PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,08 MBSHA-256 Hash: C992C03211F87067F67427CE2886E3B393F1A68A53D8D6F4736A3B2B9508022D SHA-1 Hash: 3AD1B28314003D704C282A5675F9A707358B44A9 MD5 Hash: 7B123DAC372B55CAA345F9D30DB5970B Imphash: 787F4E82A87AABF641108E9050B6685B MajorOSVersion: 5 MinorOSVersion: 2 CheckSum: 00218246 EntryPoint (rva): 24218 SizeOfHeaders: 400 SizeOfImage: 21D000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: EC600 IAT: BA000 Characteristics: 22 TimeDateStamp: 69FAE76E Date: 06/05/2026 7:02:06 File Type: EXE Number Of Sections: 7 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .fptable, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | B9000 | 1000 | B8F6C |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
B9400 | 35E00 | BA000 | 35CD8 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
EF200 | 5200 | F0000 | 9190 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
F4400 | 7400 | FA000 | 726C |
|
|
| .fptable | 0xC0000040 Initialized Data Readable Writeable |
FB800 | 200 | 102000 | 100 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
FBA00 | 119000 | 103000 | 118EFC |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
214A00 | C00 | 21C000 | AE0 |
|
|
| Description |
| CompanyName: GenP LegalCopyright: GenP 2026 ProductName: GenP FileVersion: 4.0.4 FileDescription: GenP ProductVersion: 4.0.4 Comments: GenP Language: English (United Kingdom) (ID=0x809) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 23618 Code -> 4883EC28E8B30600004883C428E97AFEFFFFCCCC40534883EC20488BD9488BC2488D0D79A809000F57C048890B488D530848 Assembler |SUB RSP, 0X28 |CALL 0X16BC |ADD RSP, 0X28 |JMP 0XE8C |INT3 |INT3 |PUSH RBX |SUB RSP, 0X20 |MOV RBX, RCX |MOV RAX, RDX |LEA RCX, [RIP + 0X9A879] |XORPS XMM0, XMM0 |MOV QWORD PTR [RBX], RCX |LEA RDX, [RBX + 8] |
| Signatures |
| CheckSum Integrity Problem: • Header: 2196038 • Calculated: 2234312 Rich Signature Analyzer: Code -> B4B6068FF0D768DCF0D768DCF0D768DC84566DDD41D768DC84566BDDE6D768DC775E95DCF1D768DC775E6BDDF9D768DC775E6CDDE1D768DC775E6DDDC1D768DC84566CDDDAD768DC84566EDDF1D768DC845669DDD5D768DCF0D769DCC2D568DC7B5E66DDA0D768DC7B5E6BDDF1D768DC7B5E97DCF1D768DCF0D7FFDCF1D768DC7B5E6ADDF1D768DC52696368F0D768DC Footprint md5 Hash -> 59D2467AB48DEEAD1B5CB5ED7073A172 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Autoit 3 - (You can use a decompiler for this...) Detect It Easy (die) • PE+(64): library: AutoIt(3.XX)[-] • PE+(64): compiler: Microsoft Visual C/C++(-)[-] • PE+(64): linker: Microsoft Linker(14.44**)[-] • Entropy: 7.28134 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | CopyFileW | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | WriteProcessMemory | Writes data to an area of memory in a specified process. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| USER32.DLL | GetAsyncKeyState | Retrieves the status of a virtual key asynchronously. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| SHELL32.DLL | ShellExecuteExW | Performs a run operation on a specific file. |
| Windows REG (UNICODE) |
| Software\AutoIt v3\AutoIt SOFTWARE\Classes\ SYSTEM\CurrentControlSet\Control\Nls\Language |
| File Access |
| OLEAUT32.dll ole32.dll SHELL32.dll ADVAPI32.dll COMDLG32.dll GDI32.dll USER32.dll KERNEL32.dll UxTheme.dll USERENV.dll IPHLPAPI.DLL PSAPI.DLL WININET.dll MPR.dll COMCTL32.dll WINMM.dll VERSION.dll WSOCK32.dll .dat @.dat Temp UserProfile |
| File Access (UNICODE) |
| mscoree.dll Temp ProgramFiles AppData UserProfile |
| Interest's Words |
| PADDINGX exec attrib start shutdown systeminfo ping replace |
| Interest's Words (UNICODE) |
| exec attrib start pause comspec shutdown ping expand replace |
| IP Addresses |
| 255.255.255.255 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | Registry (RegDeleteKeyEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CopyFile) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GlobalMemoryStatusEx) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Stealth (ReadProcessMemory) |
| Text | Ascii | Execution (CreateProcessA) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ShellExecute) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (CreateEventW) |
| Text | Unicode | Privileges (SeAssignPrimaryTokenPrivilege) |
| Text | Unicode | Privileges (SeBackupPrivilege) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Privileges (SeIncreaseQuotaPrivilege) |
| Text | Unicode | Privileges (SeRestorePrivilege) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Ascii | Keyboard Key ([F4]) |
| Text | Unicode | Keyboard Key (ALTDOWN) |
| Text | Unicode | Keyboard Key (ALTUP) |
| Text | Unicode | Keyboard Key (SHIFTDOWN) |
| Text | Unicode | Keyboard Key (SHIFTUP) |
| Text | Unicode | Keyboard Key (CTRLDOWN) |
| Text | Unicode | Keyboard Key (CTRLUP) |
| Text | Unicode | Keyboard Key (LWINDOWN) |
| Text | Unicode | Keyboard Key (LWINUP) |
| Text | Unicode | Keyboard Key (RWINDOWN) |
| Text | Unicode | Keyboard Key (RWINUP) |
| Text | Unicode | Keyboard Key (LBUTTON) |
| Text | Unicode | Keyboard Key (MBUTTON) |
| Text | Unicode | Keyboard Key (RBUTTON) |
| Text | Unicode | Keyboard Key (NUMPAD0) |
| Text | Unicode | Keyboard Key (NUMPAD1) |
| Text | Unicode | Keyboard Key (NUMPAD2) |
| Text | Unicode | Keyboard Key (NUMPAD3) |
| Text | Unicode | Keyboard Key (NUMPAD4) |
| Text | Unicode | Keyboard Key (NUMPAD5) |
| Text | Unicode | Keyboard Key (NUMPAD6) |
| Text | Unicode | Keyboard Key (NUMPAD7) |
| Text | Unicode | Keyboard Key (NUMPAD8) |
| Text | Unicode | Keyboard Key (NUMPAD9) |
| Text | Unicode | Keyboard Key (CapsLock) |
| Text | Ascii | Stealer malware focused on obtaining CVV codes to conduct unauthorized transactions (CVV) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\2057 | 1034D0 | 128 | FBED0 | 2800000010000000200000000100040000000000C000000000000000000000000000000000000000000000007A60EB00795F | (....... ...................................z..y_ |
| \ICON\2\2057 | 1035F8 | B2E3 | FBFF8 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000097048597300000EC300000EC301 | .PNG........IHDR.............\r.f....pHYs......... |
| \ICON\3\2057 | 10E8DC | 10828 | 1072DC | 2800000080000000000100000100200000000000000801000000000000000000000000000000000000000000000000000000 | (............. ................................... |
| \ICON\4\2057 | 11F104 | 94A8 | 117B04 | 2800000060000000C00000000100200000000000809400000000000000000000000000000000000000000000000000000000 | (............ ................................... |
| \ICON\5\2057 | 1285AC | 5488 | 120FAC | 2800000048000000900000000100200000000000605400000000000000000000000000000000000000000000000000000000 | (...H......... .....T............................ |
| \ICON\6\2057 | 12DA34 | 4228 | 126434 | 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000 | (...@......... ......B............................ |
| \ICON\7\2057 | 131C5C | 25A8 | 12A65C | 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000 | (...0........ ......%............................ |
| \ICON\8\2057 | 134204 | 10A8 | 12CC04 | 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000 | (... ...@..... ................................... |
| \ICON\9\2057 | 1352AC | 988 | 12DCAC | 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000 | (.......0..... .................................. |
| \ICON\10\2057 | 135C34 | 468 | 12E634 | 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000 | (....... ..... .....@............................. |
| \STRING\7\2057 | 13609C | 594 | 12EA9C | 0000000000000000000009002800500061007500730065006400290020000C004100750074006F0049007400200045007200 | ............(.P.a.u.s.e.d.). ...A.u.t.o.I.t. .E.r. |
| \STRING\8\2057 | 136630 | 68A | 12F030 | 300049006E0063006F007200720065006300740020006E0075006D0062006500720020006F00660020007000610072006100 | 0.I.n.c.o.r.r.e.c.t. .n.u.m.b.e.r. .o.f. .p.a.r.a. |
| \STRING\9\2057 | 136CBC | 490 | 12F6BC | 30004500780070006500630074006500640020006100200022003D00220020006F00700065007200610074006F0072002000 | 0.E.x.p.e.c.t.e.d. .a. .".=.". .o.p.e.r.a.t.o.r. . |
| \STRING\10\2057 | 13714C | 5FC | 12FB4C | 1A0049006E00760061006C00690064002000660069006C0065002000660069006C0074006500720020006700690076006500 | ..I.n.v.a.l.i.d. .f.i.l.e. .f.i.l.t.e.r. .g.i.v.e. |
| \STRING\11\2057 | 137748 | 65C | 130148 | 3E002200530065006C0065006300740022002000730074006100740065006D0065006E00740020006900730020006D006900 | >.".S.e.l.e.c.t.". .s.t.a.t.e.m.e.n.t. .i.s. .m.i. |
| \STRING\12\2057 | 137DA4 | 466 | 1307A4 | 4800430061006E0020007000610073007300200063006F006E007300740061006E0074007300200062007900200072006500 | H.C.a.n. .p.a.s.s. .c.o.n.s.t.a.n.t.s. .b.y. .r.e. |
| \STRING\313\2057 | 13820C | 158 | 130C0C | 00000000000000000000000000000000150055006E00610062006C006500200074006F002000700061007200730065002000 | ..................U.n.a.b.l.e. .t.o. .p.a.r.s.e. . |
| \RCDATA\SCRIPT\0 | 138364 | E3467 | 130D64 | A3484BBE986C4AA9994C530A86D6487D41553321454130364DA8FF7324A73CF67A12F167ACC193E76B43CA52A6AD0000E1BB | .HK..lJ..LS...H}AU3!EA06M..s$.<.z..g....kC.R...... |
| \GROUP_ICON\99\2057 | 21B7CC | 84 | 2141CC | 0000010009000000000001002000E3B20000020080800000010020002808010003006060000001002000A894000004004848 | ............ ............. .(......... .......HH |
| \GROUP_ICON\169\2057 | 21B850 | 14 | 214250 | 0000010001001010100001000400280100000100 | ..............(..... |
| \VERSION\1\2057 | 21B864 | 29C | 214264 | 9C0234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\2057 | 21BB00 | 3FA | 214500 | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122 | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" |
| Intelligent String |
| • kernel32.dll • RUNASWAIT • RUNAS • mscoree.dll • COMSPEC • runas • 0.0.0.0 • .lnk • 255.255.255.255 • .icl • .exe • .dll • .tls • .bss • COMCTL32.dll • KERNEL32.dll • USER32.dll • COMDLG32.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 61C | N/A | .text | CALL QWORD PTR [RIP+0xB9ABE] |
| 6C7 | N/A | .text | CALL QWORD PTR [RIP+0xB9BBB] |
| 973 | N/A | .text | JMP QWORD PTR [RIP+0xB9577] |
| 9CC | N/A | .text | JMP QWORD PTR [RIP+0xB951E] |
| 9D8 | N/A | .text | CALL QWORD PTR [RIP+0xB98FA] |
| A88 | N/A | .text | CALL QWORD PTR [RIP+0xB9462] |
| C55 | N/A | .text | CALL QWORD PTR [RIP+0xB9295] |
| CE5 | N/A | .text | CALL QWORD PTR [RIP+0xB9145] |
| CFA | N/A | .text | CALL QWORD PTR [RIP+0xB8928] |
| D73 | N/A | .text | CALL QWORD PTR [RIP+0xB9177] |
| D9D | N/A | .text | CALL QWORD PTR [RIP+0xB9375] |
| ED0 | N/A | .text | CALL QWORD PTR [RIP+0xB8F5A] |
| F72 | N/A | .text | CALL QWORD PTR [RIP+0xB8EB8] |
| F7D | N/A | .text | CALL QWORD PTR [RIP+0xB86BD] |
| F92 | N/A | .text | CALL QWORD PTR [RIP+0xB8680] |
| F9D | N/A | .text | CALL QWORD PTR [RIP+0xB86B5] |
| FE2 | N/A | .text | CALL QWORD PTR [RIP+0xB9130] |
| 1064 | N/A | .text | CALL QWORD PTR [RIP+0xB905E] |
| 10D5 | N/A | .text | CALL QWORD PTR [RIP+0xB9135] |
| 10FC | N/A | .text | CALL QWORD PTR [RIP+0xB903E] |
| 1117 | N/A | .text | CALL QWORD PTR [RIP+0xB84EB] |
| 1172 | N/A | .text | CALL QWORD PTR [RIP+0xB8F48] |
| 11CD | N/A | .text | CALL QWORD PTR [RIP+0xB8425] |
| 1285 | N/A | .text | CALL QWORD PTR [RIP+0xB8355] |
| 130A | N/A | .text | CALL QWORD PTR [RIP+0xB82D0] |
| 1510 | N/A | .text | CALL QWORD PTR [RIP+0xB808A] |
| 1528 | N/A | .text | CALL QWORD PTR [RIP+0xB816A] |
| 153D | N/A | .text | CALL QWORD PTR [RIP+0xB8145] |
| 1555 | N/A | .text | CALL QWORD PTR [RIP+0xB802D] |
| 157B | N/A | .text | CALL QWORD PTR [RIP+0xB8027] |
| 161E | N/A | .text | CALL QWORD PTR [RIP+0xB7F74] |
| 1631 | N/A | .text | CALL QWORD PTR [RIP+0xB8051] |
| 164A | N/A | .text | CALL QWORD PTR [RIP+0xB7FA8] |
| 166F | N/A | .text | CALL QWORD PTR [RIP+0xB8013] |
| 16D0 | N/A | .text | CALL QWORD PTR [RIP+0xB7F62] |
| 17B1 | N/A | .text | CALL QWORD PTR [RIP+0xB8829] |
| 17D0 | N/A | .text | CALL QWORD PTR [RIP+0xB896A] |
| 17F4 | N/A | .text | CALL QWORD PTR [RIP+0xB884E] |
| 1805 | N/A | .text | CALL QWORD PTR [RIP+0xB883D] |
| 1D7C | N/A | .text | CALL QWORD PTR [RIP+0xB856E] |
| 1D90 | N/A | .text | CALL QWORD PTR [RIP+0xB80FA] |
| 1DBA | N/A | .text | CALL QWORD PTR [RIP+0xB8530] |
| 1DCE | N/A | .text | CALL QWORD PTR [RIP+0xB80BC] |
| 1DEE | N/A | .text | CALL QWORD PTR [RIP+0xB809C] |
| 1E13 | N/A | .text | CALL QWORD PTR [RIP+0xB8217] |
| 1E26 | N/A | .text | CALL QWORD PTR [RIP+0xB83B4] |
| 1E8A | N/A | .text | CALL QWORD PTR [RIP+0xB8420] |
| 1EAA | N/A | .text | CALL QWORD PTR [RIP+0xB7FE8] |
| 1EC5 | N/A | .text | CALL QWORD PTR [RIP+0xB8205] |
| 1EE5 | N/A | .text | CALL QWORD PTR [RIP+0xB776D] |
| 1EF9 | N/A | .text | CALL QWORD PTR [RIP+0xB82F9] |
| 1F2B | N/A | .text | CALL QWORD PTR [RIP+0xB836F] |
| 2026 | N/A | .text | CALL QWORD PTR [RIP+0xB82A4] |
| 2036 | N/A | .text | CALL QWORD PTR [RIP+0xB828C] |
| 204B | N/A | .text | CALL QWORD PTR [RIP+0xB826F] |
| 2064 | N/A | .text | CALL QWORD PTR [RIP+0xB8256] |
| 207D | N/A | .text | CALL QWORD PTR [RIP+0xB823D] |
| 20AC | N/A | .text | CALL QWORD PTR [RIP+0xB7EDE] |
| 2113 | N/A | .text | CALL QWORD PTR [RIP+0xB819F] |
| 21A1 | N/A | .text | CALL QWORD PTR [RIP+0xB8109] |
| 2203 | N/A | .text | CALL QWORD PTR [RIP+0xB80A7] |
| 2219 | N/A | .text | CALL QWORD PTR [RIP+0xB8089] |
| 222D | N/A | .text | JMP QWORD PTR [RIP+0xB8075] |
| 2408 | N/A | .text | CALL QWORD PTR [RIP+0xB73FA] |
| 24BE | N/A | .text | CALL QWORD PTR [RIP+0xB7DA4] |
| 24F9 | N/A | .text | CALL QWORD PTR [RIP+0xB7D89] |
| 2528 | N/A | .text | CALL QWORD PTR [RIP+0xB7D72] |
| 2535 | N/A | .text | CALL QWORD PTR [RIP+0xB7D5D] |
| 254B | N/A | .text | CALL QWORD PTR [RIP+0xB7D3F] |
| 255C | N/A | .text | CALL QWORD PTR [RIP+0xB7D1E] |
| 25BF | N/A | .text | CALL QWORD PTR [RIP+0xB7D0B] |
| 25F3 | N/A | .text | CALL QWORD PTR [RIP+0xB7CBF] |
| 2607 | N/A | .text | CALL QWORD PTR [RIP+0xB7C8B] |
| 2625 | N/A | .text | CALL QWORD PTR [RIP+0xB6F2D] |
| 2640 | N/A | .text | CALL QWORD PTR [RIP+0xB6F1A] |
| 2659 | N/A | .text | CALL QWORD PTR [RIP+0xB7C61] |
| 266C | N/A | .text | CALL QWORD PTR [RIP+0xB6E9E] |
| 279A | N/A | .text | CALL QWORD PTR [RIP+0xB6DE8] |
| 281C | N/A | .text | CALL QWORD PTR [RIP+0xB78BE] |
| 28F6 | N/A | .text | CALL QWORD PTR [RIP+0xB74E4] |
| 2A8F | N/A | .text | CALL QWORD PTR [RIP+0xB6CAB] |
| 2AEF | N/A | .text | CALL QWORD PTR [RIP+0xB6D53] |
| 2EAD | N/A | .text | CALL QWORD PTR [RIP+0xB686D] |
| 2F1F | N/A | .text | CALL QWORD PTR [RIP+0xB67FB] |
| 2F49 | N/A | .text | CALL QWORD PTR [RIP+0xB6981] |
| 3145 | N/A | .text | CALL QWORD PTR [RIP+0xB73CD] |
| 3166 | N/A | .text | CALL QWORD PTR [RIP+0xB676C] |
| 3257 | N/A | .text | CALL QWORD PTR [RIP+0xB64CB] |
| 326F | N/A | .text | CALL QWORD PTR [RIP+0xB64BB] |
| 329F | N/A | .text | CALL QWORD PTR [RIP+0xB6483] |
| 32B7 | N/A | .text | CALL QWORD PTR [RIP+0xB6473] |
| 3319 | N/A | .text | CALL QWORD PTR [RIP+0xB6401] |
| 3545 | N/A | .text | CALL QWORD PTR [RIP+0xB6EA5] |
| 3645 | N/A | .text | CALL QWORD PTR [RIP+0xB6EDD] |
| 37C9 | N/A | .text | CALL QWORD PTR [RIP+0xB67A1] |
| 38A6 | N/A | .text | CALL QWORD PTR [RIP+0xB6194] |
| 38BB | N/A | .text | CALL QWORD PTR [RIP+0xB6177] |
| 3941 | N/A | .text | CALL QWORD PTR [RIP+0xB5F01] |
| 39D8 | N/A | .text | CALL QWORD PTR [RIP+0xB6052] |
| 3A60 | N/A | .text | CALL QWORD PTR [RIP+0xB5DE2] |
| CD968-CD975 | N/A | .rdata | Potential obfuscated jump sequence detected, count: 7 |
| CD9F2-CDA21 | N/A | .rdata | Potential obfuscated jump sequence detected, count: 24 |
| D2A70-D2B87 | N/A | .rdata | Potential obfuscated jump sequence detected, count: 140 |
| D2BC4-D2BEF | N/A | .rdata | Potential obfuscated jump sequence detected, count: 22 |
| F4400 | 1000 | .pdata | ExceptionHook | Pointer to 1000 - 0x400 .text + UnwindInfo: .rdata |
| F440C | 102C | .pdata | ExceptionHook | Pointer to 102C - 0x42C .text + UnwindInfo: .rdata |
| F4418 | 1048 | .pdata | ExceptionHook | Pointer to 1048 - 0x448 .text + UnwindInfo: .rdata |
| F4424 | 1064 | .pdata | ExceptionHook | Pointer to 1064 - 0x464 .text + UnwindInfo: .rdata |
| F4430 | 1080 | .pdata | ExceptionHook | Pointer to 1080 - 0x480 .text + UnwindInfo: .rdata |
| F443C | 10B0 | .pdata | ExceptionHook | Pointer to 10B0 - 0x4B0 .text + UnwindInfo: .rdata |
| F4448 | 10CC | .pdata | ExceptionHook | Pointer to 10CC - 0x4CC .text + UnwindInfo: .rdata |
| F4454 | 10E8 | .pdata | ExceptionHook | Pointer to 10E8 - 0x4E8 .text + UnwindInfo: .rdata |
| F4460 | 1104 | .pdata | ExceptionHook | Pointer to 1104 - 0x504 .text + UnwindInfo: .rdata |
| F446C | 1120 | .pdata | ExceptionHook | Pointer to 1120 - 0x520 .text + UnwindInfo: .rdata |
| F4478 | 1140 | .pdata | ExceptionHook | Pointer to 1140 - 0x540 .text + UnwindInfo: .rdata |
| F4484 | 1320 | .pdata | ExceptionHook | Pointer to 1320 - 0x720 .text + UnwindInfo: .rdata |
| F4490 | 1360 | .pdata | ExceptionHook | Pointer to 1360 - 0x760 .text + UnwindInfo: .rdata |
| F449C | 139C | .pdata | ExceptionHook | Pointer to 139C - 0x79C .text + UnwindInfo: .rdata |
| F44A8 | 1410 | .pdata | ExceptionHook | Pointer to 1410 - 0x810 .text + UnwindInfo: .rdata |
| F44B4 | 14F8 | .pdata | ExceptionHook | Pointer to 14F8 - 0x8F8 .text + UnwindInfo: .rdata |
| F44C0 | 157C | .pdata | ExceptionHook | Pointer to 157C - 0x97C .text + UnwindInfo: .rdata |
| F44CC | 15D4 | .pdata | ExceptionHook | Pointer to 15D4 - 0x9D4 .text + UnwindInfo: .rdata |
| F44D8 | 161C | .pdata | ExceptionHook | Pointer to 161C - 0xA1C .text + UnwindInfo: .rdata |
| F44E4 | 16A4 | .pdata | ExceptionHook | Pointer to 16A4 - 0xAA4 .text + UnwindInfo: .rdata |
| F44F0 | 16C0 | .pdata | ExceptionHook | Pointer to 16C0 - 0xAC0 .text + UnwindInfo: .rdata |
| F44FC | 1980 | .pdata | ExceptionHook | Pointer to 1980 - 0xD80 .text + UnwindInfo: .rdata |
| F4508 | 19DC | .pdata | ExceptionHook | Pointer to 19DC - 0xDDC .text + UnwindInfo: .rdata |
| F4514 | 1A8C | .pdata | ExceptionHook | Pointer to 1A8C - 0xE8C .text + UnwindInfo: .rdata |
| F4520 | 1BCC | .pdata | ExceptionHook | Pointer to 1BCC - 0xFCC .text + UnwindInfo: .rdata |
| F452C | 1C1C | .pdata | ExceptionHook | Pointer to 1C1C - 0x101C .text + UnwindInfo: .rdata |
| F4538 | 1D94 | .pdata | ExceptionHook | Pointer to 1D94 - 0x1194 .text + UnwindInfo: .rdata |
| F4544 | 1F18 | .pdata | ExceptionHook | Pointer to 1F18 - 0x1318 .text + UnwindInfo: .rdata |
| F4550 | 20F4 | .pdata | ExceptionHook | Pointer to 20F4 - 0x14F4 .text + UnwindInfo: .rdata |
| F455C | 2184 | .pdata | ExceptionHook | Pointer to 2184 - 0x1584 .text + UnwindInfo: .rdata |
| F4568 | 2290 | .pdata | ExceptionHook | Pointer to 2290 - 0x1690 .text + UnwindInfo: .rdata |
| F4574 | 2344 | .pdata | ExceptionHook | Pointer to 2344 - 0x1744 .text + UnwindInfo: .rdata |
| F4580 | 2388 | .pdata | ExceptionHook | Pointer to 2388 - 0x1788 .text + UnwindInfo: .rdata |
| F458C | 2474 | .pdata | ExceptionHook | Pointer to 2474 - 0x1874 .text + UnwindInfo: .rdata |
| F4598 | 24B0 | .pdata | ExceptionHook | Pointer to 24B0 - 0x18B0 .text + UnwindInfo: .rdata |
| F45A4 | 2558 | .pdata | ExceptionHook | Pointer to 2558 - 0x1958 .text + UnwindInfo: .rdata |
| F45B0 | 25A0 | .pdata | ExceptionHook | Pointer to 25A0 - 0x19A0 .text + UnwindInfo: .rdata |
| F45BC | 2724 | .pdata | ExceptionHook | Pointer to 2724 - 0x1B24 .text + UnwindInfo: .rdata |
| F45C8 | 2880 | .pdata | ExceptionHook | Pointer to 2880 - 0x1C80 .text + UnwindInfo: .rdata |
| F45D4 | 2B90 | .pdata | ExceptionHook | Pointer to 2B90 - 0x1F90 .text + UnwindInfo: .rdata |
| F45E0 | 2BC0 | .pdata | ExceptionHook | Pointer to 2BC0 - 0x1FC0 .text + UnwindInfo: .rdata |
| F45EC | 2BF0 | .pdata | ExceptionHook | Pointer to 2BF0 - 0x1FF0 .text + UnwindInfo: .rdata |
| F45F8 | 2C0C | .pdata | ExceptionHook | Pointer to 2C0C - 0x200C .text + UnwindInfo: .rdata |
| F4604 | 2D48 | .pdata | ExceptionHook | Pointer to 2D48 - 0x2148 .text + UnwindInfo: .rdata |
| F4610 | 2E34 | .pdata | ExceptionHook | Pointer to 2E34 - 0x2234 .text + UnwindInfo: .rdata |
| F461C | 2ED8 | .pdata | ExceptionHook | Pointer to 2ED8 - 0x22D8 .text + UnwindInfo: .rdata |
| F4628 | 2F70 | .pdata | ExceptionHook | Pointer to 2F70 - 0x2370 .text + UnwindInfo: .rdata |
| F4634 | 2FE4 | .pdata | ExceptionHook | Pointer to 2FE4 - 0x23E4 .text + UnwindInfo: .rdata |
| F4640 | 303C | .pdata | ExceptionHook | Pointer to 303C - 0x243C .text + UnwindInfo: .rdata |
| F464C | 3164 | .pdata | ExceptionHook | Pointer to 3164 - 0x2564 .text + UnwindInfo: .rdata |
| F4658 | 3294 | .pdata | ExceptionHook | Pointer to 3294 - 0x2694 .text + UnwindInfo: .rdata |
| F4664 | 3310 | .pdata | ExceptionHook | Pointer to 3310 - 0x2710 .text + UnwindInfo: .rdata |
| F4670 | 332C | .pdata | ExceptionHook | Pointer to 332C - 0x272C .text + UnwindInfo: .rdata |
| F467C | 3354 | .pdata | ExceptionHook | Pointer to 3354 - 0x2754 .text + UnwindInfo: .rdata |
| F4688 | 3440 | .pdata | ExceptionHook | Pointer to 3440 - 0x2840 .text + UnwindInfo: .rdata |
| F4694 | 346C | .pdata | ExceptionHook | Pointer to 346C - 0x286C .text + UnwindInfo: .rdata |
| F46A0 | 3498 | .pdata | ExceptionHook | Pointer to 3498 - 0x2898 .text + UnwindInfo: .rdata |
| F46AC | 3500 | .pdata | ExceptionHook | Pointer to 3500 - 0x2900 .text + UnwindInfo: .rdata |
| F46B8 | 356C | .pdata | ExceptionHook | Pointer to 356C - 0x296C .text + UnwindInfo: .rdata |
| F46C4 | 35D0 | .pdata | ExceptionHook | Pointer to 35D0 - 0x29D0 .text + UnwindInfo: .rdata |
| F46D0 | 3600 | .pdata | ExceptionHook | Pointer to 3600 - 0x2A00 .text + UnwindInfo: .rdata |
| F46DC | 3670 | .pdata | ExceptionHook | Pointer to 3670 - 0x2A70 .text + UnwindInfo: .rdata |
| F46E8 | 36C4 | .pdata | ExceptionHook | Pointer to 36C4 - 0x2AC4 .text + UnwindInfo: .rdata |
| F46F4 | 3790 | .pdata | ExceptionHook | Pointer to 3790 - 0x2B90 .text + UnwindInfo: .rdata |
| F4700 | 37F0 | .pdata | ExceptionHook | Pointer to 37F0 - 0x2BF0 .text + UnwindInfo: .rdata |
| F470C | 380C | .pdata | ExceptionHook | Pointer to 380C - 0x2C0C .text + UnwindInfo: .rdata |
| F4718 | 3840 | .pdata | ExceptionHook | Pointer to 3840 - 0x2C40 .text + UnwindInfo: .rdata |
| F4724 | 3894 | .pdata | ExceptionHook | Pointer to 3894 - 0x2C94 .text + UnwindInfo: .rdata |
| F4730 | 38C0 | .pdata | ExceptionHook | Pointer to 38C0 - 0x2CC0 .text + UnwindInfo: .rdata |
| F473C | 391C | .pdata | ExceptionHook | Pointer to 391C - 0x2D1C .text + UnwindInfo: .rdata |
| F4748 | 3938 | .pdata | ExceptionHook | Pointer to 3938 - 0x2D38 .text + UnwindInfo: .rdata |
| F4754 | 3964 | .pdata | ExceptionHook | Pointer to 3964 - 0x2D64 .text + UnwindInfo: .rdata |
| F4760 | 3990 | .pdata | ExceptionHook | Pointer to 3990 - 0x2D90 .text + UnwindInfo: .rdata |
| F476C | 3A5C | .pdata | ExceptionHook | Pointer to 3A5C - 0x2E5C .text + UnwindInfo: .rdata |
| F4778 | 3ABC | .pdata | ExceptionHook | Pointer to 3ABC - 0x2EBC .text + UnwindInfo: .rdata |
| F4784 | 3B90 | .pdata | ExceptionHook | Pointer to 3B90 - 0x2F90 .text + UnwindInfo: .rdata |
| F4790 | 3B9E | .pdata | ExceptionHook | Pointer to 3B9E - 0x2F9E .text + UnwindInfo: .rdata |
| F479C | 3D14 | .pdata | ExceptionHook | Pointer to 3D14 - 0x3114 .text + UnwindInfo: .rdata |
| F47A8 | 3D32 | .pdata | ExceptionHook | Pointer to 3D32 - 0x3132 .text + UnwindInfo: .rdata |
| F47B4 | 3DE0 | .pdata | ExceptionHook | Pointer to 3DE0 - 0x31E0 .text + UnwindInfo: .rdata |
| F47C0 | 3E18 | .pdata | ExceptionHook | Pointer to 3E18 - 0x3218 .text + UnwindInfo: .rdata |
| F47CC | 3E40 | .pdata | ExceptionHook | Pointer to 3E40 - 0x3240 .text + UnwindInfo: .rdata |
| F47D8 | 3E88 | .pdata | ExceptionHook | Pointer to 3E88 - 0x3288 .text + UnwindInfo: .rdata |
| F47E4 | 3ED0 | .pdata | ExceptionHook | Pointer to 3ED0 - 0x32D0 .text + UnwindInfo: .rdata |
| F47F0 | 3F2C | .pdata | ExceptionHook | Pointer to 3F2C - 0x332C .text + UnwindInfo: .rdata |
| F47FC | 3F7C | .pdata | ExceptionHook | Pointer to 3F7C - 0x337C .text + UnwindInfo: .rdata |
| F4808 | 3FE8 | .pdata | ExceptionHook | Pointer to 3FE8 - 0x33E8 .text + UnwindInfo: .rdata |
| F4814 | 4034 | .pdata | ExceptionHook | Pointer to 4034 - 0x3434 .text + UnwindInfo: .rdata |
| F4820 | 4070 | .pdata | ExceptionHook | Pointer to 4070 - 0x3470 .text + UnwindInfo: .rdata |
| F482C | 40D0 | .pdata | ExceptionHook | Pointer to 40D0 - 0x34D0 .text + UnwindInfo: .rdata |
| F4838 | 4410 | .pdata | ExceptionHook | Pointer to 4410 - 0x3810 .text + UnwindInfo: .rdata |
| F4844 | 442C | .pdata | ExceptionHook | Pointer to 442C - 0x382C .text + UnwindInfo: .rdata |
| F4850 | 4448 | .pdata | ExceptionHook | Pointer to 4448 - 0x3848 .text + UnwindInfo: .rdata |
| F485C | 4464 | .pdata | ExceptionHook | Pointer to 4464 - 0x3864 .text + UnwindInfo: .rdata |
| F4868 | 45F8 | .pdata | ExceptionHook | Pointer to 45F8 - 0x39F8 .text + UnwindInfo: .rdata |
| F4874 | 46D8 | .pdata | ExceptionHook | Pointer to 46D8 - 0x3AD8 .text + UnwindInfo: .rdata |
| F4880 | 4768 | .pdata | ExceptionHook | Pointer to 4768 - 0x3B68 .text + UnwindInfo: .rdata |
| F488C | 47CC | .pdata | ExceptionHook | Pointer to 47CC - 0x3BCC .text + UnwindInfo: .rdata |
| F4898 | 480C | .pdata | ExceptionHook | Pointer to 480C - 0x3C0C .text + UnwindInfo: .rdata |
| F48A4 | 49F4 | .pdata | ExceptionHook | Pointer to 49F4 - 0x3DF4 .text + UnwindInfo: .rdata |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1308959 | 59,9147% |
| Null Byte Code | 282138 | 12,9142% |
© 2026 All rights reserved.