PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,42 MBSHA-256 Hash: AA38CE67B31BC1AE0B204C5CA0681680A5D1BBBAE0C336A6943A388BB54A9AAD SHA-1 Hash: 0FB79B8C4AD556C3F10A12EB512E398EF34599AE MD5 Hash: F91BFEF5C00E9F84E14B570EEA1B6460 Imphash: D41D8CD98F00B204E9800998ECF8427E MajorOSVersion: 1 MinorOSVersion: 11 CheckSum: 00000000 EntryPoint (rva): BEB4C SizeOfHeaders: 400 SizeOfImage: 445000 ImageBase: 400000 Architecture: x86 ImportTable: F8000 Characteristics: 1A2 TimeDateStamp: 356D4403 Date: 28/05/1998 11:01:23 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names: AUTO, .idata, DGROUP, .bss, .reloc, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI [Incomplete Binary or Compressor Packer - 2,85 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| AUTO | 0x60000020 Code Executable Readable |
400 | F6E00 | 1000 | 0 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
F7200 | 1000 | F8000 | 0 |
|
|
| DGROUP | 0xC0000040 Initialized Data Readable Writeable |
F8200 | 33000 | F9000 | 0 |
|
|
| .bss | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 2D7600 | 12C000 | 0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
12B200 | 15A00 | 404000 | 0 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
140C00 | 2A800 | 41A000 | 0 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 4BDDA9 |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: Watcom(-)[-] • PE: linker: Watcom Linker(2.18*)[-] • Entropy: 6.64042 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| Windows REG |
| SOFTWARE\Psygnosis\Studios\G-Police System\CurrentControlSet\control\Nls\Codepage System\CurrentControlSet\Control\MediaResources\Joystick System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\OEM |
| File Access |
| USER32.DLL ?W32SKRNL.DLL DINPUT.dll DSOUND.dll DDRAW.dll KERNEL32.dll WINMM.dll GDI32.dll ADVAPI32.dll ole32.dll Temp |
| Interest's Words |
| exec attrib start pause systeminfo ping replace |
| Interest's Words (UNICODE) |
| start |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (send) |
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (CreateEventA) |
| Text | Ascii | Related to the rights and duties of citizens (Civil) |
| Intelligent String |
| • .bss • DOOBIESMRTICKYSTATTOECAM1A.MPG • CAM2A.MPG • CAM3A.MPG • CAM4A.MPG • CAM5A.MPG • CAM6A.MPG • CAM7A.MPG • STR1A.MPG • STR2A.MPG • STR3A.MPG • STR4A.MPG • STR5A.MPG • STR6A.MPG • OUTA.MPG • PSYGLOGO.MPG • LOGO.MPG • INTA.MPG • INTH.MPG • HORTA.MPG • demo.rec • .RDR • RDR2.RDA • mixout.raw |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| D079 | FF | AUTO | JMP [static] | Indirect jump to absolute memory address |
| D326 | FF | AUTO | JMP [static] | Indirect jump to absolute memory address |
| D5B3 | FF | AUTO | JMP [static] | Indirect jump to absolute memory address |
| D89A | FF | AUTO | JMP [static] | Indirect jump to absolute memory address |
| DE54 | FF | AUTO | JMP [static] | Indirect jump to absolute memory address |
| E145 | FF | AUTO | JMP [static] | Indirect jump to absolute memory address |
| F87C | FF | AUTO | JMP [static] | Indirect jump to absolute memory address |
| 11BAF | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11BCC | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11BE6 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11C1C | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11C33 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11C7A | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11DD4 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11EE5 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11F48 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 11FC8 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 120B3 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 12168 | 4F8378 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 121BA | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 12217 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 12280 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 12318 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 1237C | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 123D7 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 1246A | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 12492 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 124BB | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 12503 | 4F8390 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 12551 | 4F8438 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 12566 | 4F856C | AUTO | CALL [static] | Indirect call to absolute memory address |
| 25CD2 | 5256F8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27578 | 5256E4 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 275AA | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 275C4 | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 275DE | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 275F8 | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27A3B | 5256E4 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27AC7 | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27B07 | 5255DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27B16 | 5255E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27B1C | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27C20 | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27C3A | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27C54 | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27C6E | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 27C8A | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 28084 | 5255DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 28115 | 5255E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 28128 | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 28170 | 5256E4 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 283D0 | 5255DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 283DA | 5255E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 283E0 | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 363E9 | 4F84B0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 36944 | 4F8494 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 36987 | 4F84DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 37D79 | 4F8494 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 37DBC | 4F84DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 38CFC | 5256E4 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 38D2E | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 38D48 | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 38D62 | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 38D7C | 5256E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 39A06 | FF | AUTO | JMP [static] | Indirect jump to absolute memory address |
| 3BACC | 5255DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BAE9 | 5256FC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BAEF | 5255E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BAF5 | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BCC5 | 5255DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BCE2 | 5256FC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BD09 | 5255E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BD0F | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BFB4 | 5255DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3BFD1 | 5256FC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3C001 | 5255E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3C007 | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3C223 | 5255DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3C346 | 5255E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3C34C | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3C479 | 5255E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3C47F | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 3C4AF | 5255DC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 4A071 | 5255E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 4A0FD | 5255F0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 54ED4 | 5255F0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 5511D | 5256E0 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 55126 | 5255EC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 55158 | 5255EC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 55183 | 5255EC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 570CB | 5255E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 570E3 | 5255E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 57126 | 5255EC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 57137 | 5255EC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 57337 | 5255EC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 57372 | 5255E8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 57961 | 5255EC | AUTO | CALL [static] | Indirect call to absolute memory address |
| 57D8C | 4F84D8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 57DE4 | 4F84D8 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 57DEF | 525610 | AUTO | CALL [static] | Indirect call to absolute memory address |
| 400-F71FF | 1000 | AUTO | Executable section anomaly, first bytes: CCEBFD9090909000 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 854448 | 57,4275% |
| Null Byte Code | 255608 | 17,1794% |
| NOP Cave Found | 0x9090909090 | Block Count: 1 | Total: 0,0002% |
© 2026 All rights reserved.