PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 200,00 KBSHA-256 Hash: 73FA56BBB50BAE132B806F1E4DE105050710339A8739066ABA7E2FFE813178C5 SHA-1 Hash: D2BAA213182DE11C01A8202A0AE00D6A9AB0AFDD MD5 Hash: FAF420FE944FBA276DFE6237977EDBAD Imphash: 6CD1FECE03C328D89AB8176A1DBE9927 MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): EDA0 SizeOfHeaders: 400 SizeOfImage: 36000 ImageBase: 400000 Architecture: x86 ImportTable: 1B5D0 IAT: 13000 Characteristics: 102 TimeDateStamp: 69F20000 Date: 29/04/2026 12:56:32 File Type: EXE Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .reloc, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 11E00 | 1000 | 11D4A |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
12200 | 9400 | 13000 | 921A |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
1B600 | A00 | 1D000 | 1028 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
1C000 | 1200 | 1F000 | 1100 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1D200 | 14E00 | 21000 | 14C08 |
|
|
| Description |
| OriginalFilename: Crm.Admin.dll CompanyName: Crm.Admin ProductName: Crm.Admin FileVersion: 26.7.20.4 FileDescription: Crm.Admin ProductVersion: 26.7.20.4+b8889fc95c5cb219ef4d0601bcfa225df17baa28 Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - E1A0 Code -> E84D070000E968FEFFFF8B4DF464890D00000000595F5F5E5B8BE55D51C35064FF35000000008D44240C2B64240C53565789 Assembler |CALL 0X1752 |JMP 0XE72 |MOV ECX, DWORD PTR [EBP - 0XC] |MOV DWORD PTR FS:[0], ECX |POP ECX |POP EDI |POP EDI |POP ESI |POP EBX |MOV ESP, EBP |POP EBP |PUSH ECX |RET |PUSH EAX |PUSH DWORD PTR FS:[0] |LEA EAX, [ESP + 0XC] |SUB ESP, DWORD PTR [ESP + 0XC] |PUSH EBX |PUSH ESI |PUSH EDI |
| Signatures |
| Rich Signature Analyzer: Code -> 63201667274178342741783427417834A0C87B3528417834A0C87C3536417834A0C87D35724178342E39EB34374178345EC079352E41783427417934E1417834BEC871352D417834BEC87A35264178345269636827417834 Footprint md5 Hash -> F5E6D350ADA17BBF45A9FD9449F3B027 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32] • PE: compiler: Microsoft Visual C/C++(-)[-] • PE: linker: Microsoft Linker(14.44**)[-] • Entropy: 6.42301 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| SOFTWARE\dotnet |
| File Access |
| Crm.Admin.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-locale-l1-1-0.dll api-ms-win-crt-time-l1-1-0.dll api-ms-win-crt-convert-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-heap-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll ADVAPI32.dll SHELL32.dll USER32.dll KERNEL32.dll ntdll.dll .dat @.dat Temp |
| File Access (UNICODE) |
| Admin.dll Akernel32.dll comctl32.dll hostfxr.dll ProgramFiles |
| Interest's Words |
| exec attrib start |
| Interest's Words (UNICODE) |
| exec start |
| URLs (UNICODE) |
| https://go.microsoft.com/fwlink/?linkid=798306 https://aka.ms/dotnet-core-applaunch? https://aka.ms/dotnet/app-launch-failed https://aka.ms/dotnet/app-launch-failedWould you like to download it now? https://aka.ms/dotnet/app-launch-failedDownload the .NET runtime:%s&apphost_version=%s |
| IP Addresses |
| 26.7.20.4 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegGetValue) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Unicode | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Entry Point | Hex Pattern | fasm - Tomasz Grysztar |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\0 | 21270 | 2E8 | 1D470 | 2800000020000000400000000100040000000000800200000000000000000000100000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\2\0 | 21558 | 128 | 1D758 | 2800000010000000200000000100040000000000C00000000000000000000000100000000000000000000000000080000080 | (....... ......................................... |
| \ICON\3\0 | 21680 | EA8 | 1D880 | 2800000030000000600000000100080000000000800A0000000000000000000000010000000000000000000019181700161B | (...0............................................ |
| \ICON\4\0 | 22528 | 8A8 | 1E728 | 28000000200000004000000001000800000000008004000000000000000000000001000000000000000000001E2C3B002934 | (... ...@....................................,;.)4 |
| \ICON\5\0 | 22DD0 | 568 | 1EFD0 | 280000001000000020000000010008000000000040010000000000000000000000010000000000000000000056705000657B | (....... ...........@.......................VpP.e{ |
| \ICON\6\0 | 23338 | 7A79 | 1F538 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A86600007A404944415478DAEC5D059C14651B | .PNG........IHDR.............\r.f..z@IDATx..]...e. |
| \ICON\7\0 | 2ADB4 | 4228 | 26FB4 | 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000 | (...@......... ......B............................ |
| \ICON\8\0 | 2EFDC | 25A8 | 2B1DC | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\9\0 | 31584 | 1A68 | 2D784 | 2800000028000000500000000100200000000000401A00000000000000000000000000000000000000000000000000000000 | (...(...P..... .....@............................. |
| \ICON\10\0 | 32FEC | 10A8 | 2F1EC | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\11\0 | 34094 | 988 | 30294 | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000 | (.......0..... .................................. |
| \ICON\12\0 | 34A1C | 6B8 | 30C1C | 2800000014000000280000000100200000000000900600000000000000000000000000000000000000000000000000000000 | (.......(..... ................................... |
| \ICON\13\0 | 350D4 | 468 | 312D4 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000 | (....... ..... .....@............................. |
| \GROUP_ICON\32512\0 | 3553C | BC | 3173C | 000001000D002020100001000400E8020000010010101000010004002801000002003030000001000800A80E000003002020 | ...... ....................(.....00............ |
| \VERSION\1\0 | 355F8 | 324 | 317F8 | 240334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000700 | $.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\0 | 3591C | 1EA | 31B1C | EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65 | ...<?xml version="1.0" encoding="UTF-8" standalone |
| Intelligent String |
| • Crm.Admin.dll • 26.7.20.4 • api-ms-win-crt-heap-l1-1-0.dll • api-ms-win-crt-stdio-l1-1-0.dll • 0_time64api-ms-win-crt-runtime-l1-1-0.dll • https://aka.ms/dotnet/app-launch-failed • hostfxr.dll • https://go.microsoft.com/fwlink/?linkid=798306 • <A HREF=" • comctl32.dll • TaskDialogIndirect • Akernel32.dll • ntdll.dll • D:\a\_work\1\s\artifacts\obj\win-x86.Release\corehost\apphost\standalone\apphost.pdb • .tls • .bss • KERNEL32.dll • api-ms-win-crt-string-l1-1-0.dll • api-ms-win-crt-convert-l1-1-0.dll • api-ms-win-crt-time-l1-1-0.dll • api-ms-win-crt-locale-l1-1-0.dll • api-ms-win-crt-math-l1-1-0.dll • 26.7.20.4+b8889fc95c5cb219ef4d0601bcfa225df17baa28 |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 508 | 41307C | .text | CALL [static] | Indirect call to absolute memory address |
| 7B1 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 817 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 861 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 8AE | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| AD8 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| BFA | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| C88 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| E16 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 1110 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 1128 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 1291 | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 12A9 | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 12C1 | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 12D9 | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 12F1 | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 130C | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 13B2 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 1402 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 16B5 | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 16C1 | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 17BB | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 196B | 4131B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1973 | 4131B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 197B | 4131B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1984 | 4131A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 19DA | 41300C | .text | CALL [static] | Indirect call to absolute memory address |
| 1AEE | 413010 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AF5 | 413008 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B31 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D35 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 20C6 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 213E | 413020 | .text | CALL [static] | Indirect call to absolute memory address |
| 2150 | 41307C | .text | CALL [static] | Indirect call to absolute memory address |
| 215E | 41301C | .text | CALL [static] | Indirect call to absolute memory address |
| 21AD | 41304C | .text | CALL [static] | Indirect call to absolute memory address |
| 21BD | 413084 | .text | CALL [static] | Indirect call to absolute memory address |
| 22A4 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 22CF | 4130E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 22D6 | 41301C | .text | CALL [static] | Indirect call to absolute memory address |
| 2312 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 236E | 4130E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 2426 | 4130FC | .text | CALL [static] | Indirect call to absolute memory address |
| 24EB | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 262E | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AD9 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 2B51 | 413080 | .text | CALL [static] | Indirect call to absolute memory address |
| 2BFE | 413094 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C21 | 413088 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D27 | 4130F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D54 | 4130E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 3075 | 41308C | .text | CALL [static] | Indirect call to absolute memory address |
| 307F | 413088 | .text | CALL [static] | Indirect call to absolute memory address |
| 311C | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 316C | 413088 | .text | CALL [static] | Indirect call to absolute memory address |
| 31CC | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 32CE | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 337E | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 3396 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 365C | 41304C | .text | CALL [static] | Indirect call to absolute memory address |
| 36FF | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 374A | 41310C | .text | CALL [static] | Indirect call to absolute memory address |
| 38BA | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 39FF | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 4258 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4351 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 43BB | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 444E | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4466 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4532 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 454C | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4787 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 47A1 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 48A6 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4917 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4978 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4A25 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4BC0 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 4BF0 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 4D40 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E1B | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 5109 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5131 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 514C | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5164 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 52C1 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5328 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 5382 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 54D3 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 554A | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5683 | 413148 | .text | CALL [static] | Indirect call to absolute memory address |
| 56D6 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5715 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 58E4 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 596B | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 59D0 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5A60 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5AD3 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5B50 | 4131FC | .text | CALL [static] | Indirect call to absolute memory address |
| 5C07 | 4131C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 82B0-82CF | N/A | .text | Unusual BP Cave, count: 32 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 106116 | 51,8145% |
| Null Byte Code | 50365 | 24,5923% |
© 2026 All rights reserved.