PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 2,17 MB SHA-256 Hash: 24BB00C15D9C125410330B8D5FBFD8AC5FB117B2A7C1FB832A6E1C056624E1D6 SHA-1 Hash: 29BB44A6DBCA85135A17CBD17C53D7CCAA819915 MD5 Hash: 7F76E159C1E3A21C34BB0C97C8FB9B12 Imphash: 91B2DEACD206EF373BAA926022D03AE2 MajorOSVersion: 6 MinorOSVersion: 1 CheckSum: 002387B5 EntryPoint (rva): 1C14D0 SizeOfHeaders: 400 SizeOfImage: 230000 ImageBase: 10000000 Architecture: x86 ExportTable: 202670 ImportTable: 20CCD7 IAT: 20D274 Characteristics: 2122 TimeDateStamp: 6373AC37 Date: 15/11/2022 15:11:51 File Type: DLL Number Of Sections: 6 ASLR: Enabled Section Names: .text, .rdata, .data, .00cfg, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | 1C1A00 | 1000 | 1C1801 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
1C1E00 | 4B800 | 1C3000 | 4B764 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
20D600 | 3000 | 20F000 | 5520 |
|
|
| .00cfg | 0x40000040 Initialized Data Readable |
210600 | 200 | 215000 | 4 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
210800 | 400 | 216000 | 380 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
210C00 | 18800 | 217000 | 186E0 |
|
|
| Description |
| OriginalFilename: nss3.dll CompanyName: Mozilla Foundation LegalCopyright: License: MPL 2 LegalTrademarks: Mozilla ProductName: Thunderbird FileVersion: 102.5.0 ProductVersion: 102.5.0 Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 1C08D0 Code -> 558BEC837D0C017505E823050000FF7510FF750CFF7508E8D2FEFFFF83C40C5DC20C00A1C04421105333DB43563BC3746085 EP changed to another address -> (Address Of EntryPoint > Base Of Data) Assembler |PUSH EBP |MOV EBP, ESP |CMP DWORD PTR [EBP + 0XC], 1 |JNE 0X101C14DE |CALL 0X101C1A01 |PUSH DWORD PTR [EBP + 0X10] |PUSH DWORD PTR [EBP + 0XC] |PUSH DWORD PTR [EBP + 8] |CALL 0X101C13BE |ADD ESP, 0XC |POP EBP |RET 0XC |MOV EAX, DWORD PTR [0X102144C0] |PUSH EBX |XOR EBX, EBX |INC EBX |PUSH ESI |CMP EAX, EBX |JE 0X101C1561 |
| Signatures |
| CheckSum Integrity Problem: • Header: 2328501 • Calculated: 2279503 Certificate - Digital Signature: • The file is signed but has been modified |
| Packer/Compiler |
| Detect It Easy (die) • PE: linker: Microsoft Linker(14.0)[-] • PE: Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 6.75588 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | CreateMutexW | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ReleaseSemaphore | Releases ownership of a semaphore. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | UnmapViewOfFile | Unmaps a mapped file view. |
| KERNEL32.DLL | MapViewOfFile | Maps a file into memory. |
| KERNEL32.DLL | CreateFileMappingA | Creates a file mapping object. |
| KERNEL32.DLL | CreateFileMappingW | Creates a file mapping object. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessA | Creates and starts a new process. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | CreateSemaphoreA | Creates or opens a semaphore object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| File Access |
| api-ms-win-crt-convert-l1-1-0.dll api-ms-win-crt-string-l1-1-0.dll api-ms-win-crt-multibyte-l1-1-0.dll api-ms-win-crt-time-l1-1-0.dll api-ms-win-crt-math-l1-1-0.dll api-ms-win-crt-filesystem-l1-1-0.dll api-ms-win-crt-environment-l1-1-0.dll api-ms-win-crt-stdio-l1-1-0.dll api-ms-win-crt-runtime-l1-1-0.dll api-ms-win-crt-utility-l1-1-0.dll VCRUNTIME140.dll KERNEL32.dll WSOCK32.dll ADVAPI32.dll mozglue.dll nss3.dll WINMM.dll ws2_32.dll softokn3.dll wship6.dll @.dat pkcs11.txt Temp |
| File Access (UNICODE) |
| nss3.dll ReleaseSRWLockExclusiveAcquireSRWLockExclusiveKERNEL32.DLL kernel32.dll |
| SQL Queries |
| SELECT * FROM %Q.%Q SELECT 1 FROM %Q.%q_segments WHERE blockid=? AND block IS NULL SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level = ? ORDER BY idx ASC SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level BETWEEN ? AND ?ORDER BY level DESC, idx ASC SELECT level, idx, end_block FROM %Q.%q_segdir WHERE level BETWEEN ? AND ? ORDER BY level DESC, idx ASC SELECT idx FROM %Q.%q_segdir WHERE level=? ORDER BY 1 ASC SELECT size FROM %Q.%q_docsize WHERE docid=? SELECT value FROM %Q.%q_stat WHERE id=? SELECT max(level) FROM %Q.%q_segdir WHERE level BETWEEN ? AND ? SELECT idx, start_block, leaves_end_block, end_block, root FROM %Q.%q_segdir WHERE level = ? AND idx = ? SELECT count(*) FROM %Q.%q_segdir WHERE level = ? SELECT tbl,idx,stat FROM %Q.sqlite_stat1 SELECT level, count(*) AS cnt FROM %Q.%q_segdirGROUP BY level HAVING cnt>=? ORDER BY (level %% 1024) ASC, 2 DESC LIMIT 1 SELECT (SELECT max(idx) FROM %Q.%q_segdir WHERE level = ?) + 1 SELECT sql FROM "%w".sqlite_schema WHERE type=tableAND name<>sqlite_sequence AND coalesce(rootpage,1)>0 SELECT NOT EXISTS(SELECT docid FROM %Q.%q_content WHERE rowid!=?) SELECT coalesce((SELECT max(blockid) FROM %Q.%q_segments) + 1, 1) SELECT * FROM (SELECT sqlite_schema AS name,1 AS rootpage,table AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0) SELECT 2 * total(1 + leaves_end_block - start_block)FROM (SELECT * FROM %Q.%q_segdir WHERE level = ? ORDER BY idx ASC LIMIT ? ) SELECT sql FROM "%w".sqlite_schema WHERE type=index SELECT ? UNION SELECT level / (1024 * ?) FROM %Q.%q_segdir SELECT max( level %% 1024 ) FROM %Q.%q_segdir SELECT CASE WHEN quick_check GLOB CHECK* THEN raise(ABORT,CHECK constraint failed) ELSE raise(ABORT,NOT NULL constraint failed) END FROM pragma_quick_check(%Q,%Q) WHERE quick_check GLOB CHECK* OR quick_check GLOB NULL* SELECT raise(ABORT,%Q) FROM "%w"."%w" SELECT 1 FROM "%w".sqlite_master WHERE name NOT LIKE sqliteX_%% ESCAPE X AND sql NOT LIKE create virtual%% AND sqlite_rename_test(%Q, sql, type, name, %d, %Q, %d)=NULL SELECT 1 FROM temp.sqlite_master WHERE name NOT LIKE sqliteX_%% ESCAPE X AND sql NOT LIKE create virtual%% AND sqlite_rename_test(%Q, sql, type, name, 1, %Q, %d)=NULL INSERT INTO %Q.sqlite_master VALUES(index,%Q,%Q,%d,%Q); INSERT INTO vacuum_db.||quote(name)|| SELECT*FROM"%w".||quote(name)FROM vacuum_db.sqlite_schema WHERE type=tableAND coalesce(rootpage,1)>0 INSERT INTO %Q.%q_content VALUES(%s) INSERT INTO vacuum_db.sqlite_schema SELECT*FROM "%w".sqlite_schema WHERE type IN(view,trigger) OR(type=tableAND rootpage=0) INSERT INTO %Q.sqlite_master VALUES(trigger,%Q,%Q,0,CREATE TRIGGER %q) INSERT into generated column "%s" CREATE TABLE x( name TEXT, path TEXT, pagenoINTEGER, pagetypeTEXT, ncell INTEGER, payload INTEGER, unusedINTEGER, mx_payload INTEGER, pgoffsetINTEGER, pgsizeINTEGER, schemaTEXT HIDDEN, aggregate BOOLEAN HIDDEN) CREATE TABLE %Q.%q_segments(blockid INTEGER PRIMARY KEY, block BLOB); CREATE TABLE %Q.%q_docsize(docid INTEGER PRIMARY KEY, size BLOB); CREATE TABLE IF NOT EXISTS %Q.%q_stat(id INTEGER PRIMARY KEY, value BLOB); CREATE TABLE %Q.%q_segdir(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx)); CREATE TABLE x(type text,name text,tbl_name text,rootpage int,sql text) CREATE TABLE %Q.%s(%s) CREATE TABLE %Q.%q_content(%s) CREATE TABLE %Q.sqlite_sequence(name,seq) CREATE TABLE x(input, token, start, end, position) CREATE TABLE x(key,value,type,atom,id,parent,fullkey,path,json HIDDEN,root HIDDEN) CREATE TABLE x(term, col, documents, occurrences, languageid HIDDEN) CREATE TABLE x(%s %Q HIDDEN, docid HIDDEN, %Q HIDDEN) CREATE TABLE DROP TABLE to delete table %s DROP TABLE IF EXISTS %Q.%q_segments;DROP TABLE IF EXISTS %Q.%q_segdir;DROP TABLE IF EXISTS %Q.%q_docsize;DROP TABLE IF EXISTS %Q.%q_stat;%s DROP TABLE IF EXISTS %Q.%q_content; DELETE FROM %Q.%s WHERE %s=%Q DELETE FROM %Q.sqlite_sequence WHERE name=%Q DELETE FROM %Q.%q_segdir WHERE level BETWEEN ? AND ? DELETE FROM %Q.%q_segments WHERE blockid BETWEEN ? AND ? DELETE FROM %Q.%q_segdir WHERE level = ? AND idx = ? DELETE FROM %Q.%q_segdir WHERE level = ? DELETE FROM %Q.%q_content WHERE rowid = ? DELETE FROM %Q.%q_docsize WHERE docid = ? DELETE FROM %Q.sqlite_master WHERE name=%Q AND type=index DELETE FROM %Q.%q_content DELETE FROM %Q.%q_stat DELETE FROM %Q.%q_segments DELETE FROM %Q.%q_segdir DELETE FROM %Q.sqlite_master WHERE name=%Q AND type=trigger DELETE FROM %Q.sqlite_master WHERE tbl_name=%Q and type!=trigger DELETE FROM %Q.%q_docsize |
| Interest's Words |
| Encrypt Decrypt Encryption PassWord exec createobject attrib start cipher shutdown systeminfo ping expand replace |
| URLs |
| http://ocsp.digicert.com http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl http://crl3.digicert.com/sha2-assured-cs-g1.crl http://crl4.digicert.com/sha2-assured-cs-g1.crl http://www.digicert.com/CPS0 http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt http://cacerts.digicert.com/DigiCertTrustedRootG4.crt http://crl3.digicert.com/DigiCertTrustedRootG4.crl http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt https://www.digicert.com/CPS0 https://mozilla.org0/ |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Encryption (Base64Decode) |
| Text | Ascii | Encryption (Base64Encode) |
| Text | Ascii | Information used to authenticate a user’s identity (Credential) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \VERSION\1\1033 | 216060 | 31C | 210860 | 1C0334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000500 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • kernel32.dll • jsignal_policy.map • nss3.dll • H0F08 • https://www.digicert.com/CPS0 • :060U00Uq]dL.g?O0U0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0U |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 45A | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 4A3 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CF | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 4EF | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 559 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 592 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 5E3 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 6BC | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D4 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 8DB | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 911 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 932 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 95C | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 97D | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| B1C | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| B81 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| F31 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| F4A | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| F93 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 107C | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 10A4 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 10BD | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 112F | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1151 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 11BE | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 11F3 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1217 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1872 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1884 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 18A3 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 18BF | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 18F1 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 191E | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 194B | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1964 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 19D2 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 19FE | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A17 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1A91 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1ABD | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1AD6 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B50 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B7C | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B95 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C0F | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C2A | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C8B | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CA6 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CD5 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1CFA | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D41 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1D5A | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1DDC | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E31 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1E4A | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1EAC | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F9D | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FB3 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FCF | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1FEF | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2043 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 20E1 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 20FD | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2121 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2165 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 217D | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 21D7 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 225A | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 227A | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 228C | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 22CC | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 232C | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2369 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2393 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 241B | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 242D | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2489 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 24B4 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 24D0 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2508 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2520 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2572 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 25E5 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 25F7 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2616 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2632 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2648 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 26C6 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 26DA | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2723 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2735 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2754 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 279A | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 280D | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 282C | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 286C | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 2887 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 28BE | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 28D2 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 28F0 | 10215000 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C659A-1C65B1 | N/A | .rdata | Potential obfuscated jump sequence detected, count: 12 |
| 1C1C01-1C1DFF | N/A | .text | Unusual BP Cave, count: 511 |
| 229400 | N/A | *Overlay* | A0290000000202003082298F06092A864886F70D | . |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1460402 | 64,1436% |
| Null Byte Code | 266727 | 11,7152% |
© 2026 All rights reserved.