PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,80 MBSHA-256 Hash: CA3D6DB83232F9E5F79F6BA2A78263172E163DA11E8233BEF1C961A15DA5AF3F SHA-1 Hash: FA91F58CCAACDC2B3486834D80BC846DFAF02D72 MD5 Hash: 08CA1B53E72FC0E41FDD9A63F3C51577 Imphash: 75E9596D74D063246BA6F3AC7C5369A0 MajorOSVersion: 5 MinorOSVersion: 1 CheckSum: 002CDCA9 EntryPoint (rva): 21D50 SizeOfHeaders: 400 SizeOfImage: 79000 ImageBase: 400000 Architecture: x86 ExportTable: 405C0 ImportTable: 405F4 IAT: 36000 Characteristics: 102 TimeDateStamp: 651BC7F7 Date: 03/10/2023 7:51:19 File Type: EXE Number Of Sections: 6 ASLR: Enabled Section Names: .text, .rdata, .data, .didat, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 34600 | 1000 | 345CC |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
34A00 | B600 | 36000 | B410 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
40000 | 1200 | 42000 | 24758 |
|
|
| .didat | 0xC0000040 Initialized Data Readable Writeable |
41200 | 200 | 67000 | 1A4 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
41400 | E000 | 68000 | DFF8 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
4F400 | 2600 | 76000 | 255C |
|
|
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 2,33 MB |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 21150 Code -> E8C6040000E978FEFFFFCCCCCCCCCCCC68204F420064FF35000000008B442410896C24108D6C24102BE0535657A17C274400 Assembler |CALL 0X42221B |JMP 0X421BD2 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |PUSH 0X424F20 |PUSH DWORD PTR FS:[0] |MOV EAX, DWORD PTR [ESP + 0X10] |MOV DWORD PTR [ESP + 0X10], EBP |LEA EBP, [ESP + 0X10] |SUB ESP, EAX |PUSH EBX |PUSH ESI |PUSH EDI |MOV EAX, DWORD PTR [0X44277C] |
| Signatures |
| Rich Signature Analyzer: Code -> ED57C9BAA936A7E9A936A7E9A936A7E91DAA56E9A436A7E91DAA54E92736A7E91DAA55E9B136A7E9294D5AE9AB36A7E9294DA3E8BA36A7E9294DA4E8BF36A7E9294DA2E89C36A7E9A04E24E9A236A7E9A04E34E9AE36A7E9A936A6E9B337A7E9274DA2E89836A7E9274DA7E8A836A7E9274D58E9A836A7E9274DA5E8A836A7E952696368A936A7E9 Footprint md5 Hash -> C2D9B7710A878FE1E622E636C95EE19F • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE: sfx: WinRAR(-)[-] • PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32] • PE: compiler: Microsoft Visual C/C++(-)[-] • PE: linker: Microsoft Linker(14.33**)[-] • PE: overlay: RAR archive(-)[-] • PE: archive: RAR(5)[-] • Entropy: 7.95651 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ReleaseSemaphore | Releases ownership of a semaphore. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingW | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateSemaphoreW | Creates or opens a semaphore object. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| Software\Microsoft\Windows\CurrentVersion Software\WinRAR SFX |
| File Access |
| package/setup.exe sfxrar.exe gdiplus.dll OLEAUT32.dll KERNEL32.dll COMCTL32.dll SHLWAPI.dll ole32.dll SHELL32.dll ADVAPI32.dll COMDLG32.dll GDI32.dll USER32.dll .jAR start.bat package/Click To Run.bat .dat @.dat f.vbs Temp |
| File Access (UNICODE) |
| mscoree.dll KERNEL32.DLL riched20.dll uxtheme.dll peerdist.dll dsrole.dll aclui.dll RpcRtRemote.dll cryptsp.dll linkinfo.dll XmlLite.dll dhcpcsvc.dll dhcpcsvc6.dll rasadhlp.dll browcli.dll dfscli.dll wkscli.dll samlib.dll samcli.dll mlang.dll propsys.dll devrtl.dll mpr.dll netutils.dll WINNSI.DLL iphlpapi.DLL dnsapi.DLL imageres.dll slc.dll cscapi.dll srvcli.dll WindowsCodecs.dll profapi.dll ntmarta.dll oleaccrc.dll cabinet.dll secur32.dll shell32.dll wintrust.dll cryptui.dll msasn1.dll crypt32.dll shdocvw.dll netapi32.dll userenv.dll apphelp.dll setupapi.dll atl.dll ntshrui.dll ieframe.dll psapi.dll ws2help.dll ws2_32.dll comres.dll clbcatq.dll usp10.dll lpk.dll cryptbase.dll dwmapi.dll UXTheme.dll rsaenh.dll SSPICLI.DLL sfc_os.dll DXGIDebug.dll version.dll Crypt32.dll Temp ProgramFiles |
| SQL Queries |
| SELECT * FROM Win32_OperatingSystem |
| Interest's Words |
| Spam PassWord exec attrib start pause shutdown systeminfo ping expand replace |
| Interest's Words (UNICODE) |
| Encrypt Encryption PassWord <html <head <meta attrib start pause ping replace |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings http://crl.comodoca.com/AAACertificateServices.crl http://ocsp.comodoca.com http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0 http://ocsp.sectigo.com http://crl.sectigo.com/SectigoPublicCodeSigningCAEVR36.crl http://crt.sectigo.com/SectigoPublicCodeSigningCAEVR36.crt http://crl.sectigo.com/SectigoRSATimeStampingCA.crl http://crt.sectigo.com/SectigoRSATimeStampingCA.crt http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt http://ocsp.usertrust.com https://sectigo.com/CPS0 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Antivirus Software (comodo) |
| Text | Unicode | Privileges (SeCreateSymbolicLinkPrivilege) |
| Text | Unicode | Privileges (SeRestorePrivilege) |
| Text | Unicode | Privileges (SeSecurityPrivilege) |
| Text | Unicode | WMI execution (ROOT\CIMV2) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \PNG\101\1033 | 68650 | B45 | 41A50 | 89504E470D0A1A0A0000000D494844520000005D0000012E080200000063D2894F0000000467414D410000B18F0BFC610500 | .PNG........IHDR...].........c..O....gAMA......a.. |
| \PNG\102\1033 | 69198 | 15A9 | 42598 | 89504E470D0A1A0A0000000D49484452000000BA0000025C0802000000C1EE29100000000467414D410000B18F0BFC610500 | .PNG........IHDR.......\.......).....gAMA......a.. |
| \ICON\1\1033 | 6A748 | 568 | 43B48 | 280000001000000020000000010008000000000000010000120B0000120B000000010000000100000000000024349B002735 | (....... ...................................$4..’5 |
| \ICON\2\1033 | 6ACB0 | 8A8 | 440B0 | 280000002000000040000000010008000000000000040000120B0000120B00000001000000010000000000003F110F000A06 | (... ...@...................................?..... |
| \ICON\3\1033 | 6B558 | EA8 | 44958 | 280000003000000060000000010008000000000000090000120B0000120B0000000100000001000000000000103E05000D07 | (...0.......................................>.... |
| \ICON\4\1033 | 6C400 | 468 | 45800 | 280000001000000020000000010020000000000000040000120B0000120B0000000000000000000000000000000000000000 | (....... ..... ................................... |
| \ICON\5\1033 | 6C868 | 10A8 | 45C68 | 280000002000000040000000010020000000000000100000120B0000120B0000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\6\1033 | 6D910 | 25A8 | 46D10 | 280000003000000060000000010020000000000000240000120B0000120B0000000000000000000000000000000000000000 | (...0........ ......$............................ |
| \ICON\7\1033 | 6FEB8 | 3D71 | 492B8 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A86600003D384944415478DAEDBD6BB4644956 | .PNG........IHDR.............\r.f..=8IDATx...k.dIV |
| \DIALOG\ASKNEXTVOL\1033 | 74588 | 286 | 4D988 | C000C8900000000007003B004B00C2008B00000000004E00650078007400200076006F006C0075006D006500200069007300 | ..........;.K.........N.e.x.t. .v.o.l.u.m.e. .i.s. |
| \DIALOG\GETPASSWORD1\1033 | 74358 | 13A | 4D758 | C008C89000000000050026002E00B70043000000000045006E007400650072002000700061007300730077006F0072006400 | ..........&.....C.....E.n.t.e.r. .p.a.s.s.w.o.r.d. |
| \DIALOG\LICENSEDLG\1033 | 74498 | EC | 4D898 | C008CA900000000005001B002F005B01E000000000004C006900630065006E0073006500000008004D005300200053006800 | ............/.[.......L.i.c.e.n.s.e.....M.S. .S.h. |
| \DIALOG\RENAMEDLG\1033 | 74228 | 12E | 4D628 | C000C890000000000700600052009E005D0000000000520065006E0061006D006500000008004D0053002000530068006500 | ...........R...].....R.e.n.a.m.e.....M.S. .S.h.e. |
| \DIALOG\REPLACEFILEDLG\1033 | 73EF0 | 338 | 4D2F0 | C000C8900000000011006E003500DE00AD000000000043006F006E006600690072006D002000660069006C00650020007200 | ..........n.5.........C.o.n.f.i.r.m. .f.i.l.e. .r. |
| \DIALOG\STARTDLG\1033 | 73C98 | 252 | 4D098 | C008CA90000000000B001B002F005B01E00000000000570069006E005200410052002000730065006C0066002D0065007800 | ............/.[.......W.i.n.R.A.R. .s.e.l.f.-.e.x. |
| \STRING\7\1033 | 74F68 | 1E2 | 4E368 | 00000000000000001900530065006C006500630074002000640065007300740069006E006100740069006F006E0020006600 | ..........S.e.l.e.c.t. .d.e.s.t.i.n.a.t.i.o.n. .f. |
| \STRING\8\1033 | 75150 | 1CC | 4E550 | 11004E006F007400200065006E006F0075006700680020006D0065006D006F0072007900140055006E006B006E006F007700 | ..N.o.t. .e.n.o.u.g.h. .m.e.m.o.r.y...U.n.k.n.o.w. |
| \STRING\9\1033 | 75320 | 1B8 | 4E720 | 0000000000001A005700720069007400650020006500720072006F007200200069006E002000740068006500200066006900 | ........W.r.i.t.e. .e.r.r.o.r. .i.n. .t.h.e. .f.i. |
| \STRING\10\1033 | 754D8 | 146 | 4E8D8 | 050043006C006F00730065000000000000000000000005004500720072006F00720061004500720072006F00720073002000 | ..C.l.o.s.e.............E.r.r.o.r.a.E.r.r.o.r.s. . |
| \STRING\11\1033 | 75620 | 46C | 4EA20 | 200053006F006D0065002000660069006C0065007300200063006F0075006C00640020006E006F0074002000620065002000 | .S.o.m.e. .f.i.l.e.s. .c.o.u.l.d. .n.o.t. .b.e. . |
| \STRING\12\1033 | 75A90 | 166 | 4EE90 | 3200630072006500610074006500640020006100750074006F006D00610074006900630061006C006C007900200062006500 | 2.c.r.e.a.t.e.d. .a.u.t.o.m.a.t.i.c.a.l.l.y. .b.e. |
| \STRING\13\1033 | 75BF8 | 152 | 4EFF8 | 0000000000003D0054006F00740061006C0020007000610074006800200061006E0064002000660069006C00650020006E00 | ......=.T.o.t.a.l. .p.a.t.h. .a.n.d. .f.i.l.e. .n. |
| \STRING\14\1033 | 75D50 | 10A | 4F150 | 000000001500430061006E006E006F007400200063006F0070007900200025007300200074006F002000250073002E000000 | ......C.a.n.n.o.t. .c.o.p.y. .%.s. .t.o. .%.s..... |
| \STRING\15\1033 | 75E60 | BC | 4F260 | 0000410059006F00750020006D006100790020006E00650065006400200074006F002000720075006E002000740068006900 | ..A.Y.o.u. .m.a.y. .n.e.e.d. .t.o. .r.u.n. .t.h.i. |
| \STRING\16\1033 | 75F20 | D6 | 4F320 | 10005300650063007500720069007400790020007700610072006E0069006E0067004B0050006C0065006100730065002000 | ..S.e.c.u.r.i.t.y. .w.a.r.n.i.n.g.K.P.l.e.a.s.e. . |
| \GROUP_ICON\100\1033 | 73C30 | 68 | 4D030 | 00000100070010100000010008006805000001002020000001000800A808000002003030000001000800A80E000003001010 | ..............h..... ............00.............. |
| \24\1\1033 | 74810 | 753 | 4DC10 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • 3package/setup.exe • .rar • .exe • .sfx • Crypt32.dll • version.dll • sfc_os.dll • SSPICLI.DLL • rsaenh.dll • UXTheme.dll • dwmapi.dll • cryptbase.dll • lpk.dll • usp10.dll • clbcatq.dll • comres.dll • ws2_32.dll • ws2help.dll • psapi.dll • ieframe.dll • ntshrui.dll • atl.dll • setupapi.dll • apphelp.dll • userenv.dll • netapi32.dll • shdocvw.dll • crypt32.dll • msasn1.dll • cryptui.dll • wintrust.dll • shell32.dll • secur32.dll • cabinet.dll • oleaccrc.dll • ntmarta.dll • profapi.dll • WindowsCodecs.dll • srvcli.dll • cscapi.dll • slc.dll • imageres.dll • WINNSI.DLL • netutils.dll • mpr.dll • devrtl.dll • propsys.dll • mlang.dll • samcli.dll • samlib.dll • wkscli.dll • dfscli.dll • browcli.dll • rasadhlp.dll • dhcpcsvc6.dll • dhcpcsvc.dll • XmlLite.dll • linkinfo.dll • cryptsp.dll • RpcRtRemote.dll • aclui.dll • dsrole.dll • peerdist.dll • uxtheme.dll • riched20.dll • winrarsfxmappingfile.tmp • runas • %s.%d.tmp • .lnk • .inf • USER32.dll • GDI32.dll • COMDLG32.dll • ADVAPI32.dll • ole32.dll • KERNEL32.DLL • K@SHLWAPI.dll • COMCTL32.dll • mscoree.dll • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb • .bss • sfxrar.exe • KERNEL32.dll • OLEAUT32.dll • <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> • Setup=start.bat • 0package/Click To Run.bat • package/configuration.xml • start.bat • +0U 00U 0g0KUD0B0@><:http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0{+o0m0F+0:http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0+0http://ocsp.sectigo.com0*H_6rZ-9JZBJ |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 613 | 467050 | .text | CALL [static] | Indirect call to absolute memory address |
| 61B | 467058 | .text | CALL [static] | Indirect call to absolute memory address |
| 627 | 467054 | .text | CALL [static] | Indirect call to absolute memory address |
| 643 | 467050 | .text | CALL [static] | Indirect call to absolute memory address |
| 64B | 467058 | .text | CALL [static] | Indirect call to absolute memory address |
| 6A7 | 4670A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D3 | 467094 | .text | CALL [static] | Indirect call to absolute memory address |
| 6E1 | 467098 | .text | CALL [static] | Indirect call to absolute memory address |
| 6F8 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 731 | 467174 | .text | CALL [static] | Indirect call to absolute memory address |
| 738 | 467170 | .text | CALL [static] | Indirect call to absolute memory address |
| 756 | 467174 | .text | CALL [static] | Indirect call to absolute memory address |
| 75D | 467180 | .text | CALL [static] | Indirect call to absolute memory address |
| 79A | 467168 | .text | CALL [static] | Indirect call to absolute memory address |
| 7AA | 467174 | .text | CALL [static] | Indirect call to absolute memory address |
| 7C0 | 46716C | .text | CALL [static] | Indirect call to absolute memory address |
| E75 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| EAE | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| F29 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| F50 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| F91 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| FD3 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| FE8 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 100F | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 102C | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 10B2 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 10DC | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 1143 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 122E | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 1311 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 1494 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 151B | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 2464 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AD7 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E0D | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 2E25 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F70 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 3836 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 3BC6 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 6FFF | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| 7020 | 436008 | .text | CALL [static] | Indirect call to absolute memory address |
| 75C1 | 436024 | .text | CALL [static] | Indirect call to absolute memory address |
| 75DD | 436018 | .text | CALL [static] | Indirect call to absolute memory address |
| 7663 | 43601C | .text | CALL [static] | Indirect call to absolute memory address |
| 7729 | 436024 | .text | CALL [static] | Indirect call to absolute memory address |
| 7769 | 436010 | .text | CALL [static] | Indirect call to absolute memory address |
| 7774 | 436018 | .text | CALL [static] | Indirect call to absolute memory address |
| 778D | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| 77D1 | 436020 | .text | CALL [static] | Indirect call to absolute memory address |
| 77D9 | 436028 | .text | CALL [static] | Indirect call to absolute memory address |
| 7957 | 467014 | .text | CALL [static] | Indirect call to absolute memory address |
| 797A | 467014 | .text | CALL [static] | Indirect call to absolute memory address |
| 7996 | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| 7A4B | 43602C | .text | CALL [static] | Indirect call to absolute memory address |
| 7C65 | 436014 | .text | CALL [static] | Indirect call to absolute memory address |
| 807F | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 80B2 | 43600C | .text | CALL [static] | Indirect call to absolute memory address |
| 80B9 | 46700C | .text | CALL [static] | Indirect call to absolute memory address |
| 80D7 | 467018 | .text | CALL [static] | Indirect call to absolute memory address |
| 80EC | 467010 | .text | CALL [static] | Indirect call to absolute memory address |
| 80F6 | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| 8105 | 436018 | .text | CALL [static] | Indirect call to absolute memory address |
| 8F55 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 9CAD | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 9DFC | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| 9E19 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A12B | 436034 | .text | CALL [static] | Indirect call to absolute memory address |
| A14A | 436030 | .text | CALL [static] | Indirect call to absolute memory address |
| A25E | 436038 | .text | CALL [static] | Indirect call to absolute memory address |
| A29E | 436038 | .text | CALL [static] | Indirect call to absolute memory address |
| A3EB | 436018 | .text | CALL [static] | Indirect call to absolute memory address |
| A4A4 | 436024 | .text | CALL [static] | Indirect call to absolute memory address |
| A4D4 | 436024 | .text | CALL [static] | Indirect call to absolute memory address |
| A531 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A561 | 436040 | .text | CALL [static] | Indirect call to absolute memory address |
| A579 | 436048 | .text | CALL [static] | Indirect call to absolute memory address |
| A5AB | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| A5CA | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| A5F9 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A616 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A627 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A647 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A677 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A694 | 43603C | .text | CALL [static] | Indirect call to absolute memory address |
| A742 | 436024 | .text | CALL [static] | Indirect call to absolute memory address |
| A74F | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| A782 | 436024 | .text | CALL [static] | Indirect call to absolute memory address |
| A78A | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| A7D9 | 436014 | .text | CALL [static] | Indirect call to absolute memory address |
| A850 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A8E9 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A955 | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A9BD | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| A9EB | 436054 | .text | CALL [static] | Indirect call to absolute memory address |
| A9FA | 436000 | .text | CALL [static] | Indirect call to absolute memory address |
| AA3B | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| AAAA | 436278 | .text | CALL [static] | Indirect call to absolute memory address |
| ABFC | 43604C | .text | CALL [static] | Indirect call to absolute memory address |
| ACB0 | 436014 | .text | CALL [static] | Indirect call to absolute memory address |
| AD07 | 436054 | .text | CALL [static] | Indirect call to absolute memory address |
| 22EC48-22EC55 | N/A | *padding* | Potential obfuscated jump sequence detected, count: 7 |
| A3B2-A3CF | N/A | .text | Unusual BP Cave, count: 30 |
| 51A00 | N/A | *Overlay* | 526172211A070100BEAB6F910C01050800070101 | Rar!......o......... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1984119 | 67,4916% |
| Null Byte Code | 70427 | 2,3956% |
| NOP Cave Found | 0x9090909090 | Block Count: 2 | Total: 0,0002% |
© 2026 All rights reserved.