable section anomaly, first bytes: 352E313100555058
Extra Analysis
Metric Value Percentage
Ascii Code 2423834 68,7389%
Null Byte Code 15550 0,441%
© 2026 All rights reserved.