PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,23 MBSHA-256 Hash: 77B56700BF5D1CC5530D72D4800825B46D719FFF11B36F2A02305E89CB2E48E7 SHA-1 Hash: 7BA13448CABDAE6C9573ED95FBA841A10B687CC9 MD5 Hash: 2775C961FA031D03825179C4E7749F3D Imphash: FADC5A257419D2541A6B13DFB5E311E2 MajorOSVersion: 5 MinorOSVersion: 2 CheckSum: 0013C079 EntryPoint (rva): 2549C SizeOfHeaders: 400 SizeOfImage: 142000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: E5C10 IAT: B5000 Characteristics: 22 TimeDateStamp: 66590360 Date: 30/05/2024 22:53:20 File Type: EXE Number Of Sections: 6 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | B3400 | 1000 | B3328 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
B3800 | 34400 | B5000 | 34204 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
E7C00 | 5000 | EA000 | 9120 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
ECC00 | 7000 | F4000 | 6F48 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
F3C00 | 45400 | FB000 | 4529C |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
139000 | C00 | 141000 | A74 |
|
|
| Description |
| CompanyName: AdobeGenP LegalCopyright: AdobeGenP ProductName: AdobeGenP FileVersion: 3.3.16.1 FileDescription: AdobeGenP ProductVersion: 3.3.16.1 Comments: AdobeGenP Language: English (United Kingdom) (ID=0x809) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 2489C Code -> 4883EC28E86B0500004883C428E97AFEFFFFCCCC40534883EC20488BD9488BC2488D0D6D46090048890B488D530833C94889 Assembler |SUB RSP, 0X28 |CALL 0X1574 |ADD RSP, 0X28 |JMP 0XE8C |INT3 |INT3 |PUSH RBX |SUB RSP, 0X20 |MOV RBX, RCX |MOV RAX, RDX |LEA RCX, [RIP + 0X9466D] |MOV QWORD PTR [RBX], RCX |LEA RDX, [RBX + 8] |XOR ECX, ECX |
| Signatures |
| CheckSum Integrity Problem: • Header: 1294457 • Calculated: 1289087 Rich Signature Analyzer: Code -> 6F3129EB2B5047B82B5047B82B5047B89FCCB6B83E5047B89FCCB4B8B75047B89FCCB5B80A5047B8B5F080B82A5047B8793842B9055047B8793843B93A5047B8793844B9235047B82228C4B8235047B82228C0B82A5047B82228D4B80E5047B82B5046B8065247B88E3949B97B5047B88E3944B92A5047B88E39B8B82A5047B82B50D0B82A5047B88E3945B92A5047B8526963682B5047B8 Footprint md5 Hash -> AFE3092A83F13734D82BF96FB766C32E • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Autoit 3 - (You can use a decompiler for this...) Detect It Easy (die) • PE+(64): library: AutoIt(3.XX)[-] • PE+(64): compiler: Microsoft Visual C/C++(2017 v.15.9)[-] • PE+(64): linker: Microsoft Linker(14.16, Visual Studio 2017 15.9*)[-] • Entropy: 6.44964 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | CopyFileW | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| Software\AutoIt v3\AutoIt SOFTWARE\Classes\ SYSTEM\CurrentControlSet\Control\Nls\Language |
| File Access |
| OLEAUT32.dll ole32.dll SHELL32.dll ADVAPI32.dll COMDLG32.dll GDI32.dll USER32.dll KERNEL32.dll UxTheme.dll USERENV.dll IPHLPAPI.DLL PSAPI.DLL WININET.dll MPR.dll COMCTL32.dll WINMM.dll VERSION.dll WSOCK32.dll .dat @.dat Temp UserProfile |
| File Access (UNICODE) |
| mscoree.dll kernel32.dll api-ms-win-core-synch-l1-2-0.dll Temp ProgramFiles AppData UserProfile |
| Interest's Words |
| PADDINGX exec attrib start shutdown systeminfo ping replace |
| Interest's Words (UNICODE) |
| exec attrib start pause comspec shutdown ping expand replace |
| IP Addresses |
| 255.255.255.255 3.3.16.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | Registry (RegDeleteKeyEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CopyFile) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GlobalMemoryStatusEx) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (ReadProcessMemory) |
| Text | Ascii | Execution (CreateProcessA) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (CreateEventW) |
| Text | Unicode | Privileges (SeAssignPrimaryTokenPrivilege) |
| Text | Unicode | Privileges (SeBackupPrivilege) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Privileges (SeIncreaseQuotaPrivilege) |
| Text | Unicode | Privileges (SeRestorePrivilege) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Unicode | Keyboard Key (ALTDOWN) |
| Text | Unicode | Keyboard Key (ALTUP) |
| Text | Unicode | Keyboard Key (SHIFTDOWN) |
| Text | Unicode | Keyboard Key (SHIFTUP) |
| Text | Unicode | Keyboard Key (CTRLDOWN) |
| Text | Unicode | Keyboard Key (CTRLUP) |
| Text | Unicode | Keyboard Key (LWINDOWN) |
| Text | Unicode | Keyboard Key (LWINUP) |
| Text | Unicode | Keyboard Key (RWINDOWN) |
| Text | Unicode | Keyboard Key (RWINUP) |
| Text | Unicode | Keyboard Key (LBUTTON) |
| Text | Unicode | Keyboard Key (MBUTTON) |
| Text | Unicode | Keyboard Key (RBUTTON) |
| Text | Unicode | Keyboard Key (NUMPAD0) |
| Text | Unicode | Keyboard Key (NUMPAD1) |
| Text | Unicode | Keyboard Key (NUMPAD2) |
| Text | Unicode | Keyboard Key (NUMPAD3) |
| Text | Unicode | Keyboard Key (NUMPAD4) |
| Text | Unicode | Keyboard Key (NUMPAD5) |
| Text | Unicode | Keyboard Key (NUMPAD6) |
| Text | Unicode | Keyboard Key (NUMPAD7) |
| Text | Unicode | Keyboard Key (NUMPAD8) |
| Text | Unicode | Keyboard Key (NUMPAD9) |
| Text | Unicode | Keyboard Key (CapsLock) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\2057 | FB4D0 | 128 | F40D0 | 2800000010000000200000000100040000000000C000000000000000000000000000000000000000000000007A60EB00795F | (....... ...................................z..y_ |
| \ICON\2\2057 | FB5F8 | B2E3 | F41F8 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000097048597300000EC300000EC301 | .PNG........IHDR.............\r.f....pHYs......... |
| \ICON\3\2057 | 1068DC | 10828 | FF4DC | 2800000080000000000100000100200000000000000801000000000000000000000000000000000000000000000000000000 | (............. ................................... |
| \ICON\4\2057 | 117104 | 94A8 | 10FD04 | 2800000060000000C00000000100200000000000809400000000000000000000000000000000000000000000000000000000 | (............ ................................... |
| \ICON\5\2057 | 1205AC | 5488 | 1191AC | 2800000048000000900000000100200000000000605400000000000000000000000000000000000000000000000000000000 | (...H......... .....T............................ |
| \ICON\6\2057 | 125A34 | 4228 | 11E634 | 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000 | (...@......... ......B............................ |
| \ICON\7\2057 | 129C5C | 25A8 | 12285C | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\8\2057 | 12C204 | 10A8 | 124E04 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\9\2057 | 12D2AC | 988 | 125EAC | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000 | (.......0..... .................................. |
| \ICON\10\2057 | 12DC34 | 468 | 126834 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000 | (....... ..... .....@............................. |
| \STRING\7\2057 | 12E09C | 594 | 126C9C | 0000000000000000000009002800500061007500730065006400290020000C004100750074006F0049007400200045007200 | ............(.P.a.u.s.e.d.). ...A.u.t.o.I.t. .E.r. |
| \STRING\8\2057 | 12E630 | 68A | 127230 | 300049006E0063006F007200720065006300740020006E0075006D0062006500720020006F00660020007000610072006100 | 0.I.n.c.o.r.r.e.c.t. .n.u.m.b.e.r. .o.f. .p.a.r.a. |
| \STRING\9\2057 | 12ECBC | 490 | 1278BC | 30004500780070006500630074006500640020006100200022003D00220020006F00700065007200610074006F0072002000 | 0.E.x.p.e.c.t.e.d. .a. .".=.". .o.p.e.r.a.t.o.r. . |
| \STRING\10\2057 | 12F14C | 5FC | 127D4C | 1A0049006E00760061006C00690064002000660069006C0065002000660069006C0074006500720020006700690076006500 | ..I.n.v.a.l.i.d. .f.i.l.e. .f.i.l.t.e.r. .g.i.v.e. |
| \STRING\11\2057 | 12F748 | 65C | 128348 | 3E002200530065006C0065006300740022002000730074006100740065006D0065006E00740020006900730020006D006900 | >.".S.e.l.e.c.t.". .s.t.a.t.e.m.e.n.t. .i.s. .m.i. |
| \STRING\12\2057 | 12FDA4 | 466 | 1289A4 | 4800430061006E0020007000610073007300200063006F006E007300740061006E0074007300200062007900200072006500 | H.C.a.n. .p.a.s.s. .c.o.n.s.t.a.n.t.s. .b.y. .r.e. |
| \STRING\313\2057 | 13020C | 158 | 128E0C | 00000000000000000000000000000000150055006E00610062006C006500200074006F002000700061007200730065002000 | ..................U.n.a.b.l.e. .t.o. .p.a.r.s.e. . |
| \RCDATA\SCRIPT\0 | 130364 | F816 | 128F64 | A3484BBE986C4AA9994C530A86D6487D41553321454130364DA8FF7324A73CF67A12F167ACC193E76B43CA52A6AD0000E1BB | .HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R...... |
| \GROUP_ICON\99\2057 | 13FB7C | 84 | 13877C | 0000010009000000000001002000E3B20000020080800000010020002808010003006060000001002000A894000004004848 | ............ ............. .(......... .......HH |
| \GROUP_ICON\169\2057 | 13FC00 | 14 | 138800 | 0000010001001010100001000400280100000100 | ..............(..... |
| \VERSION\1\2057 | 13FC14 | 28C | 138814 | 8C0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\2057 | 13FEA0 | 3FA | 138AA0 | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122 | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" |
| Intelligent String |
| • 3.3.16.1 • kernel32.dll • RUNASWAIT • RUNAS • api-ms-win-core-synch-l1-2-0.dll • mscoree.dll • COMSPEC • runas • 0.0.0.0 • .lnk • 255.255.255.255 • .icl • .exe • .dll • .tls • .bss • COMCTL32.dll • KERNEL32.dll • USER32.dll • COMDLG32.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| AC8 | N/A | .text | CALL QWORD PTR [RIP+0xB45D2] |
| BA3 | N/A | .text | CALL QWORD PTR [RIP+0xB469F] |
| CEA | N/A | .text | CALL QWORD PTR [RIP+0xB43B0] |
| D4E | N/A | .text | CALL QWORD PTR [RIP+0xB383C] |
| D56 | N/A | .text | CALL QWORD PTR [RIP+0xB3834] |
| D5E | N/A | .text | CALL QWORD PTR [RIP+0xB4544] |
| D66 | N/A | .text | CALL QWORD PTR [RIP+0xB4334] |
| F3D | N/A | .text | JMP QWORD PTR [RIP+0xB4195] |
| 1002 | N/A | .text | JMP QWORD PTR [RIP+0xB3ED0] |
| 1060 | N/A | .text | JMP QWORD PTR [RIP+0xB3E72] |
| 10A8 | N/A | .text | CALL QWORD PTR [RIP+0xB41EA] |
| 111B | N/A | .text | CALL QWORD PTR [RIP+0xB3E7F] |
| 113A | N/A | .text | CALL QWORD PTR [RIP+0xB3FC0] |
| 1162 | N/A | .text | CALL QWORD PTR [RIP+0xB3EA0] |
| 1182 | N/A | .text | CALL QWORD PTR [RIP+0xB3E80] |
| 124C | N/A | .text | CALL QWORD PTR [RIP+0xB3E36] |
| 12B7 | N/A | .text | CALL QWORD PTR [RIP+0xB3F13] |
| 12DE | N/A | .text | CALL QWORD PTR [RIP+0xB3E1C] |
| 12F9 | N/A | .text | CALL QWORD PTR [RIP+0xB3309] |
| 135A | N/A | .text | CALL QWORD PTR [RIP+0xB3D20] |
| 13AE | N/A | .text | CALL QWORD PTR [RIP+0xB3244] |
| 146C | N/A | .text | CALL QWORD PTR [RIP+0xB316E] |
| 14F4 | N/A | .text | CALL QWORD PTR [RIP+0xB30E6] |
| 1704 | N/A | .text | CALL QWORD PTR [RIP+0xB2E7E] |
| 171C | N/A | .text | CALL QWORD PTR [RIP+0xB2F76] |
| 1731 | N/A | .text | CALL QWORD PTR [RIP+0xB2F51] |
| 1746 | N/A | .text | CALL QWORD PTR [RIP+0xB2E44] |
| 1766 | N/A | .text | CALL QWORD PTR [RIP+0xB2E3C] |
| 17FF | N/A | .text | CALL QWORD PTR [RIP+0xB2D9B] |
| 1812 | N/A | .text | CALL QWORD PTR [RIP+0xB2E70] |
| 182B | N/A | .text | CALL QWORD PTR [RIP+0xB2DC7] |
| 1852 | N/A | .text | CALL QWORD PTR [RIP+0xB2E30] |
| 18C0 | N/A | .text | CALL QWORD PTR [RIP+0xB2D72] |
| 1A63 | N/A | .text | CALL QWORD PTR [RIP+0xB33AF] |
| 1AF8 | N/A | .text | CALL QWORD PTR [RIP+0xB331A] |
| 1B03 | N/A | .text | CALL QWORD PTR [RIP+0xB2B37] |
| 1B18 | N/A | .text | CALL QWORD PTR [RIP+0xB2AFA] |
| 1B23 | N/A | .text | CALL QWORD PTR [RIP+0xB2B2F] |
| 1B66 | N/A | .text | CALL QWORD PTR [RIP+0xB3754] |
| 1CCA | N/A | .text | CALL QWORD PTR [RIP+0xB3208] |
| 1DB9 | N/A | .text | CALL QWORD PTR [RIP+0xB3059] |
| 1DCE | N/A | .text | CALL QWORD PTR [RIP+0xB2854] |
| 1E47 | N/A | .text | CALL QWORD PTR [RIP+0xB308B] |
| 1E71 | N/A | .text | CALL QWORD PTR [RIP+0xB3449] |
| 1FE8 | N/A | .text | CALL QWORD PTR [RIP+0xB32C2] |
| 1FF3 | N/A | .text | CALL QWORD PTR [RIP+0xB2E7F] |
| 2025 | N/A | .text | CALL QWORD PTR [RIP+0xB3285] |
| 202F | N/A | .text | CALL QWORD PTR [RIP+0xB2E43] |
| 205A | N/A | .text | CALL QWORD PTR [RIP+0xB2E18] |
| 207D | N/A | .text | CALL QWORD PTR [RIP+0xB311D] |
| 2090 | N/A | .text | CALL QWORD PTR [RIP+0xB3102] |
| 20EF | N/A | .text | CALL QWORD PTR [RIP+0xB317B] |
| 210E | N/A | .text | CALL QWORD PTR [RIP+0xB2D6C] |
| 2130 | N/A | .text | CALL QWORD PTR [RIP+0xB2F5A] |
| 214C | N/A | .text | CALL QWORD PTR [RIP+0xB2506] |
| 215F | N/A | .text | CALL QWORD PTR [RIP+0xB2FD3] |
| 2190 | N/A | .text | CALL QWORD PTR [RIP+0xB30CA] |
| 2B05 | N/A | .text | CALL QWORD PTR [RIP+0xB27A5] |
| 2B25 | N/A | .text | CALL QWORD PTR [RIP+0xB2785] |
| 2B56 | N/A | .text | CALL QWORD PTR [RIP+0xB279C] |
| 2B97 | N/A | .text | CALL QWORD PTR [RIP+0xB2713] |
| 2BF2 | N/A | .text | CALL QWORD PTR [RIP+0xB1E48] |
| 2C07 | N/A | .text | CALL QWORD PTR [RIP+0xB1E2B] |
| 2C8D | N/A | .text | CALL QWORD PTR [RIP+0xB1B9D] |
| 2D24 | N/A | .text | CALL QWORD PTR [RIP+0xB1D06] |
| 2F9E | N/A | .text | CALL QWORD PTR [RIP+0xB22EC] |
| 2FAE | N/A | .text | CALL QWORD PTR [RIP+0xB22D4] |
| 2FC3 | N/A | .text | CALL QWORD PTR [RIP+0xB22B7] |
| 2FDC | N/A | .text | CALL QWORD PTR [RIP+0xB229E] |
| 2FF5 | N/A | .text | CALL QWORD PTR [RIP+0xB2285] |
| 3021 | N/A | .text | CALL QWORD PTR [RIP+0xB1F29] |
| 3085 | N/A | .text | CALL QWORD PTR [RIP+0xB21ED] |
| 310C | N/A | .text | CALL QWORD PTR [RIP+0xB215E] |
| 315F | N/A | .text | CALL QWORD PTR [RIP+0xB210B] |
| 3175 | N/A | .text | CALL QWORD PTR [RIP+0xB20ED] |
| 3189 | N/A | .text | JMP QWORD PTR [RIP+0xB20D9] |
| 31E5 | N/A | .text | CALL QWORD PTR [RIP+0xB20A5] |
| 3216 | N/A | .text | CALL QWORD PTR [RIP+0xB205C] |
| 322A | N/A | .text | CALL QWORD PTR [RIP+0xB2028] |
| 3248 | N/A | .text | CALL QWORD PTR [RIP+0xB130A] |
| 3263 | N/A | .text | CALL QWORD PTR [RIP+0xB12F7] |
| 327C | N/A | .text | CALL QWORD PTR [RIP+0xB1FFE] |
| 328F | N/A | .text | CALL QWORD PTR [RIP+0xB127B] |
| 32D8 | N/A | .text | CALL QWORD PTR [RIP+0xB152A] |
| 33FD | N/A | .text | CALL QWORD PTR [RIP+0xB142D] |
| 3BAC | N/A | .text | CALL QWORD PTR [RIP+0xB1566] |
| 4A9F | N/A | .text | CALL QWORD PTR [RIP+0xAFC9B] |
| 4AFF | N/A | .text | CALL QWORD PTR [RIP+0xAFD2B] |
| 51DE | N/A | .text | CALL QWORD PTR [RIP+0xAFBBC] |
| 5276 | N/A | .text | CALL QWORD PTR [RIP+0xAFFAC] |
| 52B1 | N/A | .text | CALL QWORD PTR [RIP+0xAFF91] |
| 52D9 | N/A | .text | CALL QWORD PTR [RIP+0xAFF81] |
| 52E6 | N/A | .text | CALL QWORD PTR [RIP+0xAFF6C] |
| 52FC | N/A | .text | CALL QWORD PTR [RIP+0xAFF4E] |
| 5323 | N/A | .text | CALL QWORD PTR [RIP+0xAFF17] |
| 5750 | N/A | .text | CALL QWORD PTR [RIP+0xAF64A] |
| 58BA | N/A | .text | CALL QWORD PTR [RIP+0xAEE60] |
| 58E4 | N/A | .text | CALL QWORD PTR [RIP+0xAEFE6] |
| 596F | N/A | .text | CALL QWORD PTR [RIP+0xAEDAB] |
| 5B4B | N/A | .text | CALL QWORD PTR [RIP+0xAF987] |
| C7D18-C7D25 | N/A | .rdata | Potential obfuscated jump sequence detected, count: 7 |
| C7DA2-C7DD1 | N/A | .rdata | Potential obfuscated jump sequence detected, count: 24 |
| CCE20-CCF37 | N/A | .rdata | Potential obfuscated jump sequence detected, count: 140 |
| CCF74-CCF9F | N/A | .rdata | Potential obfuscated jump sequence detected, count: 22 |
| ECC00 | 1000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| ECC0C | 102C | .pdata | ExceptionHook | Pointer to 102C - 0x42C .text + UnwindInfo: .rdata |
| ECC18 | 1048 | .pdata | ExceptionHook | Pointer to 1048 - 0x448 .text + UnwindInfo: .rdata |
| ECC24 | 1064 | .pdata | ExceptionHook | Pointer to 1064 - 0x464 .text + UnwindInfo: .rdata |
| ECC30 | 1080 | .pdata | ExceptionHook | Pointer to 1080 - 0x480 .text + UnwindInfo: .rdata |
| ECC3C | 10B0 | .pdata | ExceptionHook | Pointer to 10B0 - 0x4B0 .text + UnwindInfo: .rdata |
| ECC48 | 10CC | .pdata | ExceptionHook | Pointer to 10CC - 0x4CC .text + UnwindInfo: .rdata |
| ECC54 | 10E8 | .pdata | ExceptionHook | Pointer to 10E8 - 0x4E8 .text + UnwindInfo: .rdata |
| ECC60 | 1104 | .pdata | ExceptionHook | Pointer to 1104 - 0x504 .text + UnwindInfo: .rdata |
| ECC6C | 1120 | .pdata | ExceptionHook | Pointer to 1120 - 0x520 .text + UnwindInfo: .rdata |
| ECC78 | 1140 | .pdata | ExceptionHook | Pointer to 1140 - 0x540 .text + UnwindInfo: .rdata |
| ECC84 | 12A0 | .pdata | ExceptionHook | Pointer to 12A0 - 0x6A0 .text + UnwindInfo: .rdata |
| ECC90 | 1314 | .pdata | ExceptionHook | Pointer to 1314 - 0x714 .text + UnwindInfo: .rdata |
| ECC9C | 1470 | .pdata | ExceptionHook | Pointer to 1470 - 0x870 .text + UnwindInfo: .rdata |
| ECCA8 | 1504 | .pdata | ExceptionHook | Pointer to 1504 - 0x904 .text + UnwindInfo: .rdata |
| ECCB4 | 15EC | .pdata | ExceptionHook | Pointer to 15EC - 0x9EC .text + UnwindInfo: .rdata |
| ECCC0 | 17FC | .pdata | ExceptionHook | Pointer to 17FC - 0xBFC .text + UnwindInfo: .rdata |
| ECCCC | 183C | .pdata | ExceptionHook | Pointer to 183C - 0xC3C .text + UnwindInfo: .rdata |
| ECCD8 | 1978 | .pdata | ExceptionHook | Pointer to 1978 - 0xD78 .text + UnwindInfo: .rdata |
| ECCE4 | 1AA4 | .pdata | ExceptionHook | Pointer to 1AA4 - 0xEA4 .text + UnwindInfo: .rdata |
| ECCF0 | 1B58 | .pdata | ExceptionHook | Pointer to 1B58 - 0xF58 .text + UnwindInfo: .rdata |
| ECCFC | 1B90 | .pdata | ExceptionHook | Pointer to 1B90 - 0xF90 .text + UnwindInfo: .rdata |
| ECD08 | 1C10 | .pdata | ExceptionHook | Pointer to 1C10 - 0x1010 .text + UnwindInfo: .rdata |
| ECD14 | 1C68 | .pdata | ExceptionHook | Pointer to 1C68 - 0x1068 .text + UnwindInfo: .rdata |
| ECD20 | 1CA4 | .pdata | ExceptionHook | Pointer to 1CA4 - 0x10A4 .text + UnwindInfo: .rdata |
| ECD2C | 1CEC | .pdata | ExceptionHook | Pointer to 1CEC - 0x10EC .text + UnwindInfo: .rdata |
| ECD38 | 1E04 | .pdata | ExceptionHook | Pointer to 1E04 - 0x1204 .text + UnwindInfo: .rdata |
| ECD44 | 1F7C | .pdata | ExceptionHook | Pointer to 1F7C - 0x137C .text + UnwindInfo: .rdata |
| ECD50 | 2100 | .pdata | ExceptionHook | Pointer to 2100 - 0x1500 .text + UnwindInfo: .rdata |
| ECD5C | 22E8 | .pdata | ExceptionHook | Pointer to 22E8 - 0x16E8 .text + UnwindInfo: .rdata |
| ECD68 | 2370 | .pdata | ExceptionHook | Pointer to 2370 - 0x1770 .text + UnwindInfo: .rdata |
| ECD74 | 2480 | .pdata | ExceptionHook | Pointer to 2480 - 0x1880 .text + UnwindInfo: .rdata |
| ECD80 | 2534 | .pdata | ExceptionHook | Pointer to 2534 - 0x1934 .text + UnwindInfo: .rdata |
| ECD8C | 2570 | .pdata | ExceptionHook | Pointer to 2570 - 0x1970 .text + UnwindInfo: .rdata |
| ECD98 | 2620 | .pdata | ExceptionHook | Pointer to 2620 - 0x1A20 .text + UnwindInfo: .rdata |
| ECDA4 | 2750 | .pdata | ExceptionHook | Pointer to 2750 - 0x1B50 .text + UnwindInfo: .rdata |
| ECDB0 | 2798 | .pdata | ExceptionHook | Pointer to 2798 - 0x1B98 .text + UnwindInfo: .rdata |
| ECDBC | 27B4 | .pdata | ExceptionHook | Pointer to 27B4 - 0x1BB4 .text + UnwindInfo: .rdata |
| ECDC8 | 2A54 | .pdata | ExceptionHook | Pointer to 2A54 - 0x1E54 .text + UnwindInfo: .rdata |
| ECDD4 | 2AA8 | .pdata | ExceptionHook | Pointer to 2AA8 - 0x1EA8 .text + UnwindInfo: .rdata |
| ECDE0 | 2AE0 | .pdata | ExceptionHook | Pointer to 2AE0 - 0x1EE0 .text + UnwindInfo: .rdata |
| ECDEC | 2DE4 | .pdata | ExceptionHook | Pointer to 2DE4 - 0x21E4 .text + UnwindInfo: .rdata |
| ECDF8 | 3070 | .pdata | ExceptionHook | Pointer to 3070 - 0x2470 .text + UnwindInfo: .rdata |
| ECE04 | 3234 | .pdata | ExceptionHook | Pointer to 3234 - 0x2634 .text + UnwindInfo: .rdata |
| ECE10 | 354C | .pdata | ExceptionHook | Pointer to 354C - 0x294C .text + UnwindInfo: .rdata |
| ECE1C | 362C | .pdata | ExceptionHook | Pointer to 362C - 0x2A2C .text + UnwindInfo: .rdata |
| ECE28 | 36E8 | .pdata | ExceptionHook | Pointer to 36E8 - 0x2AE8 .text + UnwindInfo: .rdata |
| ECE34 | 3730 | .pdata | ExceptionHook | Pointer to 3730 - 0x2B30 .text + UnwindInfo: .rdata |
| ECE40 | 37B0 | .pdata | ExceptionHook | Pointer to 37B0 - 0x2BB0 .text + UnwindInfo: .rdata |
| ECE4C | 3944 | .pdata | ExceptionHook | Pointer to 3944 - 0x2D44 .text + UnwindInfo: .rdata |
| ECE58 | 3994 | .pdata | ExceptionHook | Pointer to 3994 - 0x2D94 .text + UnwindInfo: .rdata |
| ECE64 | 39BC | .pdata | ExceptionHook | Pointer to 39BC - 0x2DBC .text + UnwindInfo: .rdata |
| ECE70 | 39E4 | .pdata | ExceptionHook | Pointer to 39E4 - 0x2DE4 .text + UnwindInfo: .rdata |
| ECE7C | 3AA8 | .pdata | ExceptionHook | Pointer to 3AA8 - 0x2EA8 .text + UnwindInfo: .rdata |
| ECE88 | 3AD4 | .pdata | ExceptionHook | Pointer to 3AD4 - 0x2ED4 .text + UnwindInfo: .rdata |
| ECE94 | 3B20 | .pdata | ExceptionHook | Pointer to 3B20 - 0x2F20 .text + UnwindInfo: .rdata |
| ECEA0 | 3B84 | .pdata | ExceptionHook | Pointer to 3B84 - 0x2F84 .text + UnwindInfo: .rdata |
| ECEAC | 3CBC | .pdata | ExceptionHook | Pointer to 3CBC - 0x30BC .text + UnwindInfo: .rdata |
| ECEB8 | 3D90 | .pdata | ExceptionHook | Pointer to 3D90 - 0x3190 .text + UnwindInfo: .rdata |
| ECEC4 | 3EB4 | .pdata | ExceptionHook | Pointer to 3EB4 - 0x32B4 .text + UnwindInfo: .rdata |
| ECED0 | 3F04 | .pdata | ExceptionHook | Pointer to 3F04 - 0x3304 .text + UnwindInfo: .rdata |
| ECEDC | 3F9C | .pdata | ExceptionHook | Pointer to 3F9C - 0x339C .text + UnwindInfo: .rdata |
| ECEE8 | 4074 | .pdata | ExceptionHook | Pointer to 4074 - 0x3474 .text + UnwindInfo: .rdata |
| ECEF4 | 40E8 | .pdata | ExceptionHook | Pointer to 40E8 - 0x34E8 .text + UnwindInfo: .rdata |
| ECF00 | 4174 | .pdata | ExceptionHook | Pointer to 4174 - 0x3574 .text + UnwindInfo: .rdata |
| ECF0C | 4438 | .pdata | ExceptionHook | Pointer to 4438 - 0x3838 .text + UnwindInfo: .rdata |
| ECF18 | 4598 | .pdata | ExceptionHook | Pointer to 4598 - 0x3998 .text + UnwindInfo: .rdata |
| ECF24 | 45C8 | .pdata | ExceptionHook | Pointer to 45C8 - 0x39C8 .text + UnwindInfo: .rdata |
| ECF30 | 4618 | .pdata | ExceptionHook | Pointer to 4618 - 0x3A18 .text + UnwindInfo: .rdata |
| ECF3C | 4680 | .pdata | ExceptionHook | Pointer to 4680 - 0x3A80 .text + UnwindInfo: .rdata |
| ECF48 | 4744 | .pdata | ExceptionHook | Pointer to 4744 - 0x3B44 .text + UnwindInfo: .rdata |
| ECF54 | 47E0 | .pdata | ExceptionHook | Pointer to 47E0 - 0x3BE0 .text + UnwindInfo: .rdata |
| ECF60 | 4918 | .pdata | ExceptionHook | Pointer to 4918 - 0x3D18 .text + UnwindInfo: .rdata |
| ECF6C | 4944 | .pdata | ExceptionHook | Pointer to 4944 - 0x3D44 .text + UnwindInfo: .rdata |
| ECF78 | 4974 | .pdata | ExceptionHook | Pointer to 4974 - 0x3D74 .text + UnwindInfo: .rdata |
| ECF84 | 49E4 | .pdata | ExceptionHook | Pointer to 49E4 - 0x3DE4 .text + UnwindInfo: .rdata |
| ECF90 | 4A60 | .pdata | ExceptionHook | Pointer to 4A60 - 0x3E60 .text + UnwindInfo: .rdata |
| ECF9C | 4B0C | .pdata | ExceptionHook | Pointer to 4B0C - 0x3F0C .text + UnwindInfo: .rdata |
| ECFA8 | 4C54 | .pdata | ExceptionHook | Pointer to 4C54 - 0x4054 .text + UnwindInfo: .rdata |
| ECFB4 | 4D28 | .pdata | ExceptionHook | Pointer to 4D28 - 0x4128 .text + UnwindInfo: .rdata |
| ECFC0 | 5348 | .pdata | ExceptionHook | Pointer to 5348 - 0x4748 .text + UnwindInfo: .rdata |
| ECFCC | 5364 | .pdata | ExceptionHook | Pointer to 5364 - 0x4764 .text + UnwindInfo: .rdata |
| ECFD8 | 53A8 | .pdata | ExceptionHook | Pointer to 53A8 - 0x47A8 .text + UnwindInfo: .rdata |
| ECFE4 | 5410 | .pdata | ExceptionHook | Pointer to 5410 - 0x4810 .text + UnwindInfo: .rdata |
| ECFF0 | 548C | .pdata | ExceptionHook | Pointer to 548C - 0x488C .text + UnwindInfo: .rdata |
| ECFFC | 54E4 | .pdata | ExceptionHook | Pointer to 54E4 - 0x48E4 .text + UnwindInfo: .rdata |
| ED008 | 5540 | .pdata | ExceptionHook | Pointer to 5540 - 0x4940 .text + UnwindInfo: .rdata |
| ED014 | 5598 | .pdata | ExceptionHook | Pointer to 5598 - 0x4998 .text + UnwindInfo: .rdata |
| ED020 | 5680 | .pdata | ExceptionHook | Pointer to 5680 - 0x4A80 .text + UnwindInfo: .rdata |
| ED02C | 56D4 | .pdata | ExceptionHook | Pointer to 56D4 - 0x4AD4 .text + UnwindInfo: .rdata |
| ED038 | 57A0 | .pdata | ExceptionHook | Pointer to 57A0 - 0x4BA0 .text + UnwindInfo: .rdata |
| ED044 | 5AB4 | .pdata | ExceptionHook | Pointer to 5AB4 - 0x4EB4 .text + UnwindInfo: .rdata |
| ED050 | 5AF8 | .pdata | ExceptionHook | Pointer to 5AF8 - 0x4EF8 .text + UnwindInfo: .rdata |
| ED05C | 5CEC | .pdata | ExceptionHook | Pointer to 5CEC - 0x50EC .text + UnwindInfo: .rdata |
| ED068 | 5D1C | .pdata | ExceptionHook | Pointer to 5D1C - 0x511C .text + UnwindInfo: .rdata |
| ED074 | 5D54 | .pdata | ExceptionHook | Pointer to 5D54 - 0x5154 .text + UnwindInfo: .rdata |
| ED080 | 5D88 | .pdata | ExceptionHook | Pointer to 5D88 - 0x5188 .text + UnwindInfo: .rdata |
| ED08C | 5DF4 | .pdata | ExceptionHook | Pointer to 5DF4 - 0x51F4 .text + UnwindInfo: .rdata |
| ED098 | 5F3C | .pdata | ExceptionHook | Pointer to 5F3C - 0x533C .text + UnwindInfo: .rdata |
| ED0A4 | 5FE4 | .pdata | ExceptionHook | Pointer to 5FE4 - 0x53E4 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 696972 | 54,234% |
| Null Byte Code | 273043 | 21,2465% |
© 2026 All rights reserved.