PESCAN.IO - Analysis Report

PESCAN.IO - Analysis Report

File Structure:
PE chart code: - The executable header is displayed in light blue. - The executable sections are pink. - Non-executable sections are black. - Code added to executables externally to a compiler appears in red. Chart code for other files: - Printable characters are blue. - Non-printable characters (Null Bytes) are black.

Information:

Size: 149,50 KB
SHA-256 Hash: 8E36D4F98A882487BEDBEDF73CBB010F793C7BB529D133A58673A14850198F9F
SHA-1 Hash: AB5CD40EF781545F856C17E99A56F75EB313AC72
MD5 Hash: EE4A28F13637B0F90A1865366FAE40AE
Imphash: F34D5F2D4577ED6D9CEEC516C1F5A744
MajorOSVersion: 4
CheckSum: 00000000
EntryPoint (rva): 26B62
SizeOfHeaders: 200
SizeOfImage: 2C000
ImageBase: 400000
Architecture: x86
ImportTable: 26B08
Characteristics: 10E
TimeDateStamp: 68625061
Date: 30/06/2025 8:52:49
File Type: EXE
Number Of Sections: 3
ASLR: Disabled
Section Names: .text, .reloc, .rsrc
Number Of Executable Sections: 1
Subsystem: Windows GUI
UAC Execution Level Manifest: asInvoker

Sections Info:

Section Name	Flags	ROffset	RSize	VOffset	VSize
.text	60000020 (Executable)	200	24C00	2000	24B68
.reloc	42000040	24E00	200	28000	C
.rsrc	40000040	25000	600	2A000	588

Description:

InternalName: SDGSD.exe
OriginalFilename: SDGSD.exe
LegalCopyright: Copyright 2025
ProductName: SDGSD
FileVersion: 1.0.0.0

Entry Point:

The section number (1) - (.text) have the Entry Point
Information -> EntryPoint (calculated) - 24D62
Code -> FF25002040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
• JMP DWORD PTR [0X402000]
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL
• ADD BYTE PTR [EAX], AL

Signatures:

Certificate - Digital Signature Not Found:
• The file is not signed

Packer/Compiler:

Compiler: Microsoft Visual .NET - (You can use a decompiler for this...)
• AnyCPU: False
• Version: v4.0
Detect It Easy (die)
• PE: protector: Crypto Obfuscator For .Net(5.X)[-]
• PE: library: .NET(v4.0.30319)[-]
• PE: compiler: VB.NET(-)[-]
• PE: linker: Microsoft Linker(80.0)[EXE32]
• Entropy: 7.67668

File Access:

SDGSD.exe
mscoree.dll
Temp

File Access (UNICODE):

SDGSD.exe

Interest's Words:

Decrypt
exec
attrib
start
cipher
replace

IP Addresses:

11.0.0.0
16.0.0.0
16.10.0.0

Strings/Hex Code Found With The File Rules:

• Rule Text (Ascii): Encryption (CipherMode)
• Rule Text (Ascii): Encryption (CreateDecryptor)
• Rule Text (Ascii): Encryption (DESCryptoServiceProvider)
• Rule Text (Ascii): Encryption (FromBase64String)
• Rule Text (Ascii): Encryption (ICryptoTransform)
• Rule Text (Ascii): Encryption (MD5CryptoServiceProvider)
• EP Rules: Microsoft Visual C / Basic .NET
• EP Rules: Microsoft Visual C++ 8
• EP Rules: Microsoft Visual C++ 8.0
• EP Rules: Microsoft Visual C v7.0 / Basic .NET
• EP Rules: Microsoft Visual Studio .NET
• EP Rules: .NET executable

Resources:

Path	DataRVA	Size	FileOffset	Code	Text
\VERSION\1\0	2A0A0	2FC	250A0	FC0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000	..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............
\24\1\0	2A39C	1EA	2539C	EFBBBF3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E65	...<?xml version="1.0" encoding="UTF-8" standalone

Intelligent String:

• 1.0.0.0
• SDGSD.exe
• C:\Users\VICTOR\Documents\CryptoObfuscator_Output\SDGSD.pdbBSJB
• _CorExeMainmscoree.dll

Extra 4n4lysis:

Metric	Value	Percentage
Ascii Code	97225	63,5092%
Null Byte Code	13115	8,567%