PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 3,65 MBSHA-256 Hash: 3D1734EBF94CC31C37CD9B2629B0761BC09F0704B96036C52FD1D147BC7F2B04 SHA-1 Hash: 86B4D28579475A184E4F153A09B0443990B90C48 MD5 Hash: 238F840A3861C65C112E534738C31CB4 Imphash: 99EE65C2DB82C04251A5C24F214C8892 MajorOSVersion: 5 MinorOSVersion: 1 CheckSum: 00000000 EntryPoint (rva): 265D0 SizeOfHeaders: 400 SizeOfImage: 6A000 ImageBase: 400000 Architecture: x86 ExportTable: 47D70 ImportTable: 47DA4 IAT: 3C000 Characteristics: 102 TimeDateStamp: 6640971F Date: 12/05/2024 10:17:03 File Type: EXE Number Of Sections: 6 ASLR: Enabled Section Names: .text, .rdata, .data, .didat, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 3A400 | 1000 | 3A32C |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
3A800 | CC00 | 3C000 | CBF8 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
47400 | 1200 | 49000 | D7E0 |
|
|
| .didat | 0xC0000040 Initialized Data Readable Writeable |
48600 | 200 | 57000 | 1A8 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
48800 | E400 | 58000 | E360 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
56C00 | 2C00 | 67000 | 2AFC |
|
|
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 3,23 MB |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 259D0 Code -> E8F6040000E978FEFFFFCCCCCCCCCCCC518D4C24082BC883E10F03C11BC90BC159E92AF5FFFF518D4C24082BC883E10703C1 Assembler |CALL 0X426ACB |JMP 0X426452 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |PUSH ECX |LEA ECX, [ESP + 8] |SUB ECX, EAX |AND ECX, 0XF |ADD EAX, ECX |SBB ECX, ECX |OR EAX, ECX |POP ECX |JMP 0X425B20 |PUSH ECX |LEA ECX, [ESP + 8] |SUB ECX, EAX |AND ECX, 7 |ADD EAX, ECX |
| Signatures |
| Rich Signature Analyzer: Code -> 76B80C7032D9622332D9622332D96223864593233FD9622386459123BED96223864590232AD96223B2A29F2330D96223B2A2662221D96223B2A261222AD96223B2A2672205D962233BA1E12339D962233BA1F12335D9622332D963232CD86223BCA2672200D96223BCA2622233D96223BCA29D2333D96223BCA2602233D962235269636832D96223 Footprint md5 Hash -> 7B8658A87B752D565FCD4D5B58303703 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Detect It Easy (die) • PE: sfx: WinRAR(-)[-] • PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32] • PE: compiler: Microsoft Visual C/C++(-)[-] • PE: linker: Microsoft Linker(14.33**)[-] • PE: overlay: RAR archive(-)[-] • PE: archive: RAR(5)[-] • Entropy: 7.96706 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ReleaseSemaphore | Releases ownership of a semaphore. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingW | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateSemaphoreW | Creates or opens a semaphore object. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| Software\Microsoft\Windows\CurrentVersion Software\WinRAR SFX |
| File Access |
| CB_KG.exe sfxrar.exe vcruntime140.dll SView3.dll msvcp140.dll mfc140.dll gdiplus.dll OLEAUT32.dll KERNEL32.dll O COMCTL32.dll SHLWAPI.dll ole32.dll SHELL32.dll ADVAPI32.dll COMDLG32.dll GDI32.dll USER32.dll .dat @.dat Temp |
| File Access (UNICODE) |
| mscoree.dll kernel32.dll ]Eapi-ms-win-core-synch-l1-2-0.dll KERNEL32.DLL riched20.dll uxtheme.dll peerdist.dll dsrole.dll aclui.dll RpcRtRemote.dll cryptsp.dll linkinfo.dll XmlLite.dll dhcpcsvc.dll dhcpcsvc6.dll rasadhlp.dll browcli.dll dfscli.dll wkscli.dll samlib.dll samcli.dll mlang.dll propsys.dll devrtl.dll mpr.dll netutils.dll WINNSI.DLL iphlpapi.DLL dnsapi.DLL imageres.dll slc.dll cscapi.dll srvcli.dll WindowsCodecs.dll profapi.dll ntmarta.dll oleaccrc.dll cabinet.dll secur32.dll shell32.dll wintrust.dll cryptui.dll msasn1.dll crypt32.dll shdocvw.dll netapi32.dll userenv.dll apphelp.dll setupapi.dll atl.dll ntshrui.dll ieframe.dll psapi.dll ws2help.dll ws2_32.dll comres.dll clbcatq.dll usp10.dll lpk.dll cryptbase.dll dwmapi.dll UXTheme.dll rsaenh.dll SSPICLI.DLL sfc_os.dll DXGIDebug.dll version.dll Crypt32.dll Temp ProgramFiles |
| SQL Queries |
| SELECT * FROM Win32_OperatingSystem |
| Interest's Words |
| PassWord exec attrib start pause shutdown systeminfo ping expand replace |
| Interest's Words (UNICODE) |
| Encrypt Encryption PassWord <html <head <meta attrib start pause ping replace |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | Privileges (SeCreateSymbolicLinkPrivilege) |
| Text | Unicode | Privileges (SeRestorePrivilege) |
| Text | Unicode | Privileges (SeSecurityPrivilege) |
| Text | Unicode | WMI execution (ROOT\CIMV2) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \PNG\101\1033 | 58680 | B45 | 48E80 | 89504E470D0A1A0A0000000D494844520000005D0000012E080200000063D2894F0000000467414D410000B18F0BFC610500 | .PNG........IHDR...].........c..O....gAMA......a.. |
| \PNG\102\1033 | 591C8 | 15A9 | 499C8 | 89504E470D0A1A0A0000000D49484452000000BA0000025C0802000000C1EE29100000000467414D410000B18F0BFC610500 | .PNG........IHDR.......\.......).....gAMA......a.. |
| \ICON\1\1033 | 5A778 | 568 | 4AF78 | 280000001000000020000000010008000000000000010000120B0000120B000000010000000100000000000024349B002735 | (....... ...................................$4..’5 |
| \ICON\2\1033 | 5ACE0 | 8A8 | 4B4E0 | 280000002000000040000000010008000000000000040000120B0000120B00000001000000010000000000003F110F000A06 | (... ...@...................................?..... |
| \ICON\3\1033 | 5B588 | EA8 | 4BD88 | 280000003000000060000000010008000000000000090000120B0000120B0000000100000001000000000000103E05000D07 | (...0.......................................>.... |
| \ICON\4\1033 | 5C430 | 468 | 4CC30 | 280000001000000020000000010020000000000000040000120B0000120B0000000000000000000000000000000000000000 | (....... ..... ................................... |
| \ICON\5\1033 | 5C898 | 10A8 | 4D098 | 280000002000000040000000010020000000000000100000120B0000120B0000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\6\1033 | 5D940 | 25A8 | 4E140 | 280000003000000060000000010020000000000000240000120B0000120B0000000000000000000000000000000000000000 | (...0........ ......$............................ |
| \ICON\7\1033 | 5FEE8 | 3D71 | 506E8 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A86600003D384944415478DAEDBD6BB4644956 | .PNG........IHDR.............\r.f..=8IDATx...k.dIV |
| \DIALOG\ASKNEXTVOL\1033 | 645B8 | 286 | 54DB8 | C000C8900000000007003B004B00C2008B00000000004E00650078007400200076006F006C0075006D006500200069007300 | ..........;.K.........N.e.x.t. .v.o.l.u.m.e. .i.s. |
| \DIALOG\GETPASSWORD1\1033 | 64388 | 13A | 54B88 | C008C89000000000050026002E00B70043000000000045006E007400650072002000700061007300730077006F0072006400 | ..........&.....C.....E.n.t.e.r. .p.a.s.s.w.o.r.d. |
| \DIALOG\LICENSEDLG\1033 | 644C8 | EC | 54CC8 | C008CA900000000005001B002F005B01E000000000004C006900630065006E0073006500000008004D005300200053006800 | ............/.[.......L.i.c.e.n.s.e.....M.S. .S.h. |
| \DIALOG\RENAMEDLG\1033 | 64258 | 12E | 54A58 | C000C890000000000700600052009E005D0000000000520065006E0061006D006500000008004D0053002000530068006500 | ...........R...].....R.e.n.a.m.e.....M.S. .S.h.e. |
| \DIALOG\REPLACEFILEDLG\1033 | 63F20 | 338 | 54720 | C000C8900000000011006E003500DE00AD000000000043006F006E006600690072006D002000660069006C00650020007200 | ..........n.5.........C.o.n.f.i.r.m. .f.i.l.e. .r. |
| \DIALOG\STARTDLG\1033 | 63CC8 | 252 | 544C8 | C008CA90000000000B001B002F005B01E00000000000570069006E005200410052002000730065006C0066002D0065007800 | ............/.[.......W.i.n.R.A.R. .s.e.l.f.-.e.x. |
| \STRING\7\1033 | 64F98 | 1E2 | 55798 | 00000000000000001900530065006C006500630074002000640065007300740069006E006100740069006F006E0020006600 | ..........S.e.l.e.c.t. .d.e.s.t.i.n.a.t.i.o.n. .f. |
| \STRING\8\1033 | 65180 | 1CC | 55980 | 11004E006F007400200065006E006F0075006700680020006D0065006D006F0072007900140055006E006B006E006F007700 | ..N.o.t. .e.n.o.u.g.h. .m.e.m.o.r.y...U.n.k.n.o.w. |
| \STRING\9\1033 | 65350 | 1B8 | 55B50 | 0000000000001A005700720069007400650020006500720072006F007200200069006E002000740068006500200066006900 | ........W.r.i.t.e. .e.r.r.o.r. .i.n. .t.h.e. .f.i. |
| \STRING\10\1033 | 65508 | 146 | 55D08 | 050043006C006F00730065000000000000000000000005004500720072006F00720061004500720072006F00720073002000 | ..C.l.o.s.e.............E.r.r.o.r.a.E.r.r.o.r.s. . |
| \STRING\11\1033 | 65650 | 46C | 55E50 | 200053006F006D0065002000660069006C0065007300200063006F0075006C00640020006E006F0074002000620065002000 | .S.o.m.e. .f.i.l.e.s. .c.o.u.l.d. .n.o.t. .b.e. . |
| \STRING\12\1033 | 65AC0 | 166 | 562C0 | 3200630072006500610074006500640020006100750074006F006D00610074006900630061006C006C007900200062006500 | 2.c.r.e.a.t.e.d. .a.u.t.o.m.a.t.i.c.a.l.l.y. .b.e. |
| \STRING\13\1033 | 65C28 | 152 | 56428 | 0000000000003D0054006F00740061006C0020007000610074006800200061006E0064002000660069006C00650020006E00 | ......=.T.o.t.a.l. .p.a.t.h. .a.n.d. .f.i.l.e. .n. |
| \STRING\14\1033 | 65D80 | 10A | 56580 | 000000001500430061006E006E006F007400200063006F0070007900200025007300200074006F002000250073002E000000 | ......C.a.n.n.o.t. .c.o.p.y. .%.s. .t.o. .%.s..... |
| \STRING\15\1033 | 65E90 | BC | 56690 | 0000410059006F00750020006D006100790020006E00650065006400200074006F002000720075006E002000740068006900 | ..A.Y.o.u. .m.a.y. .n.e.e.d. .t.o. .r.u.n. .t.h.i. |
| \STRING\16\1033 | 65F50 | 1C0 | 56750 | 10005300650063007500720069007400790020007700610072006E0069006E0067004B0050006C0065006100730065002000 | ..S.e.c.u.r.i.t.y. .w.a.r.n.i.n.g.K.P.l.e.a.s.e. . |
| \STRING\17\1033 | 66110 | 250 | 56910 | 000000000000000007005700610072006E0069006E006700AD00540068006900730020006100720063006800690076006500 | ..........W.a.r.n.i.n.g...T.h.i.s. .a.r.c.h.i.v.e. |
| \GROUP_ICON\100\1033 | 63C60 | 68 | 54460 | 00000100070010100000010008006805000001002020000001000800A808000002003030000001000800A80E000003001010 | ..............h..... ............00.............. |
| \24\1\1033 | 64840 | 753 | 55040 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • 3vcruntime140.dll • SView3.dll • 3msvcp140.dll • mfc140.dll • CB_KG.exe • 3Messages/Frame.inc • .rar • Crypt32.dll • version.dll • sfc_os.dll • SSPICLI.DLL • rsaenh.dll • UXTheme.dll • dwmapi.dll • cryptbase.dll • lpk.dll • usp10.dll • clbcatq.dll • comres.dll • ws2_32.dll • ws2help.dll • psapi.dll • ieframe.dll • ntshrui.dll • atl.dll • setupapi.dll • apphelp.dll • userenv.dll • netapi32.dll • shdocvw.dll • crypt32.dll • msasn1.dll • cryptui.dll • wintrust.dll • shell32.dll • secur32.dll • cabinet.dll • oleaccrc.dll • ntmarta.dll • profapi.dll • WindowsCodecs.dll • srvcli.dll • cscapi.dll • slc.dll • imageres.dll • WINNSI.DLL • netutils.dll • mpr.dll • devrtl.dll • propsys.dll • mlang.dll • samcli.dll • samlib.dll • wkscli.dll • dfscli.dll • browcli.dll • rasadhlp.dll • dhcpcsvc6.dll • dhcpcsvc.dll • XmlLite.dll • linkinfo.dll • cryptsp.dll • RpcRtRemote.dll • aclui.dll • dsrole.dll • peerdist.dll • uxtheme.dll • riched20.dll • winrarsfxmappingfile.tmp • runas • .tmp • .lnk • .inf • .exe • USER32.dll • GDI32.dll • COMDLG32.dll • ADVAPI32.dll • ole32.dll • KERNEL32.DLL • O COMCTL32.dll • ]Eapi-ms-win-core-synch-l1-2-0.dll • kernel32.dll • mscoree.dll • D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb • .tls • .bss • sfxrar.exe • KERNEL32.dll • OLEAUT32.dll • <asmv3:windowsSettings xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings"> • Setup=CB_KG.exe • % H23Messages/Countries.inc |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| C3C | 457050 | .text | CALL [static] | Indirect call to absolute memory address |
| C44 | 457054 | .text | CALL [static] | Indirect call to absolute memory address |
| C50 | 457058 | .text | CALL [static] | Indirect call to absolute memory address |
| C6E | 457050 | .text | CALL [static] | Indirect call to absolute memory address |
| C76 | 457054 | .text | CALL [static] | Indirect call to absolute memory address |
| D34 | 4570A4 | .text | CALL [static] | Indirect call to absolute memory address |
| D60 | 45709C | .text | CALL [static] | Indirect call to absolute memory address |
| D81 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 10D2 | 457174 | .text | CALL [static] | Indirect call to absolute memory address |
| 10D9 | 45716C | .text | CALL [static] | Indirect call to absolute memory address |
| 1101 | 457174 | .text | CALL [static] | Indirect call to absolute memory address |
| 1192 | 457160 | .text | CALL [static] | Indirect call to absolute memory address |
| 11BC | 457164 | .text | CALL [static] | Indirect call to absolute memory address |
| 11FC | 457170 | .text | CALL [static] | Indirect call to absolute memory address |
| 1216 | 457168 | .text | CALL [static] | Indirect call to absolute memory address |
| 1234 | 457174 | .text | CALL [static] | Indirect call to absolute memory address |
| 123B | 457178 | .text | CALL [static] | Indirect call to absolute memory address |
| 1278 | 45715C | .text | CALL [static] | Indirect call to absolute memory address |
| 1288 | 457174 | .text | CALL [static] | Indirect call to absolute memory address |
| 129E | 457168 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AF2 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B2B | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BA6 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BCD | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C0E | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C50 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C65 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CA3 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CBF | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D47 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D70 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1DCB | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1EB6 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F99 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 2134 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 21EB | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 3225 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 38EE | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 3C0B | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 3C23 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 3D58 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 46F0 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 4A90 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 4C3C | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 8730 | 43C004 | .text | CALL [static] | Indirect call to absolute memory address |
| 8751 | 43C00C | .text | CALL [static] | Indirect call to absolute memory address |
| 8773 | 43C000 | .text | CALL [static] | Indirect call to absolute memory address |
| 92E1 | 43C024 | .text | CALL [static] | Indirect call to absolute memory address |
| 931E | 43C01C | .text | CALL [static] | Indirect call to absolute memory address |
| 94BF | 43C024 | .text | CALL [static] | Indirect call to absolute memory address |
| 9527 | 43C014 | .text | CALL [static] | Indirect call to absolute memory address |
| 9534 | 43C01C | .text | CALL [static] | Indirect call to absolute memory address |
| 954A | 43C004 | .text | CALL [static] | Indirect call to absolute memory address |
| 958E | 43C020 | .text | CALL [static] | Indirect call to absolute memory address |
| 9596 | 43C028 | .text | CALL [static] | Indirect call to absolute memory address |
| 9789 | 457014 | .text | CALL [static] | Indirect call to absolute memory address |
| 97CD | 457014 | .text | CALL [static] | Indirect call to absolute memory address |
| 9827 | 43C004 | .text | CALL [static] | Indirect call to absolute memory address |
| 98F4 | 43C02C | .text | CALL [static] | Indirect call to absolute memory address |
| 9B15 | 43C018 | .text | CALL [static] | Indirect call to absolute memory address |
| 9FFB | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| A02E | 43C010 | .text | CALL [static] | Indirect call to absolute memory address |
| A035 | 45700C | .text | CALL [static] | Indirect call to absolute memory address |
| A053 | 457018 | .text | CALL [static] | Indirect call to absolute memory address |
| A068 | 457010 | .text | CALL [static] | Indirect call to absolute memory address |
| A072 | 43C004 | .text | CALL [static] | Indirect call to absolute memory address |
| A081 | 43C01C | .text | CALL [static] | Indirect call to absolute memory address |
| B5C6 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| BFEE | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| C770 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| C959 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| C972 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| CDBF | 43C034 | .text | CALL [static] | Indirect call to absolute memory address |
| CE11 | 43C034 | .text | CALL [static] | Indirect call to absolute memory address |
| CE34 | 43C030 | .text | CALL [static] | Indirect call to absolute memory address |
| CE84 | 43C030 | .text | CALL [static] | Indirect call to absolute memory address |
| D09F | 43C038 | .text | CALL [static] | Indirect call to absolute memory address |
| D0EC | 43C038 | .text | CALL [static] | Indirect call to absolute memory address |
| D26B | 43C01C | .text | CALL [static] | Indirect call to absolute memory address |
| D315 | 43C024 | .text | CALL [static] | Indirect call to absolute memory address |
| D365 | 43C024 | .text | CALL [static] | Indirect call to absolute memory address |
| D3F9 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| D429 | 43C040 | .text | CALL [static] | Indirect call to absolute memory address |
| D441 | 43C048 | .text | CALL [static] | Indirect call to absolute memory address |
| D473 | 43C004 | .text | CALL [static] | Indirect call to absolute memory address |
| D492 | 43C004 | .text | CALL [static] | Indirect call to absolute memory address |
| D4C3 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| D4E0 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| D4F1 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| D511 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| D541 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| D55E | 43C03C | .text | CALL [static] | Indirect call to absolute memory address |
| D648 | 43C024 | .text | CALL [static] | Indirect call to absolute memory address |
| D65A | 43C004 | .text | CALL [static] | Indirect call to absolute memory address |
| D6A6 | 43C024 | .text | CALL [static] | Indirect call to absolute memory address |
| D6AF | 43C004 | .text | CALL [static] | Indirect call to absolute memory address |
| D746 | 43C018 | .text | CALL [static] | Indirect call to absolute memory address |
| D7C6 | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| D85F | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| D8CB | 43C280 | .text | CALL [static] | Indirect call to absolute memory address |
| 59800 | N/A | *Overlay* | 526172211A0701002314501A0D01050900080101 | Rar!.....P......... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 2585163 | 67,5944% |
| Null Byte Code | 77482 | 2,0259% |
| NOP Cave Found | 0x9090909090 | Block Count: 1 | Total: 0,0001% |
© 2026 All rights reserved.