PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,27 MBSHA-256 Hash: 7D3654531C32D941B8CAE81C4137FC542172BFA9635F169CB392F245A0A12BCB SHA-1 Hash: DA5995070737EC655824C92622333C489EB6BCE4 MD5 Hash: 1B54B70BEEF8EB240DB31718E8F7EB5D Imphash: 4EA4DF5D94204FC550BE1874E1B77EA7 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 0024C33E EntryPoint (rva): 33B6 SizeOfHeaders: 400 SizeOfImage: 76000 ImageBase: 400000 Architecture: x86 ImportTable: 8504 IAT: 8000 Characteristics: 10F TimeDateStamp: 57956397 Date: 25/07/2016 0:55:51 File Type: EXE Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .ndata, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 6200 | 1000 | 615D |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
6600 | 1400 | 8000 | 13A4 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
7A00 | 600 | A000 | 20338 |
|
|
| .ndata | 0xC0000080 Uninitialized Data Readable Writeable |
0 | 0 | 2B000 | 37000 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
8000 | 13200 | 62000 | 13010 |
|
|
| Description |
| LegalCopyright: Valve Corporation ProductName: Steam FileVersion: 2.10.91.91 FileDescription: Steam Language: English (United States) (ID=0x409) CodePage: Unknown (0x0) (0x0) Language: Unknown (ID=0x402) CodePage: Cyrillic (Windows 1251) (0x4E3) Language: Chinese (Taiwan) (ID=0x404) CodePage: Unknown (0x3B6) (0x3B6) Language: Czech (Slovakia) (ID=0x405) CodePage: Greek (Windows 1253) (0x4E2) Language: Unknown (ID=0x406) CodePage: Western European (Windows 1252) (0x4E4) Language: Czech (Czech Republic) (ID=0x407) CodePage: Western European (Windows 1252) (0x4E4) Language: Unknown (ID=0x408) CodePage: Unknown (0x4E5) (0x4E5) Language: Spanish (Spain, International Sort) (ID=0x40A) CodePage: Western European (Windows 1252) (0x4E4) Language: Italian (Italy) (ID=0x40B) CodePage: Western European (Windows 1252) (0x4E4) Language: French (France) (ID=0x40C) CodePage: Western European (Windows 1252) (0x4E4) Language: Unknown (ID=0x40E) CodePage: Greek (Windows 1253) (0x4E2) Language: German (Germany) (ID=0x410) CodePage: Western European (Windows 1252) (0x4E4) Language: Japanese (Japan) (ID=0x411) CodePage: Unknown (0x3A4) (0x3A4) Language: Korean (Korea) (ID=0x412) CodePage: Unknown (0x3B5) (0x3B5) Language: Unknown (ID=0x413) CodePage: Western European (Windows 1252) (0x4E4) Language: Unknown (ID=0x414) CodePage: Western European (Windows 1252) (0x4E4) Language: Unknown (ID=0x415) CodePage: Greek (Windows 1253) (0x4E2) Language: Greek (Greece) (ID=0x416) CodePage: Western European (Windows 1252) (0x4E4) Language: Unknown (ID=0x418) CodePage: Greek (Windows 1253) (0x4E2) Language: Russian (Russia) (ID=0x419) CodePage: Cyrillic (Windows 1251) (0x4E3) Language: Unknown (ID=0x41D) CodePage: Western European (Windows 1252) (0x4E4) Language: Unknown (ID=0x41E) CodePage: Unknown (0x36A) (0x36A) Language: Unknown (ID=0x41F) CodePage: Unknown (0x4E6) (0x4E6) Language: Unknown (ID=0x421) CodePage: Unknown (0x0) (0x0) Language: Unknown (ID=0x422) CodePage: Cyrillic (Windows 1251) (0x4E3) Language: Unknown (ID=0x42A) CodePage: Unknown (0x4EA) (0x4EA) Language: Chinese (People's Republic of China) (ID=0x804) CodePage: Unknown (0x3A8) (0x3A8) Language: Unknown (ID=0x816) CodePage: Western European (Windows 1252) (0x4E4) Language: Spanish (Chile) (ID=0x580A) CodePage: Western European (Windows 1252) (0x4E4) |
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 1,81 MB |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 27B6 Code -> 81ECD40200005356576A205F33DB6801800000895C2414C744241030A24000895C241CFF15B4804000FF15B0804000663D06 Assembler |SUB ESP, 0X2D4 |PUSH EBX |PUSH ESI |PUSH EDI |PUSH 0X20 |POP EDI |XOR EBX, EBX |PUSH 0X8001 |MOV DWORD PTR [ESP + 0X14], EBX |MOV DWORD PTR [ESP + 0X10], 0X40A230 |MOV DWORD PTR [ESP + 0X1C], EBX |CALL DWORD PTR [0X4080B4] |CALL DWORD PTR [0X4080B0] |
| Signatures |
| Rich Signature Analyzer: Code -> AD31E881E95086D2E95086D2E95086D22A5FD9D2EB5086D2E95087D24F5086D22A5FDBD2E65086D2BD73B6D2E35086D22E5680D2E85086D252696368E95086D2 Footprint md5 Hash -> D8710F969152EFF03A4D61D31FA0C8B9 • The Rich header apparently has not been modified Certificate - Digital Signature: • The file is signed and the signature is correct |
| Packer/Compiler |
| Compiler: Nullsoft Install System - Version: v3.0 Detect It Easy (die) • PE: installer: Nullsoft Scriptable Install System(3.0)[lzma,solid] • PE: linker: Microsoft Linker(6.0*)[-] • PE: overlay: NSIS data(-)[-] • Entropy: 7.98386 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CopyFileW | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| Software\Microsoft\Windows\CurrentVersion |
| File Access |
| Nullsoft.NSIS.exe ole32.dll COMCTL32.dll ADVAPI32.dll SHELL32.dll GDI32.dll USER32.dll KERNEL32.dll @.dat Temp |
| File Access (UNICODE) |
| %s%S.dll Temp |
| Interest's Words |
| exec attrib shutdown ping expand |
| Interest's Words (UNICODE) |
| shutdown |
| URLs |
| http://ocsp.digicert.com http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl http://cacerts.digicert.com/DigiCertTrustedRootG4.crt http://crl3.digicert.com/DigiCertTrustedRootG4.crl http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://www.digicert.com/CPS0 http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt |
| URLs (UNICODE) |
| http://nsis.sf.net/NSIS_Error |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | Registry (RegDeleteKeyEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CopyFile) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 62A18 | 5918 | 8A18 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000058DF49444154789CEC5D0760144517 | .PNG........IHDR.............\r.f..X.IDATx..]..E. |
| \ICON\2\1033 | 68330 | 25A8 | E330 | 28000000300000006000000001002000000000008025000000000000000000000000000000000000FFFFFF00FFFFFF00FFFF | (...0........ ......%............................ |
| \ICON\3\1033 | 6A8D8 | 1CA8 | 108D8 | 2800000030000000600000000100180000000000801C00000000000000000000000000000000000000000000000000000000 | (...0............................................ |
| \ICON\4\1033 | 6C580 | 10A8 | 12580 | 28000000200000004000000001002000000000008010000000000000000000000000000000000000FFFFFF00FFFFFF00FFFF | (... ...@..... ................................... |
| \ICON\5\1033 | 6D628 | CA8 | 13628 | 2800000020000000400000000100180000000000800C00000000000000000000000000000000000000000000000000000000 | (... ...@......................................... |
| \ICON\6\1033 | 6E2D0 | 568 | 142D0 | 2800000010000000200000000100080000000000400100000000000000000000000100000000000000000000800080008000 | (....... ...........@............................. |
| \ICON\7\1033 | 6E838 | 468 | 14838 | 28000000100000002000000001002000000000004004000000000000000000000000000000000000AA791300AA791300AA79 | (....... ..... .....@....................y...y...y |
| \ICON\8\1033 | 6ECA0 | 368 | 14CA0 | 2800000010000000200000000100180000000000400300000000000000000000000000000000000000000000000000000000 | (....... ...........@............................. |
| \ICON\9\1033 | 6F008 | B0 | 15008 | 2800000010000000200000000100010000000000800000000000000000000000020000000000000000000000FFFFFF00F81F | (....... ......................................... |
| \DIALOG\103\1033 | 6F0B8 | 120 | 150B8 | 0100FFFF0000000000000000480400400700000000002C018C000000000000000800000000014D0053002000530068006500 | ............H..@......,...............M.S. .S.h.e. |
| \DIALOG\105\1033 | 6F1D8 | 200 | 151D8 | 0100FFFF00000000000000004808CA800E00000000004B01DE000000000000000800000000014D0053002000530068006500 | ............H.........K...............M.S. .S.h.e. |
| \DIALOG\106\1033 | 6F3D8 | F8 | 153D8 | 0100FFFF0000000000000000480400400400000000002C018C000000000000000800000000014D0053002000530068006500 | ............H..@......,...............M.S. .S.h.e. |
| \DIALOG\107\1033 | 6F4D0 | A0 | 154D0 | 0100FFFF0000000000000000480400400300000000002C018C000000000000000800000000014D0053002000530068006500 | ............H..@......,...............M.S. .S.h.e. |
| \DIALOG\111\1033 | 6F570 | EE | 15570 | 0100FFFF0000000000000000C8080080030000000000A7002A000000000000000800000000014D0053002000530068006500 | ........................*.............M.S. .S.h.e. |
| \DIALOG\203\1033 | 6F660 | 10C | 15660 | 0100FFFF0000000000000000400400400700000000002C018C000000000000000900000000018B5B534F0000000000000000 | ............@..@......,................[SO........ |
| \DIALOG\205\1033 | 6F770 | 1EC | 15770 | 0100FFFF00000000000000004008CA800E00000000004B01DE000000000000000900000000018B5B534F0000000000000000 | ............@.........K................[SO........ |
| \DIALOG\206\1033 | 6F960 | E4 | 15960 | 0100FFFF0000000000000000400400400400000000002C018C000000000000000900000000018B5B534F0000000000000000 | ............@..@......,................[SO........ |
| \DIALOG\207\1033 | 6FA48 | 8C | 15A48 | 0100FFFF0000000000000000400400400300000000002C018C000000000000000900000000018B5B534F0000000000000000 | ............@..@......,................[SO........ |
| \DIALOG\211\1033 | 6FAD8 | DA | 15AD8 | 0100FFFF0000000000000000C0080080030000000000A7002A000000000000000900000000018B5B534F0000000000000000 | ........................*..............[SO........ |
| \DIALOG\303\1033 | 6FBB8 | 110 | 15BB8 | 0100FFFF0000000000000000400400400700000000002C018C00000000000000090000000001B065307D0E66D49A00000000 | ............@..@......,................e0}.f...... |
| \DIALOG\305\1033 | 6FCC8 | 1F0 | 15CC8 | 0100FFFF00000000000000004008CA800E00000000004B01DE00000000000000090000000001B065307D0E66D49A00000000 | ............@.........K................e0}.f...... |
| \DIALOG\306\1033 | 6FEB8 | E8 | 15EB8 | 0100FFFF0000000000000000400400400400000000002C018C00000000000000090000000001B065307D0E66D49A00000000 | ............@..@......,................e0}.f...... |
| \DIALOG\307\1033 | 6FFA0 | 90 | 15FA0 | 0100FFFF0000000000000000400400400300000000002C018C00000000000000090000000001B065307D0E66D49A00000000 | ............@..@......,................e0}.f...... |
| \DIALOG\311\1033 | 70030 | DE | 16030 | 0100FFFF0000000000000000C0080080030000000000A7002A00000000000000090000000001B065307D0E66D49A00000000 | ........................*..............e0}.f...... |
| \DIALOG\403\1033 | 70110 | 118 | 16110 | 0100FFFF0000000000000000400400400700000000002C018C000000000000000900000000012DFF33FF200030FFB430B730 | ............@..@......,...............-.3. .0..0.0 |
| \DIALOG\405\1033 | 70228 | 1F8 | 16228 | 0100FFFF00000000000000004008CA800E00000000004B01DE000000000000000900000000012DFF33FF200030FFB430B730 | ............@.........K...............-.3. .0..0.0 |
| \DIALOG\406\1033 | 70420 | F0 | 16420 | 0100FFFF0000000000000000400400400400000000002C018C000000000000000900000000012DFF33FF200030FFB430B730 | ............@..@......,...............-.3. .0..0.0 |
| \DIALOG\407\1033 | 70510 | 98 | 16510 | 0100FFFF0000000000000000400400400300000000002C018C000000000000000900000000012DFF33FF200030FFB430B730 | ............@..@......,...............-.3. .0..0.0 |
| \DIALOG\411\1033 | 705A8 | E6 | 165A8 | 0100FFFF0000000000000000C0080080030000000000A7002A000000000000000900000000012DFF33FF200030FFB430B730 | ........................*.............-.3. .0..0.0 |
| \DIALOG\503\1033 | 70690 | 10C | 16690 | 0100FFFF0000000000000000400400400700000000002C018C0000000000000009000000000174ADBCB90000000000000000 | ............@..@......,...............t........... |
| \DIALOG\505\1033 | 707A0 | 1EC | 167A0 | 0100FFFF00000000000000004008CA800E00000000004B01DE0000000000000009000000000174ADBCB90000000000000000 | ............@.........K...............t........... |
| \DIALOG\506\1033 | 70990 | E4 | 16990 | 0100FFFF0000000000000000400400400400000000002C018C0000000000000009000000000174ADBCB90000000000000000 | ............@..@......,...............t........... |
| \DIALOG\507\1033 | 70A78 | 8C | 16A78 | 0100FFFF0000000000000000400400400300000000002C018C0000000000000009000000000174ADBCB90000000000000000 | ............@..@......,...............t........... |
| \DIALOG\511\1033 | 70B08 | DA | 16B08 | 0100FFFF0000000000000000C0080080030000000000A7002A0000000000000009000000000174ADBCB90000000000000000 | ........................*.............t........... |
| \GROUP_ICON\103\1033 | 70BE8 | 84 | 16BE8 | 0000010009001010020000000000B00000000900101000000100080068050000060010100000010018006803000008002020 | ............................h.............h..... |
| \VERSION\1\1026 | 70C70 | 230 | 16C70 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1028 | 70EA0 | 230 | 16EA0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1029 | 710D0 | 230 | 170D0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1030 | 71300 | 230 | 17300 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1031 | 71530 | 230 | 17530 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1032 | 71760 | 230 | 17760 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1033 | 71990 | 230 | 17990 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1034 | 71BC0 | 230 | 17BC0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1035 | 71DF0 | 230 | 17DF0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1036 | 72020 | 230 | 18020 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1038 | 72250 | 230 | 18250 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1040 | 72480 | 230 | 18480 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1041 | 726B0 | 230 | 186B0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1042 | 728E0 | 230 | 188E0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1043 | 72B10 | 230 | 18B10 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1044 | 72D40 | 230 | 18D40 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1045 | 72F70 | 230 | 18F70 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1046 | 731A0 | 230 | 191A0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1048 | 733D0 | 230 | 193D0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1049 | 73600 | 230 | 19600 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1053 | 73830 | 230 | 19830 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1054 | 73A60 | 230 | 19A60 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1055 | 73C90 | 230 | 19C90 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1057 | 73EC0 | 230 | 19EC0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1058 | 740F0 | 230 | 1A0F0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\1066 | 74320 | 230 | 1A320 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\2052 | 74550 | 230 | 1A550 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\2070 | 74780 | 230 | 1A780 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \VERSION\1\22538 | 749B0 | 230 | 1A9B0 | 300234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000A00 | 0.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | 74BE0 | 42D | 1ABE0 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • 2.10.91.91 • KERNEL32.dll • USER32.dll • ADVAPI32.dll • COMCTL32.dll • http://nsis.sf.net/NSIS_Error • .tmp • .exe • %s%S.dll • .rNe • u.dAk • :060U00Uq]dL.g?O0U0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0U |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 42C | 408224 | .text | CALL [static] | Indirect call to absolute memory address |
| 447 | 408228 | .text | CALL [static] | Indirect call to absolute memory address |
| 45B | 40822C | .text | CALL [static] | Indirect call to absolute memory address |
| 4CF | 408064 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E4 | 408230 | .text | CALL [static] | Indirect call to absolute memory address |
| 505 | 408054 | .text | CALL [static] | Indirect call to absolute memory address |
| 526 | 408050 | .text | CALL [static] | Indirect call to absolute memory address |
| 530 | 408058 | .text | CALL [static] | Indirect call to absolute memory address |
| 556 | 408288 | .text | CALL [static] | Indirect call to absolute memory address |
| 56E | 40828C | .text | CALL [static] | Indirect call to absolute memory address |
| 7E4 | 408154 | .text | CALL [static] | Indirect call to absolute memory address |
| 7F4 | 408220 | .text | CALL [static] | Indirect call to absolute memory address |
| 8AD | 408264 | .text | CALL [static] | Indirect call to absolute memory address |
| 8E6 | 40807C | .text | CALL [static] | Indirect call to absolute memory address |
| 8F4 | 408298 | .text | CALL [static] | Indirect call to absolute memory address |
| 9A6 | 408090 | .text | CALL [static] | Indirect call to absolute memory address |
| 9BC | 408090 | .text | CALL [static] | Indirect call to absolute memory address |
| A12 | 408074 | .text | CALL [static] | Indirect call to absolute memory address |
| A45 | 408070 | .text | CALL [static] | Indirect call to absolute memory address |
| A8E | 40808C | .text | CALL [static] | Indirect call to absolute memory address |
| ADA | 408078 | .text | CALL [static] | Indirect call to absolute memory address |
| B22 | 408110 | .text | CALL [static] | Indirect call to absolute memory address |
| B41 | 408114 | .text | CALL [static] | Indirect call to absolute memory address |
| BCD | 4080C0 | .text | CALL [static] | Indirect call to absolute memory address |
| CC2 | 40811C | .text | CALL [static] | Indirect call to absolute memory address |
| CCB | 408120 | .text | CALL [static] | Indirect call to absolute memory address |
| DFB | 408118 | .text | CALL [static] | Indirect call to absolute memory address |
| E0D | 408128 | .text | CALL [static] | Indirect call to absolute memory address |
| E28 | 408124 | .text | CALL [static] | Indirect call to absolute memory address |
| E3B | 408128 | .text | CALL [static] | Indirect call to absolute memory address |
| F29 | 4081E0 | .text | CALL [static] | Indirect call to absolute memory address |
| FA7 | 408108 | .text | CALL [static] | Indirect call to absolute memory address |
| FB9 | 40810C | .text | CALL [static] | Indirect call to absolute memory address |
| 103F | 408294 | .text | CALL [static] | Indirect call to absolute memory address |
| 1057 | 408220 | .text | CALL [static] | Indirect call to absolute memory address |
| 1089 | 408278 | .text | CALL [static] | Indirect call to absolute memory address |
| 10AA | 408270 | .text | CALL [static] | Indirect call to absolute memory address |
| 10D0 | 40826C | .text | CALL [static] | Indirect call to absolute memory address |
| 10EF | 408274 | .text | CALL [static] | Indirect call to absolute memory address |
| 1100 | 40826C | .text | CALL [static] | Indirect call to absolute memory address |
| 110D | 40822C | .text | CALL [static] | Indirect call to absolute memory address |
| 112E | 408258 | .text | CALL [static] | Indirect call to absolute memory address |
| 113C | 408220 | .text | CALL [static] | Indirect call to absolute memory address |
| 114B | 40805C | .text | CALL [static] | Indirect call to absolute memory address |
| 1159 | 408210 | .text | CALL [static] | Indirect call to absolute memory address |
| 1166 | 408060 | .text | CALL [static] | Indirect call to absolute memory address |
| 1175 | 408154 | .text | CALL [static] | Indirect call to absolute memory address |
| 1186 | 408214 | .text | CALL [static] | Indirect call to absolute memory address |
| 11D1 | 408054 | .text | CALL [static] | Indirect call to absolute memory address |
| 11F2 | 408268 | .text | CALL [static] | Indirect call to absolute memory address |
| 11FD | 408218 | .text | CALL [static] | Indirect call to absolute memory address |
| 1252 | 40818C | .text | CALL [static] | Indirect call to absolute memory address |
| 12B7 | 408138 | .text | CALL [static] | Indirect call to absolute memory address |
| 12DE | 408120 | .text | CALL [static] | Indirect call to absolute memory address |
| 1352 | 40810C | .text | CALL [static] | Indirect call to absolute memory address |
| 13EE | 408174 | .text | CALL [static] | Indirect call to absolute memory address |
| 13FF | 408170 | .text | CALL [static] | Indirect call to absolute memory address |
| 147C | 40816C | .text | CALL [static] | Indirect call to absolute memory address |
| 1514 | 4082AC | .text | CALL [static] | Indirect call to absolute memory address |
| 165E | 408190 | .text | CALL [static] | Indirect call to absolute memory address |
| 16D4 | 408168 | .text | CALL [static] | Indirect call to absolute memory address |
| 1710 | 408164 | .text | CALL [static] | Indirect call to absolute memory address |
| 173E | 40801C | .text | CALL [static] | Indirect call to absolute memory address |
| 1747 | 408020 | .text | CALL [static] | Indirect call to absolute memory address |
| 17B9 | 408024 | .text | CALL [static] | Indirect call to absolute memory address |
| 1815 | 408028 | .text | CALL [static] | Indirect call to absolute memory address |
| 185B | 40802C | .text | CALL [static] | Indirect call to absolute memory address |
| 18CD | 408030 | .text | CALL [static] | Indirect call to absolute memory address |
| 18E0 | 408018 | .text | CALL [static] | Indirect call to absolute memory address |
| 18F6 | 408020 | .text | CALL [static] | Indirect call to absolute memory address |
| 1983 | 408160 | .text | CALL [static] | Indirect call to absolute memory address |
| 198E | 40815C | .text | CALL [static] | Indirect call to absolute memory address |
| 1A4D | 40814C | .text | CALL [static] | Indirect call to absolute memory address |
| 1AAB | 408148 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B6D | 408148 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BA0 | 408148 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BC3 | 408150 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BE2 | 408140 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C0A | 40813C | .text | CALL [static] | Indirect call to absolute memory address |
| 1CE9 | 408108 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CFC | 408108 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D14 | 408120 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D28 | 408144 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E36 | 408220 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E46 | 40821C | .text | CALL [static] | Indirect call to absolute memory address |
| 2020 | 408014 | .text | CALL [static] | Indirect call to absolute memory address |
| 2065 | 408020 | .text | CALL [static] | Indirect call to absolute memory address |
| 208A | 408020 | .text | CALL [static] | Indirect call to absolute memory address |
| 20A8 | 408000 | .text | CALL [static] | Indirect call to absolute memory address |
| 20F1 | 408014 | .text | CALL [static] | Indirect call to absolute memory address |
| 2122 | 40825C | .text | CALL [static] | Indirect call to absolute memory address |
| 2156 | 4081E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2166 | 408260 | .text | CALL [static] | Indirect call to absolute memory address |
| 2198 | 408154 | .text | CALL [static] | Indirect call to absolute memory address |
| 21BA | 408254 | .text | CALL [static] | Indirect call to absolute memory address |
| 21D8 | 408080 | .text | CALL [static] | Indirect call to absolute memory address |
| 2206 | 4081E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 222A | 408290 | .text | CALL [static] | Indirect call to absolute memory address |
| 2238 | 408268 | .text | CALL [static] | Indirect call to absolute memory address |
| 2255 | 408080 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B200 | N/A | *Overlay* | 00000000EFBEADDE4E756C6C736F6674496E7374 | ........NullsoftInst |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1617209 | 67,9271% |
| Null Byte Code | 36669 | 1,5402% |
© 2026 All rights reserved.