PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 845,50 KBSHA-256 Hash: 2DEEDEA02811BB8E288DB1A96AAC44BBFB533FD624B25F000823FA92BAABD9A1 SHA-1 Hash: 585CB5933DB5A9209E663C66778DFFF07669A8FE MD5 Hash: 441A67671330483C53AB5FB9845C5B3A Imphash: E793B7DB52040C47148974DB61DA7AFB MajorOSVersion: 6 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 560B0 SizeOfHeaders: 400 SizeOfImage: D3000 ImageBase: 0000000140000000 Architecture: x64 ExportTable: 8FD20 ImportTable: 8FDBC IAT: 77000 Characteristics: 22 TimeDateStamp: 0 Date: 01/01/1970 File Type: EXE File Type: DLL Number Of Sections: 9 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .data2, .pvmut, .fptable, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | 76000 | 1000 | 76000 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
77000 | 1B000 | 77000 | 1B000 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
92000 | 7000 | 92000 | 7000 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
99000 | 5000 | 99000 | 5000 |
|
|
| .data2 | 0xC0000040 Initialized Data Readable Writeable |
9E000 | 1000 | 9E000 | 1000 |
|
|
| .pvmut | 0xC0000040 Initialized Data Readable Writeable |
9F000 | 1000 | 9F000 | 1000 |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
A0000 | 1000 | A0000 | 1000 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
A1000 | 31000 | A1000 | 31000 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
D2000 | 1000 | D2000 | 1000 |
|
|
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 1,50 KB |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 560B0 Code -> 4883EC28E8D70600004883C428E96EFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCCB902000000CD29C3CCCCCCCCCCCCCCCC4883 Assembler |SUB RSP, 0X28 |CALL 0X140056790 |ADD RSP, 0X28 |JMP 0X140055F30 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |MOV ECX, 2 |INT 0X29 |RET |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • Entropy: 6.41379 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| NTDLL.DLL | NtUnmapViewOfSection | Unmaps a process memory section. |
| NTDLL.DLL | NtCreateThreadEx | Creates a thread in the virtual address space of another process. |
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | CopyFileW | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | SleepEx | Pauses the execution of the current thread, optionally allowing the thread to be awakened by a kernel object or upon expiration of a timeout. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | GetThreadContext | Retrieves a thread execution context. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | ReleaseSemaphore | Releases ownership of a semaphore. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | CreateFileMappingW | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | CreateSemaphoreW | Creates or opens a semaphore object. |
| KERNEL32.DLL | OpenEventA | Opens an existing event object. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| Ws2_32.DLL | recv | Receives data from a network socket. |
| Ws2_32.DLL | send | Sends data through a network socket. |
| ADVAPI32.DLL | CryptDecrypt | Performs a cryptographic operation on data in a data block. |
| ADVAPI32.DLL | RegDeleteValueA | Removes a named value from the specified registry key. Note that value names are not case sensitive. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| Windows REG |
| SYSTEM\CurrentControlSet\Enum\USBSTOR SYSTEM\CurrentControlSet\Services\WinSxAutoInstallService Rebuilt string - SOFTWARE\Policies\Microsoft\Windows\System |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\Windows NT\CurrentVersion SOFTWARE\Microsoft\Cryptography Software\Classes\CLSID\ Software\Microsoft\Windows\CurrentVersion\RunOnce Software\Microsoft\Windows\CurrentVersion\Run Software\Classes\CLSID\%s Software\Classes\CLSID\%s\InprocServer32 Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run32 Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder System\CentralProcessor\0 Rebuilt string - SOFTWARE\Policies\Microsoft\Windows\System Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run |
| File Access |
| client_stub.exe vmwareuser.exe vmwaretray.exe vmtoolsd.exe vboxtray.exe qemu-ga.exe vmusrvc.exe vgauthservice.exe vboxservice.exe \userinit.exe \windows\explorer.exe %s%08X%08X.exe \cmd.exe back to cmd.exe already cmd.exe pwsh.exe powershell.exe KERNEL32.dll ncrthost.dll WINHTTP.dll CRYPT32.dll OLEAUT32.dll bcrypt.dll SHELL32.dll ole32.dll USER32.dll ADVAPI32.dll WS2_32.dll ntdll.dll %sdct%08lx.dll %sdc%08lx%04x.dll kernelbase.dll sechost.dll urlmon.dll dbghelp.dll @.dat .dat .dat %swctk.dat %swcti.dat _Sb%s\Desktop\dc_hrdp_debug.log wctt.log wcts.log %s\Desktop\dc_hrdp_debug.txt $rs.Ini Temp UserProfile |
| File Access (UNICODE) |
| 0\powershell.exe cmd.exe \Windows\System32\svchost.exe \svchost.exe explorer.exe %s\cmd.exe %s\cscript.exe %s\*.exe write.exe notepad.exe dc_shc_host.exe mscoree.dll user32.dll \KnownDlls\ntdll.dll ntdll.dll advapi32.dll kernel32.dll \Temp\mscorsvw.dat 0\UsageLogs\clr.dat cache\winsvc.dat desktop.ini Exec - cmd.exe /c ping 127.0.0.1 -n 3 >nul Exec - powershell.exe Exec - powershell.exe Temp ProgramFiles AppData |
| Interest's Words |
| PADDINGX Decrypt cscript wscript exec powershell attrib start pause systeminfo ping expand |
| Interest's Words (UNICODE) |
| Encrypt Encryption cscript exec powershell attrib start ping |
| Anti-VM/Sandbox/Debug Tricks |
| VirtualBox Service - VBoxService.exe OllyDbg Libary - dbghelp.dll LabTools - taskmgr |
| IP Addresses |
| 127.0.0.1 |
| PE Carving |
| Start Offset Header | End Offset | Size (Bytes) |
|---|---|---|
| 0 | CFB10 | CFB10 |
| CFB10 | D3600 | 3AF0 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Hex | Hex Pattern | SYSCALL (SYSCALL - 4C8BD1B8) |
| Text | Ascii | Encryption (FromBase64String) |
| Text | Unicode | Technique used to circumvent security measures (Bypass) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text | PE/Payload |
|---|---|---|---|---|---|---|
| \ICON\1\1033 | A12B0 | 709E | A12B0 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000097048597300000EC300000EC301 | .PNG........IHDR.............\r.f....pHYs......... | N/A |
| \ICON\2\1033 | A8350 | 10828 | A8350 | 2800000080000000000100000100200000000000000801000000000000000000000000000000000000000000000000000000 | (............. ................................... | N/A |
| \ICON\3\1033 | B8B78 | 94A8 | B8B78 | 2800000060000000C00000000100200000000000809400000000000000000000000000000000000000000000000000000000 | (............ ................................... | N/A |
| \ICON\4\1033 | C2020 | 5488 | C2020 | 2800000048000000900000000100200000000000605400000000000000000000000000000000000000000000000000000000 | (...H......... .....T............................ | N/A |
| \ICON\5\1033 | C74A8 | 4228 | C74A8 | 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000 | (...@......... ......B............................ | N/A |
| \ICON\6\1033 | CB6D0 | 25A8 | CB6D0 | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ | N/A |
| \ICON\7\1033 | CDC78 | 10A8 | CDC78 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... | N/A |
| \ICON\8\1033 | CED20 | 988 | CED20 | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000060000 | (.......0..... .................................. | N/A |
| \ICON\9\1033 | CF6A8 | 468 | CF6A8 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000003000000360000 | (....... ..... .....@..........................6.. | N/A |
| \RCDATA\101\1033 | CFB10 | 1C00 | CFB10 | 4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000 | MZ......................@......................... | (Executable found) |
| \GROUP_ICON\1\1033 | D1710 | 84 | D1710 | 00000100090000000000010020009E700000010080800000010020002808010002006060000001002000A894000003004848 | ............ ..p.......... .(......... .......HH | N/A |
| \24\1\1033 | D1794 | 17D | D1794 | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y | N/A |
| Intelligent String |
| • .bss • ntdll.dll • kernel32.dll • .cmd • %swcti.dat • dbghelp.dll • urlmon.dll • winhttp.dll • sechost.dll • C:\Users\Public\Desktop\%s • wcts.log • wctt.log • _Sb%s\Desktop\dc_hrdp_debug.log • %s\Desktop\dc_hrdp_debug.txt • ip-api.com • C:\MachineGuid • .exe • cmd.exe /c ping 127.0.0.1 -n 3 >nul • %s\*.lnk • .lnk • dc_shc_host.exe • notepad.exe • write.exe • .cfg • %s\%s.lnk • %s\*.exe • desktop.ini • advapi32.dll • powershell.exe • pwsh.exe • type :cmd to leave, :psreset to restart] • %s\WindowsPowerShell\v1.0\powershell.exe • %s\System32\WindowsPowerShell\v1.0\powershell.exe • .ps1 • .vbs • %s\cscript.exe • C:\Windows\System32 • %s\cmd.exe • cmd.exe • /s /c "[encode failed] • explorer.exe • ws2_32.dll • kernelbase.dll • %sdct%08lx.dll • .out • \cmd.exe • cmd may have failed] • %s%08X%08X.exe • http://pastebin.com • %swctk.dat • \windows\explorer.exe • \userinit.exe • FLAGS ad=%d vm=%d sb=%d etw=%d amsi=%d uh=%d dump=%d masq=%d • \svchost.exe • C:\Windows\System32\svchost.exe • vboxservice.exevgauthservice.exe • vmusrvc.exe • qemu-ga.exe • vboxtray.exe • vmtoolsd.exe • vmwaretray.exe • vmwareuser.exe • 123time.windows.com • pool.ntp.org • \KnownDlls\ntdll.dll • user32.dll • C:\Windows • \.cache\winsvc.dat • \Microsoft\CLR_v4.0\UsageLogs\clr.dat • \Temp\mscorsvw.dat • mscoree.dll • .tls • inet_ntopinet_ptonWS2_32.dll • USER32.dll • bcrypt.dll • OLEAUT32.dll • ncrthost.dll • KERNEL32.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 132D | N/A | .text | CALL QWORD PTR [RIP+0x760F5] |
| 169D | N/A | .text | CALL QWORD PTR [RIP+0x75E55] |
| 1791 | N/A | .text | CALL QWORD PTR [RIP+0x75D61] |
| 1881 | N/A | .text | CALL QWORD PTR [RIP+0x75C71] |
| 1979 | N/A | .text | CALL QWORD PTR [RIP+0x75B79] |
| 1A99 | N/A | .text | CALL QWORD PTR [RIP+0x75A59] |
| 1BB9 | N/A | .text | CALL QWORD PTR [RIP+0x75939] |
| 1CD9 | N/A | .text | CALL QWORD PTR [RIP+0x75819] |
| 1DF9 | N/A | .text | CALL QWORD PTR [RIP+0x756F9] |
| 1F1D | N/A | .text | CALL QWORD PTR [RIP+0x755D5] |
| 2039 | N/A | .text | CALL QWORD PTR [RIP+0x754B9] |
| 2159 | N/A | .text | CALL QWORD PTR [RIP+0x75399] |
| 2271 | N/A | .text | CALL QWORD PTR [RIP+0x75281] |
| 238D | N/A | .text | CALL QWORD PTR [RIP+0x75165] |
| 24AD | N/A | .text | CALL QWORD PTR [RIP+0x75045] |
| 25C9 | N/A | .text | CALL QWORD PTR [RIP+0x74F29] |
| 26E9 | N/A | .text | CALL QWORD PTR [RIP+0x74E09] |
| 27FD | N/A | .text | CALL QWORD PTR [RIP+0x74CF5] |
| 6684 | N/A | .text | CALL QWORD PTR [RIP+0x70DBE] |
| 668E | N/A | .text | CALL QWORD PTR [RIP+0x70E64] |
| 6699 | N/A | .text | CALL QWORD PTR [RIP+0x70DD9] |
| 674B | N/A | .text | CALL QWORD PTR [RIP+0x70CF7] |
| 6755 | N/A | .text | CALL QWORD PTR [RIP+0x70D9D] |
| 6760 | N/A | .text | CALL QWORD PTR [RIP+0x70D12] |
| 6809 | N/A | .text | CALL QWORD PTR [RIP+0x70C39] |
| 6813 | N/A | .text | CALL QWORD PTR [RIP+0x70CDF] |
| 681E | N/A | .text | CALL QWORD PTR [RIP+0x70C54] |
| 68CD | N/A | .text | CALL QWORD PTR [RIP+0x70C25] |
| 69A5 | N/A | .text | CALL QWORD PTR [RIP+0x70B4D] |
| 6A82 | N/A | .text | CALL QWORD PTR [RIP+0x70A70] |
| 6B66 | N/A | .text | CALL QWORD PTR [RIP+0x7098C] |
| 6C4A | N/A | .text | CALL QWORD PTR [RIP+0x708A8] |
| 6D2A | N/A | .text | CALL QWORD PTR [RIP+0x707C8] |
| 6E0F | N/A | .text | CALL QWORD PTR [RIP+0x706E3] |
| 6EF3 | N/A | .text | CALL QWORD PTR [RIP+0x705FF] |
| 6FDC | N/A | .text | CALL QWORD PTR [RIP+0x70516] |
| 70BB | N/A | .text | CALL QWORD PTR [RIP+0x70437] |
| 71AD | N/A | .text | CALL QWORD PTR [RIP+0x70345] |
| 7290 | N/A | .text | CALL QWORD PTR [RIP+0x70262] |
| 7379 | N/A | .text | CALL QWORD PTR [RIP+0x70179] |
| 7469 | N/A | .text | CALL QWORD PTR [RIP+0x70089] |
| 7547 | N/A | .text | CALL QWORD PTR [RIP+0x6FFAB] |
| 75CC | N/A | .text | CALL QWORD PTR [RIP+0x6FF26] |
| 76AD | N/A | .text | CALL QWORD PTR [RIP+0x6FE45] |
| 7791 | N/A | .text | CALL QWORD PTR [RIP+0x6FD61] |
| 7873 | N/A | .text | CALL QWORD PTR [RIP+0x6FC7F] |
| 7956 | N/A | .text | CALL QWORD PTR [RIP+0x6FB9C] |
| 7A32 | N/A | .text | CALL QWORD PTR [RIP+0x6FAC0] |
| 7B0E | N/A | .text | CALL QWORD PTR [RIP+0x6F9E4] |
| 94BA | N/A | .text | CALL QWORD PTR [RIP+0x6DF68] |
| 9859 | N/A | .text | CALL QWORD PTR [RIP+0x6DB41] |
| 9873 | N/A | .text | CALL QWORD PTR [RIP+0x6DB07] |
| 991A | N/A | .text | CALL QWORD PTR [RIP+0x6DB80] |
| 992D | N/A | .text | CALL QWORD PTR [RIP+0x6DA3D] |
| 993A | N/A | .text | CALL QWORD PTR [RIP+0x6DAC0] |
| 9945 | N/A | .text | CALL QWORD PTR [RIP+0x6DA25] |
| 9950 | N/A | .text | CALL QWORD PTR [RIP+0x6DA1A] |
| 99CD | N/A | .text | CALL QWORD PTR [RIP+0x6D94D] |
| 99D9 | N/A | .text | CALL QWORD PTR [RIP+0x6D991] |
| 99E4 | N/A | .text | CALL QWORD PTR [RIP+0x6D986] |
| 9B7F | N/A | .text | CALL QWORD PTR [RIP+0x6D8C3] |
| 9BA0 | N/A | .text | CALL QWORD PTR [RIP+0x6D952] |
| 9BFF | N/A | .text | CALL QWORD PTR [RIP+0x6D9DB] |
| 9D5D | N/A | .text | CALL QWORD PTR [RIP+0x6D9C5] |
| 9DC4 | N/A | .text | CALL QWORD PTR [RIP+0x6D95E] |
| 9DDE | N/A | .text | CALL QWORD PTR [RIP+0x6D94C] |
| 9E85 | N/A | .text | CALL QWORD PTR [RIP+0x6D89D] |
| 9E9F | N/A | .text | CALL QWORD PTR [RIP+0x6D88B] |
| 9F1B | N/A | .text | CALL QWORD PTR [RIP+0x6D807] |
| 9F35 | N/A | .text | CALL QWORD PTR [RIP+0x6D7F5] |
| A01E | N/A | .text | CALL QWORD PTR [RIP+0x6D704] |
| A0B5 | N/A | .text | CALL QWORD PTR [RIP+0x6D675] |
| A49C | N/A | .text | CALL QWORD PTR [RIP+0x6D006] |
| A4B0 | N/A | .text | CALL QWORD PTR [RIP+0x6CEBA] |
| A4C0 | N/A | .text | CALL QWORD PTR [RIP+0x6CEAA] |
| A659 | N/A | .text | CALL QWORD PTR [RIP+0x6D0E1] |
| A6AF | N/A | .text | CALL QWORD PTR [RIP+0x6CC33] |
| A6CA | N/A | .text | CALL QWORD PTR [RIP+0x6D290] |
| A7B8 | N/A | .text | CALL QWORD PTR [RIP+0x6D1B2] |
| A868 | N/A | .text | CALL QWORD PTR [RIP+0x6CD12] |
| A88E | N/A | .text | CALL QWORD PTR [RIP+0x6CCEC] |
| AB76 | N/A | .text | CALL QWORD PTR [RIP+0x6CA04] |
| ABBC | N/A | .text | CALL QWORD PTR [RIP+0x6C76E] |
| ABD2 | N/A | .text | CALL QWORD PTR [RIP+0x6C700] |
| ABED | N/A | .text | CALL QWORD PTR [RIP+0x6C6FD] |
| AC18 | N/A | .text | CALL QWORD PTR [RIP+0x6C6C2] |
| AC2B | N/A | .text | CALL QWORD PTR [RIP+0x6CD37] |
| ACDD | N/A | .text | CALL QWORD PTR [RIP+0x6C605] |
| AD95 | N/A | .text | CALL QWORD PTR [RIP+0x6C56D] |
| ADA7 | N/A | .text | CALL QWORD PTR [RIP+0x6C55B] |
| AE01 | N/A | .text | CALL QWORD PTR [RIP+0x6C4E1] |
| AE62 | N/A | .text | CALL QWORD PTR [RIP+0x6C488] |
| AE6F | N/A | .text | CALL QWORD PTR [RIP+0x6C46B] |
| AE7F | N/A | .text | CALL QWORD PTR [RIP+0x6C46B] |
| AE90 | N/A | .text | CALL QWORD PTR [RIP+0x6C44A] |
| AEEC | N/A | .text | CALL QWORD PTR [RIP+0x6C186] |
| AF86 | N/A | .text | CALL QWORD PTR [RIP+0x6C0FC] |
| AFFE | N/A | .text | CALL QWORD PTR [RIP+0x6C07C] |
| B011 | N/A | .text | CALL QWORD PTR [RIP+0x6C089] |
| B08D | N/A | .text | CALL QWORD PTR [RIP+0x6C275] |
| AAABC-AAAF7 | N/A | .rsrc | Potential obfuscated jump sequence detected, count: 30 |
| AABEC-AAC1F | N/A | .rsrc | Potential obfuscated jump sequence detected, count: 26 |
| AACBC-AAD03 | N/A | .rsrc | Potential obfuscated jump sequence detected, count: 36 |
| 77A78 | 14004F9FC | .rdata | TLS Callback | Pointer to 4F9FC - 0x4F9FC .text |
| 99000 | 14000100C | .pdata | ExceptionHook | Pointer to 100C - 0x100C .text + UnwindInfo: .rdata |
| 9900C | 140001044 | .pdata | ExceptionHook | Pointer to 1044 - 0x1044 .text + UnwindInfo: .rdata |
| 99018 | 14000107C | .pdata | ExceptionHook | Pointer to 107C - 0x107C .text + UnwindInfo: .rdata |
| 99024 | 1400010C0 | .pdata | ExceptionHook | Pointer to 10C0 - 0x10C0 .text + UnwindInfo: .rdata |
| 99030 | 1400010F8 | .pdata | ExceptionHook | Pointer to 10F8 - 0x10F8 .text + UnwindInfo: .rdata |
| 9903C | 140001148 | .pdata | ExceptionHook | Pointer to 1148 - 0x1148 .text + UnwindInfo: .rdata |
| 99048 | 1400011B4 | .pdata | ExceptionHook | Pointer to 11B4 - 0x11B4 .text + UnwindInfo: .rdata |
| 99054 | 140001210 | .pdata | ExceptionHook | Pointer to 1210 - 0x1210 .text + UnwindInfo: .rdata |
| 99060 | 140001248 | .pdata | ExceptionHook | Pointer to 1248 - 0x1248 .text + UnwindInfo: .rdata |
| 9906C | 140001260 | .pdata | ExceptionHook | Pointer to 1260 - 0x1260 .text + UnwindInfo: .rdata |
| 99078 | 140001314 | .pdata | ExceptionHook | Pointer to 1314 - 0x1314 .text + UnwindInfo: .rdata |
| 99084 | 140001324 | .pdata | ExceptionHook | Pointer to 1324 - 0x1324 .text + UnwindInfo: .rdata |
| 99090 | 140001340 | .pdata | ExceptionHook | Pointer to 1340 - 0x1340 .text + UnwindInfo: .rdata |
| 9909C | 1400013A8 | .pdata | ExceptionHook | Pointer to 13A8 - 0x13A8 .text + UnwindInfo: .rdata |
| 990A8 | 140001420 | .pdata | ExceptionHook | Pointer to 1420 - 0x1420 .text + UnwindInfo: .rdata |
| 990B4 | 14000148C | .pdata | ExceptionHook | Pointer to 148C - 0x148C .text + UnwindInfo: .rdata |
| 990C0 | 140001508 | .pdata | ExceptionHook | Pointer to 1508 - 0x1508 .text + UnwindInfo: .rdata |
| 990CC | 14000157C | .pdata | ExceptionHook | Pointer to 157C - 0x157C .text + UnwindInfo: .rdata |
| 990D8 | 1400015F8 | .pdata | ExceptionHook | Pointer to 15F8 - 0x15F8 .text + UnwindInfo: .rdata |
| 990E4 | 14000167C | .pdata | ExceptionHook | Pointer to 167C - 0x167C .text + UnwindInfo: .rdata |
| 990F0 | 140001770 | .pdata | ExceptionHook | Pointer to 1770 - 0x1770 .text + UnwindInfo: .rdata |
| 990FC | 140001860 | .pdata | ExceptionHook | Pointer to 1860 - 0x1860 .text + UnwindInfo: .rdata |
| 99108 | 140001958 | .pdata | ExceptionHook | Pointer to 1958 - 0x1958 .text + UnwindInfo: .rdata |
| 99114 | 140001A78 | .pdata | ExceptionHook | Pointer to 1A78 - 0x1A78 .text + UnwindInfo: .rdata |
| 99120 | 140001B98 | .pdata | ExceptionHook | Pointer to 1B98 - 0x1B98 .text + UnwindInfo: .rdata |
| 9912C | 140001CB8 | .pdata | ExceptionHook | Pointer to 1CB8 - 0x1CB8 .text + UnwindInfo: .rdata |
| 99138 | 140001DD8 | .pdata | ExceptionHook | Pointer to 1DD8 - 0x1DD8 .text + UnwindInfo: .rdata |
| 99144 | 140001EFC | .pdata | ExceptionHook | Pointer to 1EFC - 0x1EFC .text + UnwindInfo: .rdata |
| 99150 | 140002018 | .pdata | ExceptionHook | Pointer to 2018 - 0x2018 .text + UnwindInfo: .rdata |
| 9915C | 140002138 | .pdata | ExceptionHook | Pointer to 2138 - 0x2138 .text + UnwindInfo: .rdata |
| 99168 | 140002250 | .pdata | ExceptionHook | Pointer to 2250 - 0x2250 .text + UnwindInfo: .rdata |
| 99174 | 14000236C | .pdata | ExceptionHook | Pointer to 236C - 0x236C .text + UnwindInfo: .rdata |
| 99180 | 14000248C | .pdata | ExceptionHook | Pointer to 248C - 0x248C .text + UnwindInfo: .rdata |
| 9918C | 1400025A8 | .pdata | ExceptionHook | Pointer to 25A8 - 0x25A8 .text + UnwindInfo: .rdata |
| 99198 | 1400026C8 | .pdata | ExceptionHook | Pointer to 26C8 - 0x26C8 .text + UnwindInfo: .rdata |
| 991A4 | 1400027DC | .pdata | ExceptionHook | Pointer to 27DC - 0x27DC .text + UnwindInfo: .rdata |
| 991B0 | 1400029A4 | .pdata | ExceptionHook | Pointer to 29A4 - 0x29A4 .text + UnwindInfo: .rdata |
| 991BC | 140002A60 | .pdata | ExceptionHook | Pointer to 2A60 - 0x2A60 .text + UnwindInfo: .rdata |
| 991C8 | 140002B24 | .pdata | ExceptionHook | Pointer to 2B24 - 0x2B24 .text + UnwindInfo: .rdata |
| 991D4 | 140002BE0 | .pdata | ExceptionHook | Pointer to 2BE0 - 0x2BE0 .text + UnwindInfo: .rdata |
| 991E0 | 140002C94 | .pdata | ExceptionHook | Pointer to 2C94 - 0x2C94 .text + UnwindInfo: .rdata |
| 991EC | 140002D50 | .pdata | ExceptionHook | Pointer to 2D50 - 0x2D50 .text + UnwindInfo: .rdata |
| 991F8 | 140002E08 | .pdata | ExceptionHook | Pointer to 2E08 - 0x2E08 .text + UnwindInfo: .rdata |
| 99204 | 140002ECC | .pdata | ExceptionHook | Pointer to 2ECC - 0x2ECC .text + UnwindInfo: .rdata |
| 99210 | 140002F80 | .pdata | ExceptionHook | Pointer to 2F80 - 0x2F80 .text + UnwindInfo: .rdata |
| 9921C | 140003038 | .pdata | ExceptionHook | Pointer to 3038 - 0x3038 .text + UnwindInfo: .rdata |
| 99228 | 140003100 | .pdata | ExceptionHook | Pointer to 3100 - 0x3100 .text + UnwindInfo: .rdata |
| 99234 | 1400031B4 | .pdata | ExceptionHook | Pointer to 31B4 - 0x31B4 .text + UnwindInfo: .rdata |
| 99240 | 140003268 | .pdata | ExceptionHook | Pointer to 3268 - 0x3268 .text + UnwindInfo: .rdata |
| 9924C | 14000331C | .pdata | ExceptionHook | Pointer to 331C - 0x331C .text + UnwindInfo: .rdata |
| 99258 | 1400033E4 | .pdata | ExceptionHook | Pointer to 33E4 - 0x33E4 .text + UnwindInfo: .rdata |
| 99264 | 1400034AC | .pdata | ExceptionHook | Pointer to 34AC - 0x34AC .text + UnwindInfo: .rdata |
| 99270 | 140003560 | .pdata | ExceptionHook | Pointer to 3560 - 0x3560 .text + UnwindInfo: .rdata |
| 9927C | 14000359C | .pdata | ExceptionHook | Pointer to 359C - 0x359C .text + UnwindInfo: .rdata |
| 99288 | 140003614 | .pdata | ExceptionHook | Pointer to 3614 - 0x3614 .text + UnwindInfo: .rdata |
| 99294 | 140003690 | .pdata | ExceptionHook | Pointer to 3690 - 0x3690 .text + UnwindInfo: .rdata |
| 992A0 | 14000371C | .pdata | ExceptionHook | Pointer to 371C - 0x371C .text + UnwindInfo: .rdata |
| 992AC | 1400037DC | .pdata | ExceptionHook | Pointer to 37DC - 0x37DC .text + UnwindInfo: .rdata |
| 992B8 | 1400038CC | .pdata | ExceptionHook | Pointer to 38CC - 0x38CC .text + UnwindInfo: .rdata |
| 992C4 | 140003980 | .pdata | ExceptionHook | Pointer to 3980 - 0x3980 .text + UnwindInfo: .rdata |
| 992D0 | 140003A50 | .pdata | ExceptionHook | Pointer to 3A50 - 0x3A50 .text + UnwindInfo: .rdata |
| 992DC | 140003B14 | .pdata | ExceptionHook | Pointer to 3B14 - 0x3B14 .text + UnwindInfo: .rdata |
| 992E8 | 140003C08 | .pdata | ExceptionHook | Pointer to 3C08 - 0x3C08 .text + UnwindInfo: .rdata |
| 992F4 | 140003CF8 | .pdata | ExceptionHook | Pointer to 3CF8 - 0x3CF8 .text + UnwindInfo: .rdata |
| 99300 | 140003D74 | .pdata | ExceptionHook | Pointer to 3D74 - 0x3D74 .text + UnwindInfo: .rdata |
| 9930C | 140003DF8 | .pdata | ExceptionHook | Pointer to 3DF8 - 0x3DF8 .text + UnwindInfo: .rdata |
| 99318 | 140003EA8 | .pdata | ExceptionHook | Pointer to 3EA8 - 0x3EA8 .text + UnwindInfo: .rdata |
| 99324 | 140003F50 | .pdata | ExceptionHook | Pointer to 3F50 - 0x3F50 .text + UnwindInfo: .rdata |
| 99330 | 140004080 | .pdata | ExceptionHook | Pointer to 4080 - 0x4080 .text + UnwindInfo: .rdata |
| 9933C | 140004284 | .pdata | ExceptionHook | Pointer to 4284 - 0x4284 .text + UnwindInfo: .rdata |
| 99348 | 140004378 | .pdata | ExceptionHook | Pointer to 4378 - 0x4378 .text + UnwindInfo: .rdata |
| 99354 | 1400045C0 | .pdata | ExceptionHook | Pointer to 45C0 - 0x45C0 .text + UnwindInfo: .rdata |
| 99360 | 1400045E8 | .pdata | ExceptionHook | Pointer to 45E8 - 0x45E8 .text + UnwindInfo: .rdata |
| 9936C | 140004620 | .pdata | ExceptionHook | Pointer to 4620 - 0x4620 .text + UnwindInfo: .rdata |
| 99378 | 140004664 | .pdata | ExceptionHook | Pointer to 4664 - 0x4664 .text + UnwindInfo: .rdata |
| 99384 | 140004694 | .pdata | ExceptionHook | Pointer to 4694 - 0x4694 .text + UnwindInfo: .rdata |
| 99390 | 140004790 | .pdata | ExceptionHook | Pointer to 4790 - 0x4790 .text + UnwindInfo: .rdata |
| 9939C | 1400048B4 | .pdata | ExceptionHook | Pointer to 48B4 - 0x48B4 .text + UnwindInfo: .rdata |
| 993A8 | 1400049E8 | .pdata | ExceptionHook | Pointer to 49E8 - 0x49E8 .text + UnwindInfo: .rdata |
| 993B4 | 140004B2C | .pdata | ExceptionHook | Pointer to 4B2C - 0x4B2C .text + UnwindInfo: .rdata |
| 993C0 | 140004CA4 | .pdata | ExceptionHook | Pointer to 4CA4 - 0x4CA4 .text + UnwindInfo: .rdata |
| 993CC | 140004E5C | .pdata | ExceptionHook | Pointer to 4E5C - 0x4E5C .text + UnwindInfo: .rdata |
| 993D8 | 140004FA0 | .pdata | ExceptionHook | Pointer to 4FA0 - 0x4FA0 .text + UnwindInfo: .rdata |
| 993E4 | 140005114 | .pdata | ExceptionHook | Pointer to 5114 - 0x5114 .text + UnwindInfo: .rdata |
| 993F0 | 140005238 | .pdata | ExceptionHook | Pointer to 5238 - 0x5238 .text + UnwindInfo: .rdata |
| 993FC | 14000538C | .pdata | ExceptionHook | Pointer to 538C - 0x538C .text + UnwindInfo: .rdata |
| 99408 | 140005494 | .pdata | ExceptionHook | Pointer to 5494 - 0x5494 .text + UnwindInfo: .rdata |
| 99414 | 140005504 | .pdata | ExceptionHook | Pointer to 5504 - 0x5504 .text + UnwindInfo: .rdata |
| 99420 | 140005600 | .pdata | ExceptionHook | Pointer to 5600 - 0x5600 .text + UnwindInfo: .rdata |
| 9942C | 140005670 | .pdata | ExceptionHook | Pointer to 5670 - 0x5670 .text + UnwindInfo: .rdata |
| 99438 | 14000576C | .pdata | ExceptionHook | Pointer to 576C - 0x576C .text + UnwindInfo: .rdata |
| 99444 | 1400058A4 | .pdata | ExceptionHook | Pointer to 58A4 - 0x58A4 .text + UnwindInfo: .rdata |
| 99450 | 140005928 | .pdata | ExceptionHook | Pointer to 5928 - 0x5928 .text + UnwindInfo: .rdata |
| 9945C | 1400059AC | .pdata | ExceptionHook | Pointer to 59AC - 0x59AC .text + UnwindInfo: .rdata |
| 99468 | 140005A30 | .pdata | ExceptionHook | Pointer to 5A30 - 0x5A30 .text + UnwindInfo: .rdata |
| 99474 | 140005AB4 | .pdata | ExceptionHook | Pointer to 5AB4 - 0x5AB4 .text + UnwindInfo: .rdata |
| 99480 | 140005B38 | .pdata | ExceptionHook | Pointer to 5B38 - 0x5B38 .text + UnwindInfo: .rdata |
| 9948C | 140005BBC | .pdata | ExceptionHook | Pointer to 5BBC - 0x5BBC .text + UnwindInfo: .rdata |
| 99498 | 140005C40 | .pdata | ExceptionHook | Pointer to 5C40 - 0x5C40 .text + UnwindInfo: .rdata |
| 994A4 | 140005CC4 | .pdata | ExceptionHook | Pointer to 5CC4 - 0x5CC4 .text + UnwindInfo: .rdata |
| D3000 | N/A | *Overlay* | 56488BF44883E4F04883EC20E805000000488BE6 | VH..H...H.. .....H.. |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 478285 | 55,2425% |
| Null Byte Code | 181599 | 20,9749% |
© 2026 All rights reserved.