PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,75 MBSHA-256 Hash: 24021A8186828E1EDDE94747AECD803014D38FCA1788682FAC395E8F37A30110 SHA-1 Hash: ED2518DCCC8D3FAB71BFBE0E4719A30FCE449C14 MD5 Hash: 5EA3464E3D6BA2D5677657C9A7903B5A Imphash: D9DA1BD8DAFF0D66388E5F8A6140380E MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 001CF42D EntryPoint (rva): 6ECC SizeOfHeaders: 1000 SizeOfImage: 1D1000 ImageBase: 400000 Architecture: x86 ImportTable: 1BC854 IAT: 1000 Characteristics: 10F TimeDateStamp: 4AD78F14 Date: 15/10/2009 21:07:32 File Type: EXE Number Of Sections: 3 ASLR: Disabled Section Names: .text, .data, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | 1BD000 | 1000 | 1BC4DC |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
1BE000 | 1000 | 1BE000 | 118B0 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1BF000 | 1000 | 1D0000 | 6C4 |
|
|
| Description |
| OriginalFilename: Electra.exe CompanyName: Electra Software LegalCopyright: 1995 - 2005 ProductName: Electra 3.4 FileVersion: 3.03.0066 ProductVersion: 3.03.0066 Comments: Professional Service Business Software Language: Spanish (Spain, Modern Sort) (ID=0xC0A) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 6ECC Code -> 682C704000E8EEFFFFFF000000000000300000006000000038000000D497306B84EB8B4DA07CCB5BF5F2B875000000000000 Assembler |PUSH 0X40702C |CALL 0X406EC4 |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |XOR BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |PUSHAD |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], BH |ADD BYTE PTR [EAX], AL |ADD AH, DL |XCHG EAX, EDI |XOR BYTE PTR [EBX - 0X7C], CH |JMP 0X406E7A |DEC EBP |MOV AL, BYTE PTR [0XF55BCB7C] |MOV EAX, 0X75 |ADD BYTE PTR [EAX], AL |
| Signatures |
| Rich Signature Analyzer: Code -> 6B63C6C22F02A8912F02A8912F02A891AC1EA6912E02A8916020A1910702A8912B21A5912E02A891526963682F02A891 Footprint md5 Hash -> F19C3CCDB2EBC4F7A42FFA211C121BE2 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Visual Basic 6 - (Native Code) Detect It Easy (die) • PE: compiler: Microsoft Visual Basic(6.0)[Native] • PE: linker: Microsoft Linker(6.0*)[-] • Entropy: 5.72503 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| MSVBVM60.DLL | DllFunctionCall | It enables calling routines from external DLLs in VB code, integrating external code into Visual Basic projects. |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| Windows REG |
| SYSTEM\PERCNT32.oca |
| File Access |
| MSVBVM60.DLL kernel32.dll Keylib32.dll shell32.dll VBA6.DLL VB5!VB6ES.DLL .dat .ZIP Temp |
| File Access (UNICODE) |
| Electra.exe notepad.exe DLL or the XCDUNZIP.DLL electra3.ini as the ZIP archive, electra3.zip ELECTRA3.ZIP Electra3.zip electra3.zip Zip)|*.zip +{Inactivity.Zip +{Client.Zip And {Client.Zip {Client.Zip +{Contact.Zip Temp |
| SQL Queries |
| Select disk drive from which you want to restore your database. Then insert the backup floppy disk into the selected drive. Select * From Schedule Where PractitionerId = SELECT * FROM Client WHERE FstNm = Select Max(ClntId) From Client SELECT * FROM Schedule WHERE CntctId = SELECT * FROM Contact WHERE FstNm = SELECT MAX(CntctId) FROM Contact Select Count(*) from Notes Where ClntId = Select Count(*) from Visit Where ClntId = Select Sum(Total) from Visit Where ClntId = Select * From Client Where FstNm = " Select * From Client Where Status = Active Order By LstNm Select * From Client Order By LstNm Select * From Client Where Status = Inactive Order By LstNm SELECT Service.*, Product.* FROM Service Select FstNm, LstNm, MidInit From Contact Where CntctId = Select FstNm, LstNm, MidInit From Client Where ClntId = Select * From Schedule Where CntctId = Select * From Schedule Where ClntId = Select * From location WHERE inactive = no Select * From Contact Select * From Client Select * From Inactivity Select * From Notes Where ClntId = Select * from RateSched where Select * From RateSched Where ServId = 0 and ProdId = 0 Select * from RateSched Where ServId = Select * From RateSched Where ServId = SELECT DISTINCTROW VisitType, ProdType From VisitType Select * from Product Where ServId = Select * from Product Where ProdId = Select Max(ServId) From Service Select Max(ProdId) From Product Select * From Service Where ServId = Select * From Product Where ProdId = Select * from Service Where ServId = Select * From VisitArea Where ClntId = SELECT * FROM VisitArea Select * FROM VisitArea WHERE ClntId = Select * from Schedule Where StartDate = Select * From History Where ClntId = Select * From Treatment Where ClntId = Select * From Practitioner Where Select * From Location Where Select * From Visit Where ClntId = Select * From Password Select Note, NoteD From Notes Where ClntId = Select * From Schedule Where StartDate = Select * From Practitioner Where InActive = 0 Order By PractLstNm, PractFstNm SELECT * FROM Location WHERE inactive = no ORDER BY LocationId Select * From Client Where ClntId = Select * From Contact Where CntctId = SELECT CntctTypeC FROM CntctType ORDER BY CntctTypeC Select Max(TrmtD) from Visit Where ClntId = Select ClntId, StartDate From Schedule Where ClntId = Select CntctId, StartDate From Schedule Where CntctId = Select Min(TrmtD) from Visit Where ClntId = Select * from Business Where BusinessId = 0 SELECT * FROM Practitioner Where Default = -1 SELECT * FROM Practitioner Where InActive = 0 ORDER BY PractitionerId Select * From Select * From [Time] Where Select Service.ServId, ServName, Product.ProdId, ProdName From Product Select * from Practitioner Select * From Minutes Where Description = Select * From Schedule Where BookDate = SELECT * FROM Visit WHERE ClntId = Select * from Visit Where ClntId = Select FstNm, MidInit, LstNm From Client Select LineItem from Visit Where ClntId = Select Max(LineItem) As MaxLine from Visit Where ClntId = SELECT DISTINCTROW Service.ServName, Product.ProdName FROM Service SELECT DISTINCTROW VisitType From VisitType SELECT DISTINCTROW * FROM RateSched WHERE ServId = SELECT DISTINCTROW Service.ServName, Product.* FROM Service Select * From PmtMthd Where SELECT * FROM Product WHERE ProdId= SELECT DISTINCTROW * FROM Service Select Min(StartDate) From Schedule Select Min(StartDate) From Schedule Where PractitionerID = Select Max(StartDate) From Schedule Select Max(StartDate) From Schedule Where PractitionerID = Select top 1 endTime From Schedule Where startDate = SELECT * FROM Schedule SELECT * FROM Client SELECT * FROM Contact SELECT * FROM History SELECT * FROM Location SELECT * FROM Notes SELECT * FROM Practitioner SELECT * FROM Treatment SELECT * FROM RateSched SELECT * FROM Area SELECT * FROM CntctType SELECT * FROM Mode SELECT * FROM PmtMthd SELECT * FROM Reference SELECT * FROM ApptType SELECT * FROM ToDoList SELECT * FROM Business SELECT * FROM Password SELECT * FROM Product SELECT * FROM Service SELECT * FROM Visit ORDER By ClntID, TrmtD SELECT * FROM VisitArea Select * From Practitioner Order By PractLstNm, PractFstNm"Use Arrows to Scroll Practitioners Select LstNm, FstNm, Company, CntctTypeC From ContactContact Select ModeC as Mode, ModeX From ModedatMode SELECT Distinctrow [Practitioner].[PractFstNm] & " " & [Practitioner].[PractLstNm] AS PractName, PractitionerId, IIf([Inactive]=True,"Inactive","Active") AS Status From Practitioner Order by PractLstNm, PractFstNmdatPractitioner Select * from Client Order by LstNm, FstNmdatClient Select ServId, ServName From Service Order by ServNamedatService1 SELECT Service.*, Product.* FROM Service INNER JOIN Product ON Service.ServId = Product.ServId WHERE ProdType="Prod" ORDER BY ServName, ProdNamedatInventory Select [Practitioner].[PractFstNm] & " " & [Practitioner].[PractLstNm] As PractNm, PractitionerId From Practitioner Where Inactive = 0 Order by PractLstNm, PractFstNmdatPract Select * From Contact Order By LstNm%Use Arrows to Scroll Through Contacts Select CntctTypeTxt, CntctTypeC From CntctTypeCntctType Select * From Treatment Where ClntId = 0datTrmt Select Duration, Order from Duration Order by [Duration].[Order]datDuration Select Frequency,Order From Frequency Order by [Frequency].[Order]datFrequency Select Areac, AreaNm from AreadatArea select name, locationID from location where Inactive = no order by namedatLocation SELECT Distinctrow [Practitioner].[PractFstNm] & " " & [Practitioner].[PractLstNm] AS PractName, PractitionerId From Practitioner Where InActive = 0 Order By PractLstNm, PractFstNmdatPractitoner Select * from ApptType Order By ApptTypedatApptType SELECT Distinctrow [Practitioner].[PractFstNm] & " " & [Practitioner].[PractLstNm] AS PractName, PractitionerId, IIf([Inactive]=True,"Inactive","Active") AS Status From Practitioner Order by PractLstNm, PractFstNmdatPratitioner Select Text From BirthdaydatBirthday Select LabelText, LabelDesc, LabelType from LabelsdatLabelType Select Distinctrow [Client].[LstNm] & ", " & [Client].[FstNm] As ClntNm, ClntId, FstNm, MidInit, LstNm From Client Order By LstNm, FstNmData1 Select CntctTypeTxt, CntctTypeC From CntctTypedatCntctType Select DistinctRow [Contact].[LstNm] & ", " & [Contact].[FstNm] As CntctName, Company, CntctId From ContactdatContact SELECT Distinctrow [Practitioner].[PractFstNm] & " " & [Practitioner].[PractLstNm] AS PractName, PractitionerId, IIf([Inactive]=True,"Inactive","Active") AS Status From Practitioner Order by PractLstNm, PractFstNmdatPractitioner Select * From Client Where Status = Active Order By LstNm$Use Arrows to Scroll Through Clients Select * from Reference Order By RefrdByIddatReference Select [Client].[LstNm] & ", " & [Client].[FstNm] & " " & [Client].[MidInit] As ClntNm, ClntId From Client Order By LstNm, FstNm, MidInitdatRefrdClnt Select CntctTypeTxt, CntctTypeC from CntctTypedatContType Select [Client].[LstNm] & ", " & [Client].[FstNm] & " " & [Client].[MidInit] As ClntNm, ClntId, [Client].[LstNm] , [Client].[FstNm], [Client].[MidInit] from Client order by LstNmdatClient Select ProdName from ProductdatProduct Select Name, LocationId from Location Order by NamedatLocation Select * From Visit Where ClntId = 0datVisit SELECT DistinctRow [Practitioner].[PractFstNm] & " " & [Practitioner].[PractLstNm] AS PractNm, PractitionerId, IIf([Inactive]=True,"Inactive","Active") AS Status From Practitioner Order by PractLstNm, PractFstNmdatPractitioner Select Name, LocationId From Location Order by NamedatLocation Select PmtMthdX, PmtMthdC from PmtMthddatPmtMthd Insert Into Inactivity Insert Into Service (ServId, ServName, Default) Values ( INSERT INTO apptType (apptType) VALUES (" INSERT INTO VisitArea (ClntId,LineItem,AreaC,[Time],Minutes,Intensity,Milliamps,Needle,Mode) delete from schedule for selected days Delete from Visit where ClntId = Delete from VisitArea where ClntId = Delete from Treatment where ClntId = Delete from History where ClntId = Delete from Notes where ClntId = Delete from Schedule where ClntId = |
| Interest's Words |
| ToolBar Encrypt Decrypt PassWord exec start pause expand |
| Interest's Words (UNICODE) |
| PassWord exec start pause expand replace |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | Keyboard Key ({Tab}) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Unicode | Unauthorized movement of funds or data (Transfer) |
| Entry Point | Hex Pattern | Microsoft Visual Basic v5.0 - v6.0 |
| Entry Point | Hex Pattern | Microsoft Visual Basic v5.0 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\30001\0 | 1D03DC | 2E8 | 1BF3DC | 28000000200000004000000001000400000000000000000000000000000000000000000000000000000000000000BF0000BF | (... ...@......................................... |
| \GROUP_ICON\1\0 | 1D03C8 | 14 | 1BF3C8 | 0000010001002020100001000400E80200003175 | ...... ..........1u |
| \VERSION\1\3082 | 1D00F0 | 2D8 | 1BF0F0 | D80234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000300 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • [1].gif • .ZIP;.LZH;.ARC;.ARJ;.ZOO • MSVBVM60.DLL • VB5!VB6ES.DLL • password.mdb • C:\Program Files\Microsoft Visual Studio\VB98\VB6.OLB • C:\WINNT\system32\Vsocx6.oca • VBA6.DLL • C:\PROGRA~1\DataMask\bin\gtmask32.oca • C:\SSCALW~1\SSCALA32.oca • C:\PROGRA~1\ReSizOCX\Resize32.oca • C:\PROGRA~1\INFRAG~1\DATAWI~1\ssdw3b32.oca • C:\WINNT\system32\Mscomctl.oca • C:\DBITech\SPPro2\COMPON~1\ctmday.oca • C:\SSCALW~1\SSCALB32.oca • C:\PROGRA~1\INFRAG~1\DATAWI~1\ssdw3a32.oca • .txt • notepad.exe • emailclnt.rpt • emailcont.rpt • emailinact.rpt • avry5160.rpt • avry5161.rpt • avry5162.rpt • avry5389.rpt • cont5160.rpt • cont5161.rpt • cont5162.rpt • cont5389.rpt • inact5160.rpt • inact5161.rpt • inact5162.rpt • inact5389.rpt • mailclnt.rpt • mailcont.rpt • mailinact.rpt • Keylib32.dll • kernel32.dll • appoint.rpt • practone.rpt • practsum.rpt • InvReo.rpt • referral.rpt • InvQty.rpt • contact.rpt • client.rpt • detail.rpt • individ.rpt • acctsum.rpt • referall.rpt • inactive.rpt • C:\PROGRA~1\DataTree\bin\gtTree32.oca • C:\PROGRA~1\DataMask\bin\gtnum32.oca • Access Database (*.mdb)|*.mdb|Zip archive (*.Zip)|*.zip • history.rpt • Access Database (*.mdb)|*.mdb • removal.rpt • electra3.zip • :C:\WINNT\SYSTEM\PERCNT32.oca • C:\XCEEDZIP\xceedzip.oca • backup.mdb • treatmnt.rpt • electra3.mdb • electra3.ini • electra3.new • electra3.bak • restore.mdb • Visitwrk.rpt • Visitrcp.rpt • Restore.mdb • ELECTRA3.ZIP • *.MDB • .mdb • *.mdb • \backup.mdb • \Backup.mdb • \Restore.mdb • Product.ico • Hand1.ico • Exclaim.ico • ClnProd.ico • DefProd.ico • ClnHand.ico • DefHand.ico • Default.ico • Folder.ico • temp.mdb • Template.mdb • Database Files(*.mdb)|*.mdb • Electra.exe |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 69F0 | 40112C | .text | JMP [static] | Indirect jump to absolute memory address |
| 69F6 | 4011C8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 69FC | 401200 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A02 | 4010D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A08 | 401098 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A0E | 401254 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A14 | 401040 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A1A | 401280 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A20 | 4010E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A26 | 401278 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A2C | 40125C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A32 | 4011DC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A38 | 401194 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A3E | 4011D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A44 | 401058 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A4A | 401014 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A50 | 4012E0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A56 | 401010 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A5C | 40132C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A62 | 401230 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A68 | 40111C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A6E | 4011AC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A74 | 40131C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A7A | 401304 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A80 | 4012F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A86 | 4010D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A8C | 401178 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A92 | 401334 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A98 | 4010E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A9E | 401090 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AA4 | 401248 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AAA | 401048 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AB0 | 4011EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AB6 | 401148 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6ABC | 40120C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AC2 | 40117C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AC8 | 401034 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6ACE | 401174 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AD4 | 401154 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6ADA | 401030 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AE0 | 40119C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AE6 | 401104 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AEC | 4010B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AF2 | 401064 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AF8 | 40103C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AFE | 401270 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B04 | 40101C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B0A | 4012EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B10 | 40106C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B16 | 401214 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B1C | 4010D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B22 | 401318 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B28 | 401284 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B2E | 401044 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B34 | 401024 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B3A | 401330 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B40 | 401264 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B46 | 401224 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B4C | 4010CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B52 | 401184 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B58 | 401300 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B5E | 4011D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B64 | 401294 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B6A | 401078 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B70 | 401084 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B76 | 4012A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B7C | 401118 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B82 | 401320 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B88 | 401018 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B8E | 401234 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B94 | 401170 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B9A | 4012B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BA0 | 401180 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BA6 | 401004 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BAC | 401228 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BB2 | 4012E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BB8 | 401220 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BBE | 401244 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BC4 | 4012D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BCA | 4012BC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BD0 | 401198 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BD6 | 401310 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BDC | 401188 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BE2 | 401290 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BE8 | 4010F4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BEE | 401140 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BF4 | 401210 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6BFA | 401100 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C00 | 40115C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C06 | 401338 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C0C | 401060 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C12 | 4012B0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C18 | 401298 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C1E | 401068 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C24 | 4011B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C2A | 401000 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C30 | 401114 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C36 | 4011A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C3C | 401314 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6C42 | 40102C | .text | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 893011 | 48,6652% |
| Null Byte Code | 438184 | 23,8791% |
| NOP Cave Found | 0x9090909090 | Block Count: 748 | Total: 0,1019% |
© 2026 All rights reserved.