PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 658,00 KB SHA-256 Hash: BF4E28AA0DE52F1B20330E95594AD1729B34FD572D2D3B11C44A8CF788DB0A0B SHA-1 Hash: 5B87294A3C9F1847C842EF612B4503193E096685 MD5 Hash: 0B84140A13B0499A630EAA9FDE7DD254 Imphash: FD130FC3BC069A5C2DF1E29AFEE50931 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 8F888 SizeOfHeaders: 400 SizeOfImage: B2000 ImageBase: 400000 Architecture: x86 ImportTable: 9D000 IAT: 9DCA4 Characteristics: 818E TimeDateStamp: 4FD0CFF9 Date: 07/06/2012 15:59:53 File Type: EXE Number Of Sections: 9 ASLR: Disabled Section Names: .text, .itext, .data, .bss, .idata, .tls, .rdata, .reloc, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 8DA00 | 1000 | 8D8F0 |
|
|
| .itext | 0x60000020 Code Executable Readable |
8DE00 | 1A00 | 8F000 | 1954 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
8F800 | 3E00 | 91000 | 3D3C |
|
|
| .bss | 0xC0000000 Readable Writeable |
93600 | 0 | 95000 | 7404 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
93600 | 4200 | 9D000 | 4140 |
|
|
| .tls | 0xC0000000 Readable Writeable |
97800 | 0 | A2000 | 38 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
97800 | 200 | A3000 | 18 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
97A00 | 8C00 | A4000 | 8ADC |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
A0600 | 4200 | AD000 | 4148 |
|
|
| Description |
| OriginalFilename: ProTest.exe CompanyName: Evasion Test v1 LegalCopyright: Copyright (C) 1999 ProductName: Evasion Test @enelpc Demos FileDescription: Evasion Test @enelpc Demos Comments: Evasion Test @enelpc Demos Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (2) - (.itext) have the Entry Point Information -> EntryPoint (calculated) - 8E688 Code -> 558BECB9300000006A006A004975F951535657B8E0E34800E82F7EF7FF33C055685606490064FF306489206A00E82A07F8FF Assembler |PUSH EBP |MOV EBP, ESP |MOV ECX, 0X30 |PUSH 0 |PUSH 0 |DEC ECX |JNE 0X48F890 |PUSH ECX |PUSH EBX |PUSH ESI |PUSH EDI |MOV EAX, 0X48E3E0 |CALL 0X4076D4 |XOR EAX, EAX |PUSH EBP |PUSH 0X490656 |PUSH DWORD PTR FS:[EAX] |MOV DWORD PTR FS:[EAX], ESP |PUSH 0 |CALL 0X40FFE4 |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Borland Delphi 7 Detect It Easy (die) • PE: compiler: Borland Delphi(2006)[-] • Entropy: 6.61695 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| NTDLL.DLL | NtUnmapViewOfSection | Unmaps a process memory section. |
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | CreateRemoteThread | Creates a thread in the address space of another process. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | GetThreadContext | Retrieves a thread execution context. |
| KERNEL32.DLL | SetThreadContext | Modifies a thread execution context. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | IsBadReadPtr | Checks whether memory is readable. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| KERNEL32.DLL | WinExec | Launches a specified application. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| KERNEL32.DLL | VirtualAllocEx | Allocates memory within the virtual address space of another process. |
| KERNEL32.DLL | VirtualProtectEx | Changes the protection on a region of memory in another process. |
| USER32.DLL | CallWindowProcA | Invokes the window procedure for the specified window and messages. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | WSAStartup | Initializes the Winsock networking library. |
| Ws2_32.DLL | WSACleanup | Releases Winsock networking resources. |
| Ws2_32.DLL | bind | Associates a socket with a local address. |
| Ws2_32.DLL | listen | Puts a socket into listening mode. |
| Ws2_32.DLL | accept | Accepts an incoming network connection. |
| Ws2_32.DLL | recv | Receives data from a network socket. |
| Ws2_32.DLL | send | Sends data through a network socket. |
| URLMON.DLL | URLDownloadToFileA | Download a file from the internet and save it to a local file. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegDeleteKeyA | Used to delete a subkey and its values from the Windows registry. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegDeleteValueA | Removes a named value from the specified registry key. Note that value names are not case sensitive. |
| ADVAPI32.DLL | OpenSCManagerA | Opens the Service Control Manager. |
| ADVAPI32.DLL | CreateServiceA | Creates a new Windows service. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| SHELL32.DLL | ShellExecuteExA | Performs a run operation on a specific file. |
| WININET.DLL | InternetConnectA | Opens an File Transfer Protocol (FTP) or HTTP session for a given site. |
| WININET.DLL | FtpPutFileA | Uploads a local file to an FTP server. |
| WININET.DLL | InternetOpenA | Initializes an application’s use of the WinINet functions. |
| WININET.DLL | InternetReadFile | Reads data from an Internet resource. |
| Windows REG |
| SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall Software\Microsoft\Windows NT\CurrentVersion\Winlogon Software\Microsoft\Windows\CurrentVersion\Run SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg SOFTWARE\Microsoft\Windows\CurrentVersion\Run SOFTWARE\Borland\Delphi\RTL Software\Borland\Locales Software\Borland\Delphi\Locales SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\ Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ System\CentralProcessor\0 System\CurrentControlSet\Services\ SYSTEM\CurrentControlSet\Control\Keyboard Layouts\ System\CurrentControlSet\Control\Keyboard Layouts\%.8x Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run Rebuilt string - SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg Rebuilt string - SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder |
| File Access |
| cmd.exe taskmgr.exe .exe notepad.exe explorer.exe \Internet Explorer\iexplore.exe AVICAP32.DLL SHELL32.DLL user32.dll SHFolder.dll WS2_32.DLL netapi32.dll ntdll.dll msacm32.dll advapi32.dll gdiplus.dll winmm.dll wininet.dll comctl32.dll oleaut32.dll URLMON.DLL ole32.dll kernel32.dll wsock32.dll version.dll gdi32.dll .dll wlanapi.dll PSAPI.dll imm32.dll DWMAPI.DLL uxtheme.dll .dat .log tmp.txt out.txt tmpprint.txt drivers\etc\hosts Temp AppData Exec - net start uxsms |
| File Access (UNICODE) |
| ProTest.exe |
| Interest's Words |
| Virus PADDINGX KeyLogger RootKit PassWord exec netsh attrib start pause comspec regedit hostname shutdown netstat systeminfo ping expand replace route |
| Interest's Words (UNICODE) |
| ToolBar start expand |
| Anti-VM/Sandbox/Debug Tricks |
| LabTools - taskmgr LabTools - regedit LabTools - msconfig |
| IP Addresses |
| 127.0.0.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Privileges (SeShutdownPrivilege) |
| Text | Unicode | Keyboard Key (Alt+) |
| Text | Ascii | Keyboard Key ([LEFT]) |
| Text | Ascii | Keyboard Key ([RIGHT]) |
| Text | Ascii | Keyboard Key ([UP]) |
| Text | Ascii | Keyboard Key ([DOWN]) |
| Text | Ascii | Keyboard Key ([DEL]) |
| Text | Ascii | Keyboard Key ([F1]) |
| Text | Ascii | Keyboard Key ([F2]) |
| Text | Ascii | Keyboard Key ([F3]) |
| Text | Ascii | Keyboard Key ([F4]) |
| Text | Ascii | Keyboard Key ([F5]) |
| Text | Ascii | Keyboard Key ([F6]) |
| Text | Ascii | Keyboard Key ([F7]) |
| Text | Ascii | Keyboard Key ([F8]) |
| Text | Ascii | Keyboard Key ([INS]) |
| Text | Ascii | Keyboard Key ([SNAPSHOT]) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (UpArrow) |
| Text | Ascii | Software that records keystrokes to capture credentials (Keylogger) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\1033 | AD6BC | 134 | A0CBC | 070001002800000020000000400000000100010000000000000200000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\2\1033 | AD7F0 | 134 | A0DF0 | 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\3\1033 | AD924 | 134 | A0F24 | 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\4\1033 | ADA58 | 134 | A1058 | 0E000C002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\5\1033 | ADB8C | 134 | A118C | 10000E002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\6\1033 | ADCC0 | 134 | A12C0 | 000000002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\7\1033 | ADDF4 | 134 | A13F4 | 020002002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \STRING\4083\0 | ADF28 | 20C | A1528 | 1200440043004F004D0020006E006F007400200069006E007300740061006C006C0065006400220055006E00610062006C00 | ..D.C.O.M. .n.o.t. .i.n.s.t.a.l.l.e.d.".U.n.a.b.l. |
| \STRING\4084\0 | AE134 | 3FC | A1734 | 0600530068006900660074002B0005004300740072006C002B00040041006C0074002B00180049006E00760061006C006900 | ..S.h.i.f.t.+...C.t.r.l.+...A.l.t.+...I.n.v.a.l.i. |
| \STRING\4085\0 | AE530 | A8 | A1B30 | 0B00590065007300200074006F002000260041006C006C00040042006B005300700003005400610062000300450073006300 | ..Y.e.s. .t.o. .&.A.l.l...B.k.S.p...T.a.b...E.s.c. |
| \STRING\4086\0 | AE5D8 | 140 | A1BD8 | 2A004100200063006F006E00740072006F006C002000630061006E006E006F00740020006800610076006500200069007400 | *.A. .c.o.n.t.r.o.l. .c.a.n.n.o.t. .h.a.v.e. .i.t. |
| \STRING\4087\0 | AE718 | 478 | A1D18 | 170049006E00760061006C0069006400200049006D006100670065004C00690073007400200049006E006400650078002900 | ..I.n.v.a.l.i.d. .I.m.a.g.e.L.i.s.t. .I.n.d.e.x.). |
| \STRING\4088\0 | AEB90 | 330 | A2190 | 24002500730020006E006F007400200069006E0020006100200063006C006100730073002000720065006700690073007400 | $.%.s. .n.o.t. .i.n. .a. .c.l.a.s.s. .r.e.g.i.s.t. |
| \STRING\4089\0 | AEEC0 | 36C | A24C0 | 150049006E00760061006C00690064002000700072006F007000650072007400790020007000610074006800160049006E00 | ..I.n.v.a.l.i.d. .p.r.o.p.e.r.t.y. .p.a.t.h...I.n. |
| \STRING\4090\0 | AF22C | 3F0 | A282C | 0800530061007400750072006400610079001A0055006E00610062006C006500200074006F00200063007200650061007400 | ..S.a.t.u.r.d.a.y...U.n.a.b.l.e. .t.o. .c.r.e.a.t. |
| \STRING\4091\0 | AF61C | CC | A2C1C | 07004F00630074006F0062006500720008004E006F00760065006D00620065007200080044006500630065006D0062006500 | ..O.c.t.o.b.e.r...N.o.v.e.m.b.e.r...D.e.c.e.m.b.e. |
| \STRING\4092\0 | AF6E8 | B0 | A2CE8 | 03004A0075006E0003004A0075006C000300410075006700030053006500700003004F006300740003004E006F0076000300 | ..J.u.n...J.u.l...A.u.g...S.e.p...O.c.t...N.o.v... |
| \STRING\4093\0 | AF798 | 2AC | A2D98 | 180055006E00650078007000650063007400650064002000760061007200690061006E00740020006500720072006F007200 | ..U.n.e.x.p.e.c.t.e.d. .v.a.r.i.a.n.t. .e.r.r.o.r. |
| \STRING\4094\0 | AFA44 | 3B8 | A3044 | 1B004E006F00200061007200670075006D0065006E007400200066006F007200200066006F0072006D006100740020002700 | ..N.o. .a.r.g.u.m.e.n.t. .f.o.r. .f.o.r.m.a.t. .’. |
| \STRING\4095\0 | AFDFC | 354 | A33FC | 1100520061006E0067006500200063006800650063006B0020006500720072006F007200100049006E007400650067006500 | ..R.a.n.g.e. .c.h.e.c.k. .e.r.r.o.r...I.n.t.e.g.e. |
| \STRING\4096\0 | B0150 | 2F0 | A3750 | 2100270025007300270020006900730020006E006F007400200061002000760061006C0069006400200069006E0074006500 | !.’.%.s.’. .i.s. .n.o.t. .a. .v.a.l.i.d. .i.n.t.e. |
| \RCDATA\DCDATA\2048 | B0440 | 11E | A3A40 | 3332423944393246303345364446443946313043443034444146303936353233354443394339323635413633393434314141 | 32B9D92F03E6DFD9F10CD04DAF0965235DC9C9265A639441AA |
| \RCDATA\DVCLAL\0 | B0560 | 10 | A3B60 | A28CDF987B3C3A7926713F090F2A2517 | ....{<:y&q?..*%. |
| \RCDATA\PACKAGEINFO\0 | B0570 | 7F4 | A3B70 | 000010CC00000000A100000001AD73657276657200108E556E744B65796C6F6767657200000D556E744D61696E000029556E | ..............server...UntKeylogger...UntMain..)Un |
| \GROUP_CURSOR\32761\1033 | B0D64 | 14 | A4364 | 0000020001002000400001000100340100000100 | ...... .@.....4..... |
| \GROUP_CURSOR\32762\1033 | B0D78 | 14 | A4378 | 0000020001002000400001000100340100000200 | ...... .@.....4..... |
| \GROUP_CURSOR\32763\1033 | B0D8C | 14 | A438C | 0000020001002000400001000100340100000300 | ...... .@.....4..... |
| \GROUP_CURSOR\32764\1033 | B0DA0 | 14 | A43A0 | 0000020001002000400001000100340100000400 | ...... .@.....4..... |
| \GROUP_CURSOR\32765\1033 | B0DB4 | 14 | A43B4 | 0000020001002000400001000100340100000500 | ...... .@.....4..... |
| \GROUP_CURSOR\32766\1033 | B0DC8 | 14 | A43C8 | 0000020001002000400001000100340100000600 | ...... .@.....4..... |
| \GROUP_CURSOR\32767\1033 | B0DDC | 14 | A43DC | 0000020001002000400001000100340100000700 | ...... .@.....4..... |
| \VERSION\1\1036 | B0DF0 | 358 | A43F0 | 580334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | X.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • netapi32.dll • oleaut32.dll • user32.dll • .dcp • kernel32.dll • 127.0.0.1 • comctl32.dll • DWMAPI.DLL • USER32.DLL • ole32.dll • www.youtube.com/watch?v=cu1t1TGu45Y};) • .bss • .tls • .wmf • GlassFrame.Top • User32.dll • PSAPI.dll • 127.0.0.1:8080 • .LNK • explorer.exe • notepadkernel32.dll • ping 127.0.0.1 -n 4 > NUL && " • tmpprint.txt • www. • .exe • DUMP • .log • net stop uxsms • runas • .dll • RegCloseKeyuser32.dll • CharNextAkernel32.dll • CloseHandlekernel32.dll • gdi32.dll • version.dll • advapi32.dll • AdjustTokenPrivilegeswsock32.dll • Sleepole32.dll • SysFreeStringole32.dll • VariantInitcomctl32.dll • wininet.dll • winmm.dll • Netbiosgdiplus.dll • GdipAllocadvapi32.dll • msacm32.dll • acmStreamOpenntdll.dll • WS2_32.DLL • SHFolder.dll • AVICAP32.DLL • ProTest.exe |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 644 | 49DD80 | .text | JMP [static] | Indirect jump to absolute memory address |
| 64C | 49DD7C | .text | JMP [static] | Indirect jump to absolute memory address |
| 654 | 49DD78 | .text | JMP [static] | Indirect jump to absolute memory address |
| 65C | 49DD74 | .text | JMP [static] | Indirect jump to absolute memory address |
| 664 | 49DD70 | .text | JMP [static] | Indirect jump to absolute memory address |
| 66C | 49DD6C | .text | JMP [static] | Indirect jump to absolute memory address |
| 674 | 49DD68 | .text | JMP [static] | Indirect jump to absolute memory address |
| 67C | 49DD64 | .text | JMP [static] | Indirect jump to absolute memory address |
| 684 | 49DD60 | .text | JMP [static] | Indirect jump to absolute memory address |
| 68C | 49DD5C | .text | JMP [static] | Indirect jump to absolute memory address |
| 694 | 49DD58 | .text | JMP [static] | Indirect jump to absolute memory address |
| 69C | 49DD54 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A4 | 49DCD4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AC | 49DD50 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B4 | 49DD4C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BC | 49DD48 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C4 | 49DD44 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6CC | 49DCD0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6D4 | 49DD40 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6DC | 49DD3C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6E4 | 49DD38 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6EC | 49DD34 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6F4 | 49DD30 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6FC | 49DD2C | .text | JMP [static] | Indirect jump to absolute memory address |
| 704 | 49DD28 | .text | JMP [static] | Indirect jump to absolute memory address |
| 70C | 49DD24 | .text | JMP [static] | Indirect jump to absolute memory address |
| 714 | 49DD20 | .text | JMP [static] | Indirect jump to absolute memory address |
| 71C | 49DD1C | .text | JMP [static] | Indirect jump to absolute memory address |
| 724 | 49DD18 | .text | JMP [static] | Indirect jump to absolute memory address |
| 72C | 49DD14 | .text | JMP [static] | Indirect jump to absolute memory address |
| 734 | 49DCCC | .text | JMP [static] | Indirect jump to absolute memory address |
| 73C | 49DD10 | .text | JMP [static] | Indirect jump to absolute memory address |
| 744 | 49DD0C | .text | JMP [static] | Indirect jump to absolute memory address |
| 74C | 49DD08 | .text | JMP [static] | Indirect jump to absolute memory address |
| 754 | 49DCBC | .text | JMP [static] | Indirect jump to absolute memory address |
| 75C | 49DCB8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 764 | 49DCB4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 76C | 49DD04 | .text | JMP [static] | Indirect jump to absolute memory address |
| 774 | 49DD00 | .text | JMP [static] | Indirect jump to absolute memory address |
| 77C | 49DCAC | .text | JMP [static] | Indirect jump to absolute memory address |
| 784 | 49DCA8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 78C | 49DCA4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 794 | 49DCFC | .text | JMP [static] | Indirect jump to absolute memory address |
| 79C | 49DCF8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 7A4 | 49DCF4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 7AC | 49DCF0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 7B4 | 49DCEC | .text | JMP [static] | Indirect jump to absolute memory address |
| 7E0 | 49DCE8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 7E8 | 49DCE4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 7F0 | 49DCE0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 7F8 | 49DCC8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 22EC | 491738 | .text | CALL [static] | Indirect call to absolute memory address |
| 2304 | 49172C | .text | CALL [static] | Indirect call to absolute memory address |
| 2320 | 491730 | .text | CALL [static] | Indirect call to absolute memory address |
| 2341 | 491734 | .text | CALL [static] | Indirect call to absolute memory address |
| 235A | 491730 | .text | CALL [static] | Indirect call to absolute memory address |
| 2373 | 49172C | .text | CALL [static] | Indirect call to absolute memory address |
| 241A | 495008 | .text | CALL [static] | Indirect call to absolute memory address |
| 2889 | 49502C | .text | CALL [static] | Indirect call to absolute memory address |
| 2C38 | 49DD68 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C40 | 49DD54 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3810 | 49DCC4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 382D | FF00 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3E40 | 495014 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E5E | 495014 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E76 | 495014 | .text | CALL [static] | Indirect call to absolute memory address |
| 3EE8 | 495014 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F08 | 495014 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F25 | 495014 | .text | CALL [static] | Indirect call to absolute memory address |
| 4002 | 495018 | .text | CALL [static] | Indirect call to absolute memory address |
| 4107 | 495010 | .text | CALL [static] | Indirect call to absolute memory address |
| 418A | 495018 | .text | CALL [static] | Indirect call to absolute memory address |
| 42E5 | 495014 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4468 | 495018 | .text | CALL [static] | Indirect call to absolute memory address |
| 471F | 495238 | .text | CALL [static] | Indirect call to absolute memory address |
| 483C | 495028 | .text | CALL [static] | Indirect call to absolute memory address |
| 48D2 | 491038 | .text | CALL [static] | Indirect call to absolute memory address |
| 4922 | 49103C | .text | CALL [static] | Indirect call to absolute memory address |
| 54E9 | 491010 | .text | CALL [static] | Indirect call to absolute memory address |
| 55F9 | 491018 | .text | CALL [static] | Indirect call to absolute memory address |
| 588C | 495000 | .text | JMP [static] | Indirect jump to absolute memory address |
| 653E | 49172C | .text | CALL [static] | Indirect call to absolute memory address |
| 6556 | 491730 | .text | CALL [static] | Indirect call to absolute memory address |
| 6576 | 491734 | .text | CALL [static] | Indirect call to absolute memory address |
| 69A8 | 49DCDC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A10 | 49DD94 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A18 | 49DD90 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A20 | 49DD8C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A28 | 49DD88 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C50 | 49E40C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C58 | 49E408 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C60 | 49E404 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C68 | 49E400 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C70 | 49E3FC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C78 | 49E3F8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C80 | 49E3F4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C88 | 49E3F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C90 | 49E3EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C98 | 49E3E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6CA0 | 49E3E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 395642 | 58,7187% |
| Null Byte Code | 96239 | 14,2832% |
| NOP Cave Found | 0x9090909090 | Block Count: 1 | Total: 0,0004% |
© 2026 All rights reserved.