PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 5,38 MB SHA-256 Hash: AD93A9DE8040013D0F5B21703388D5DE55FB45BA90AA17122BD23BA17E751BB8 SHA-1 Hash: F1364D1820046478310EEDA63BBB80586BC51B42 MD5 Hash: 8C485C454690F4827E9C62C28687FA18 Imphash: 9771EE6344923FA220489AB01239BDFD MajorOSVersion: 5 MinorOSVersion: 1 CheckSum: 005654A2 EntryPoint (rva): 14AD SizeOfHeaders: 400 SizeOfImage: 54F000 ImageBase: 400000 Architecture: x86 ImportTable: 129C4 IAT: D000 Characteristics: 102 TimeDateStamp: 6377E6AC Date: 18/11/2022 20:10:20 File Type: EXE Number Of Sections: 5 ASLR: Enabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker UAC Execution Level Manifest: requireAdministrator |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | B200 | 1000 | B1AF |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
B600 | 6200 | D000 | 6078 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
11800 | 800 | 14000 | 11E4 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
12000 | 537600 | 16000 | 537474 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
549600 | 1000 | 54E000 | EA8 |
|
|
| Description |
| OriginalFilename: ScreenConnect.Core.dll CompanyName: ScreenConnect Software ProductName: ScreenConnect FileVersion: 25.2.4.9229 ProductVersion: 25.2.4.9229 Comments: DLL support by Alessandro Iacopetti & Gilles Vollant |
| Binder/Joiner/Crypter |
| 14 Executable files found Dropper code detected (EOF) - 75,66 KB |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 8AD Code -> E8C5030000E97AFEFFFF558BEC6A00FF1540D04000FF7508FF153CD0400068090400C0FF1544D0400050FF1548D040005DC3 Assembler |CALL 0X401877 |JMP 0X401331 |PUSH EBP |MOV EBP, ESP |PUSH 0 |CALL DWORD PTR [0X40D040] |PUSH DWORD PTR [EBP + 8] |CALL DWORD PTR [0X40D03C] |PUSH 0XC0000409 |CALL DWORD PTR [0X40D044] |PUSH EAX |CALL DWORD PTR [0X40D048] |POP EBP |RET |
| Signatures |
| CheckSum Integrity Problem: • Header: 5657762 • Calculated: 5700702 Rich Signature Analyzer: Code -> 015F0EE5453E60B6453E60B6453E60B6F1A291B64F3E60B6F1A293B63F3E60B6F1A292B65D3E60B6C54565B7603E60B6C54564B7543E60B6C54563B7513E60B64C46F3B6413E60B65B6CF3B6463E60B6453E61B6253E60B6CB4569B7443E60B6CB459FB6443E60B6CB4562B7443E60B652696368453E60B6 Footprint md5 Hash -> 849DE2AC7EE0A5EA3656A6553164563A • The Rich header apparently has not been modified |
| Packer/Compiler |
| Compiler: Microsoft Visual .NET - (You can use a decompiler for this...) • AnyCPU: False Compiler: Microsoft Visual Studio Compiler: Microsoft Visual C ++ Detect It Easy (die) • PE: compiler: EP:Microsoft Visual C/C++(2017 v.15.5-6)[EXE32] • PE: compiler: Microsoft Visual C/C++(-)[-] • PE: linker: Microsoft Linker(14.33**)[-] • PE: Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 7.4314 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileW | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GlobalMemoryStatusEx | Retrieves memory usage information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| KERNEL32.DLL | OpenProcess | Opens an existing process. |
| ADVAPI32.DLL | OpenSCManagerW | Opens the Service Control Manager. |
| ADVAPI32.DLL | RegCreateKeyExW | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| ADVAPI32.DLL | RegSetValueExW | Writes data to a registry value. |
| SHELL32.DLL | ShellExecuteW | Performs a run operation on a specific file. |
| Windows REG |
| Software\Microsoft\NET Framework Setup\NDP\v2.0.50727InstallSOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client[SERVICE_NAME]restartnoneRemote Control"[SERVICE_CLIENT_LAUNCH_PARAMETERS]"{0C94448B-0C9E-4112-AC7D-B00E6BA76D82}0.0.0.0125.0.0.0OLD_PRODUCT_1{1F85D7FE-5576-41EE-9480-E3F7F9C31B8B}OLD_PRODUCT_2OLD_PRODUCT_3NEW_VERSION SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Client[SERVICE_NAME]restartnoneRemote Control"[SERVICE_CLIENT_LAUNCH_PARAMETERS]"{0C94448B-0C9E-4112-AC7D-B00E6BA76D82}0.0.0.0125.0.0.0OLD_PRODUCT_1{1F85D7FE-5576-41EE-9480-E3F7F9C31B8B}OLD_PRODUCT_2OLD_PRODUCT_3NEW_VERSION |
| Windows REG (UNICODE) |
| SOFTWARE\Microsoft\Cryptography SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Software\Policies\Microsoft\Windows\Installer SYSTEM\CurrentControlSet\Services\ |
| File Access |
| DotNetResolver.exe INSTALLLOCATION]ScreenConnect.WindowsClient.exe INSTALLLOCATION]ScreenConnect.WindowsFileManager.exeLaunchApplicationScreenConnect.WindowsClient.exe INSTALLLOCATION]ScreenConnect.WindowsFileManager.exe INSTALLLOCATION]ScreenConnect.WindowsBackstageShell.exe ScreenConnect.WindowsFileManager.exe ScreenConnect.WindowsClient.exe ScreenConnect.WindowsBackstageShell.exe ScreenConnect.ClientInstallerRunner.exe mscoree.dll ScreenConnect.WindowsCredentialProvider.dll ScreenConnect.WindowsAuthenticationPackage.dll 601ScreenConnect.WindowsCredentialProvider.dll 601ScreenConnect.WindowsAuthenticationPackage.dll KERNEL32.dll VERSION.dll ole32.dll SHELL32.dll OLEAUT32.dll USER32.dll ADVAPI32.dll msi.dll wixca.dll failed to get handle to kernel32.dll Microsoft.Deployment.Compression.Cab.dll Microsoft.Deployment.Compression.dll ScreenConnect.Windows.dll ScreenConnect.Core.dll Microsoft.Deployment.WindowsInstaller.Package.dll Microsoft.Deployment.WindowsInstaller.dll ScreenConnect.InstallerActions.dll SfxCA.dll SHLWAPI.dll Cabinet.dll ScreenConnect.WindowsCredentialProvider.dll ScreenConnect.WindowsAuthenticationPackage.dll ScreenConnect.ClientService.dll ScreenConnect.Client.dll ScreenConnect.WindowsInstaller.dll libzstd.dll zlibvc.dll libwebp.dll winmm.dll ScreenConnect.Properties.libz.x86.dll ScreenConnect.Properties.libwebp.x86.dll ScreenConnect.Properties.libzstd.x86.dll ScreenConnect.Properties.libz.x64.dll ScreenConnect.Properties.libwebp.x64.dll ScreenConnect.Properties.libzstd.x64.dll ScreenConnect.Scr ScreenConnect.ScreenConnect.ClientSetup.msi ScreenConnect.Sys ScreenConnect.UserInterfaceSettingsScreenConnect.Sys .dat Failed to read Binary.Dat @.dat Temp ProgramFiles |
| File Access (UNICODE) |
| ClientSetup.msi //feedback.scr mscoree.dll Core.dll *.dll libwebp.dll CorExitProcessmscoree.dll zlib.dll ZLib.DLL Windows.dll WindowsInstaller.dll KERNEL32.DLL GetLastActivePopupGetActiveWindowMessageBoxWUSER32.DLL InstallerActions.dll ClientInstallerRunner.exe DotNetResolver.exe rundll32.exe msiexec.exe 0\powershell.exe cmd.exe WindowsBackstageShell.exe ClientService.exe WindowsClient.exe wixca.dll Command failed to execute.Command line returned an error.kernel32.dll rstrtmgr.dll dwmapi.dll d3d9.dll SfxCA.dll CorBindToRuntimeExGetRequestedRuntimeInfoFailed to load mscoree.dll Failed to locate functions in mscoree.dll USER32.DLL WScreenConnect.Scr Exec - powershell.exe /c Temp AppData |
| SQL Queries |
| SELECT ProcessId, ParentProcessId FROM Win32_Process SELECT * FROM Win32_GroupUser WHERE GroupComponent="Win32_Group.Domain=,Name="PartComponent SELECT WixCloseApplication, Target, Description, Condition, Attributes, Property, TerminateExitCode, Timeout FROM WixCloseApplication ORDER BY Sequence SELECT Component_, Directory_, Name, Target, Attributes, IconFile, IconIndex FROM WixInternetShortcut SELECT WixRestartResource.WixRestartResource, WixRestartResource.Component_, WixRestartResource.Resource, WixRestartResource.Attributes FROM WixRestartResource SELECT WixRemoveFolderEx, Component_, Property, InstallMode FROM WixRemoveFolderEx SELECT SecureObjects.SecureObject, SecureObjects.Table, SecureObjects.Domain, SecureObjects.User, SecureObjects.Permission, SecureObjects.Component_, Component.Attributes FROM SecureObjects,Component WHERE SecureObjects.Component_=Component.Component SELECT Registry.Registry, Registry.Root, Registry.Key FROM Registry WHERE Registry.Registry=? SELECT ServiceInstall.Name FROM ServiceInstall WHERE ServiceInstall.ServiceInstall=? SELECT ServiceName, Component_, NewService, FirstFailureActionType, SecondFailureActionType, ThirdFailureActionType, ResetPeriodInDays, RestartServiceDelayInSeconds, ProgramCommandLine, RebootMessage FROM ServiceConfig SELECT Data FROM Binary WHERE Name=%s SELECT XmlFile.XmlFile, XmlFile.File, XmlFile.ElementPath, XmlFile.Name, XmlFile.Value, XmlFile.Flags, XmlFile.Component_, Component.Attributes FROM XmlFile,Component WHERE XmlFile.Component_=Component.Component ORDER BY File, Sequence SELECT XmlConfig.XmlConfig, XmlConfig.File, XmlConfig.ElementPath, XmlConfig.VerifyPath, XmlConfig.Name, XmlConfig.Value, XmlConfig.Flags, XmlConfig.Component_, Component.Attributes FROM XmlConfig,Component WHERE XmlConfig.Component_=Component.Component ORDER BY File, Sequence SELECT * FROM %s |
| Interest's Words |
| lockbit PADDINGX Encrypt Decrypt Encryption RunPE PassWord <html <head <body <div <form <button <link <title <section <main exec createobject netsh attrib start pause hostname wmic sdelete shutdown systeminfo ping dism expand getmac replace route setx |
| Interest's Words (UNICODE) |
| Encrypt Encryption PassWord exec powershell netsh attrib start pause wmic sdelete shutdown rundll32 systeminfo ping rundll dism |
| URLs |
| http://ocsp.digicert.com http://cacerts.digicert.com/DigiCertTrustedRootG4.crt http://crl3.digicert.com/DigiCertTrustedRootG4.crl http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://www.digicert.com/CPS0 http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl |
| URLs (UNICODE) |
| https://feedback.screenconnect.com/Feedback.axd |
| IP Addresses |
| 31.56.209.123 |
| PE Carving |
| Start Offset Header | End Offset | Size (Bytes) |
|---|---|---|
| 0 | 123D4 | 123D4 |
| 123D4 | 98BD4 | 86800 |
| 98BD4 | C407C | 2B4A8 |
| C407C | 12B684 | 67608 |
| 12B684 | 18088C | 55208 |
| 18088C | 195694 | 14E08 |
| 195694 | 1A7A9C | 12408 |
| 1A7A9C | 1F94A4 | 51A08 |
| 1F94A4 | 23EDD4 | 45930 |
| 23EDD4 | 2599D4 | 1AC00 |
| 2599D4 | 3FA94C | 1A0F78 |
| 3FA94C | 50494C | 10A000 |
| 50494C | 547CEC | 433A0 |
| 547CEC | 561EA0 | 1A1B4 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | Encryption (AesCryptoServiceProvider) |
| Text | Ascii | Encryption (CreateDecryptor) |
| Text | Ascii | Encryption (FromBase64String) |
| Text | Ascii | Encryption (ICryptoTransform) |
| Text | Ascii | Encryption (MD5CryptoServiceProvider) |
| Text | Ascii | Encryption (RNGCryptoServiceProvider) |
| Text | Ascii | Encryption (Rijndael) |
| Text | Ascii | Encryption (RijndaelManaged) |
| Text | Ascii | Encryption (ToBase64String) |
| Text | Unicode | Privileges (SeDebugPrivilege) |
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Ascii | Privileges (SE_PRIVILEGE_ENABLED) |
| Text | Ascii | Privileges (SE_PRIVILEGE_REMOVED) |
| Text | Ascii | Keyboard Key (ALTDOWN) |
| Text | Ascii | Keyboard Key (LBUTTON) |
| Text | Ascii | Keyboard Key (RBUTTON) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (UpArrow) |
| Text | Ascii | Malicious code executed after exploiting a vulnerability (Payload) |
| Text | Ascii | Information used to authenticate a user’s identity (Credential) |
| Text | Unicode | Information used to authenticate a user’s identity (Credential) |
| Text | Ascii | Process of gathering information about network resources (Enumeration) |
| Text | Ascii | Threat focused on obtaining CVV codes to conduct unauthorized transactions (CVV) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Unicode | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Unicode | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Text | Ascii | Technique used to capture communications between systems (Intercept) |
| Entry Point | Hex Pattern | HA Archive |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ v7.0 |
| Entry Point | Hex Pattern | PE-Exe Executable Image |
| Entry Point | Hex Pattern | Trilobyte’s RNR graphics library |
| Entry Point | Hex Pattern | VC8 - Microsoft Corporation |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text | PE/Payload |
|---|---|---|---|---|---|---|
| \FILES\SCREENCONNECT.CORE, VERSION=25.2.4.9229, CULTURE=NEUTRAL, PUBLICKEYTOKEN=4B14C015C87C1AD8\0 | 163D4 | 86800 | 123D4 | 4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000 | MZ......................@......................... | (Executable found) |
| \FILES\SCREENCONNECT.WINDOWS, VERSION=25.2.4.9229, CULTURE=NEUTRAL, PUBLICKEYTOKEN=4B14C015C87C1AD8\0 | 9CBD4 | 1A6200 | 98BD4 | 4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000 | MZ......................@......................... | (Executable found) |
| \FILES\SCREENCONNECT.WINDOWSINSTALLER, VERSION=25.2.4.9229, CULTURE=NEUTRAL, PUBLICKEYTOKEN=4B14C015C87C1AD8\0 | 242DD4 | 1AC00 | 23EDD4 | 4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000 | MZ......................@......................... | (Executable found) |
| \FILES\_ENTRYPOINT\0 | 25D9D4 | 2EE318 | 2599D4 | 4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000 | MZ......................@......................... | (Executable found) |
| \FILES\_RESOLVER\0 | 54BCEC | 1600 | 547CEC | 4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000 | MZ......................@......................... | (Executable found) |
| \24\1\1033 | 54D2EC | 188 | 5492EC | 3C3F786D6C2076657273696F6E3D27312E302720656E636F64696E673D275554462D3827207374616E64616C6F6E653D2779 | <?xml version=’1.0’ encoding=’UTF-8’ standalone=’y | N/A |
| Intelligent String |
| • 0.0.0.0 • DotNetResolver.exe • :060U00Uq]dL.g?O0U0E1-Q!m0U0y+m0k0$+0http://ocsp.digicert.com0C+07http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0EU>0<0:864http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0U • ScreenConnect.ClientInstallerRunner.exe • _CorExeMainmscoree.dll • KERNEL32.dll • mscoree.dll • ScreenConnect.Windows.dll • _CorDllMainmscoree.dll • .bss • KERNEL32.DLL • ZLib.DLL • zlib.dll • libwebp.dll • ScreenConnect.Core.dll • *.dll • OLEAUT32.dll • C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb • https://feedback.screenconnect.com/Feedback.axd • .dll • .arm • aShowTrayIconContextMenuStoreLoginCredentialsItem • C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb{ • .avi • runas • cmd.exe • KWindowsPowershell\v1.0\powershell.exe • USER32.DLL • .exe • Default.cab • WScreenConnect.ScreenConnect.ClientSetup.msi • ;ScreenConnect.ClientSetup.msi • msiexec.exe • Zt ScreenConnect.WindowsBackstageShell.exe • Z ScreenConnect.WindowsClient.exe • Zp ScreenConnect.WindowsFileManager.exe • rundll32.exe • \Microsoft.Deployment.WindowsInstaller.dll • E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb • !"$%&()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]_abcdefghijklmnopqrstuvwxyz{|}~SfxCA.dll • SfxCA.dll • CloseApps.cpp • Failed to get SID; skipping account %lsosinfo.cpp • d3d9.dll • dwmapi.dll • Unable to schedule rollback for object: %lssecureobj.cpp • serviceconfig.cpp • test.cpp • Global\WixWaitForEventFail • Failed to create the Global\WixWaitForEventFail event. • Global\WixWaitForEventSucceed • Failed to create the Global\WixWaitForEventSucceed event. • XmlConfig.cpp • memutil.cppprocutil.cpp • proc2utl.cpp • fileutil.cpp • aclutil.cpprmutil.cpp • rstrtmgr.dll • pathutil.cpp • xmlutil.cppkernel32.dll • wcalog.cpp • wcascript.cpp • qtexec.cpp • wcawow64.cpp • C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb • ADVAPI32.dll • USER32.dll • wixca.dll • C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb • 8CommandStoreLoginCredentials • AnnotationABlack out the remote monitor so they cant see what youre doing.Blank Guest MonitorGPrevent the user at the remote machine from interfering with your work.Block Guest InputChange ResolutionChange Sharing+Clear everyones annotations on the screen.Clear AnnotationsJSend your clipboard to the remote machine as keystrokes. Useful for login.Send Clipboard KeystrokesControl Sharing@Enable clipboard help for the Helper to process all copied text.Enable Clipboard Help |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 401 | 40D128 | .text | CALL [static] | Indirect call to absolute memory address |
| 459 | 40D018 | .text | CALL [static] | Indirect call to absolute memory address |
| 463 | 40D014 | .text | CALL [static] | Indirect call to absolute memory address |
| 46A | 40D00C | .text | CALL [static] | Indirect call to absolute memory address |
| 475 | 40D008 | .text | CALL [static] | Indirect call to absolute memory address |
| 482 | 40D120 | .text | CALL [static] | Indirect call to absolute memory address |
| 48F | 40D12C | .text | CALL [static] | Indirect call to absolute memory address |
| 4A5 | 40D11C | .text | CALL [static] | Indirect call to absolute memory address |
| 4BD | 40D124 | .text | CALL [static] | Indirect call to absolute memory address |
| 4D6 | 40D120 | .text | CALL [static] | Indirect call to absolute memory address |
| 55D | 40D01C | .text | CALL [static] | Indirect call to absolute memory address |
| 57B | 40D01C | .text | CALL [static] | Indirect call to absolute memory address |
| 5FD | 40D134 | .text | CALL [static] | Indirect call to absolute memory address |
| 7E9 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 8BC | 40D040 | .text | CALL [static] | Indirect call to absolute memory address |
| 8C5 | 40D03C | .text | CALL [static] | Indirect call to absolute memory address |
| 8D0 | 40D044 | .text | CALL [static] | Indirect call to absolute memory address |
| 8D7 | 40D048 | .text | CALL [static] | Indirect call to absolute memory address |
| 8EA | 40D04C | .text | CALL [static] | Indirect call to absolute memory address |
| C3C | 40D05C | .text | CALL [static] | Indirect call to absolute memory address |
| C4B | 40D058 | .text | CALL [static] | Indirect call to absolute memory address |
| C54 | 40D054 | .text | CALL [static] | Indirect call to absolute memory address |
| C61 | 40D050 | .text | CALL [static] | Indirect call to absolute memory address |
| CD4 | 40D060 | .text | CALL [static] | Indirect call to absolute memory address |
| D4F | 40D04C | .text | CALL [static] | Indirect call to absolute memory address |
| E1B | 40D064 | .text | CALL [static] | Indirect call to absolute memory address |
| E3B | 40D040 | .text | CALL [static] | Indirect call to absolute memory address |
| E45 | 40D03C | .text | CALL [static] | Indirect call to absolute memory address |
| E78 | 40D068 | .text | CALL [static] | Indirect call to absolute memory address |
| E96 | 40D06C | .text | CALL [static] | Indirect call to absolute memory address |
| EDB | 40D040 | .text | CALL [static] | Indirect call to absolute memory address |
| F59 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| F85 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 101A | 40D04C | .text | CALL [static] | Indirect call to absolute memory address |
| 13FE | 40D070 | .text | CALL [static] | Indirect call to absolute memory address |
| 16EC | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 1839 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 1B02 | 40D074 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B7B | 40D078 | .text | CALL [static] | Indirect call to absolute memory address |
| 1C33 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 21F5 | 40D07C | .text | CALL [static] | Indirect call to absolute memory address |
| 2465 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 2B3F | 40D070 | .text | CALL [static] | Indirect call to absolute memory address |
| 2BB9 | 40D088 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C55 | 40D0A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C5F | 40D01C | .text | CALL [static] | Indirect call to absolute memory address |
| 2C7F | 40D0A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C89 | 40D074 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CB1 | 40D0A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2CE5 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 2CF2 | 40D090 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D20 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 2D2A | 40D09C | .text | CALL [static] | Indirect call to absolute memory address |
| 2D5B | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 2D65 | 40D094 | .text | CALL [static] | Indirect call to absolute memory address |
| 2D99 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 2DA3 | 40D098 | .text | CALL [static] | Indirect call to absolute memory address |
| 2DDA | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 2DEA | 40D08C | .text | CALL [static] | Indirect call to absolute memory address |
| 2E02 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 2EED | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 2F1D | 40D0A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 362A | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 3640 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 3726 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 3793 | 40D000 | .text | CALL [static] | Indirect call to absolute memory address |
| 3BC2 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 3CE4 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 3D25 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 3DE1 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 3E98 | 40D044 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E9F | 40D048 | .text | CALL [static] | Indirect call to absolute memory address |
| 3EB1 | 40D0C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3EBA | 40D06C | .text | CALL [static] | Indirect call to absolute memory address |
| 3F1C | 40D0C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3F2F | 40D01C | .text | CALL [static] | Indirect call to absolute memory address |
| 3F40 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 3F52 | 40D0A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 42A1 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 46A7 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 4C28 | 40D074 | .text | CALL [static] | Indirect call to absolute memory address |
| 4C90 | 40D078 | .text | CALL [static] | Indirect call to absolute memory address |
| 4C9C | 40D078 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CAD | 40D074 | .text | CALL [static] | Indirect call to absolute memory address |
| 4D16 | 40D078 | .text | CALL [static] | Indirect call to absolute memory address |
| 4D1F | 40D078 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E6B | 40D064 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E75 | 40D040 | .text | CALL [static] | Indirect call to absolute memory address |
| 4E82 | 40D03C | .text | CALL [static] | Indirect call to absolute memory address |
| 4EF7 | 40D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 4F71 | 40D044 | .text | CALL [static] | Indirect call to absolute memory address |
| 4F78 | 40D048 | .text | CALL [static] | Indirect call to absolute memory address |
| 504D | 40D0D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 507F | 40D0D4 | .text | CALL [static] | Indirect call to absolute memory address |
| 5091 | 40D074 | .text | CALL [static] | Indirect call to absolute memory address |
| 5390 | 40D0DC | .text | CALL [static] | Indirect call to absolute memory address |
| 53B7 | 40D0D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5422 | 40D0E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 56E9 | 40D0E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 5700 | 40D0C8 | .text | CALL [static] | Indirect call to absolute memory address |
| 8B2 | 401331 | .text | Entry Point Backward Redirect | Score=1/7 - Redirects=1 - PreJumpInstructions=1 - JumpType=JMP_NEAR - TargetOffset=0x731 - TargetSection=.text - Confidence=Low |
| 54A600 | N/A | *Overlay* | A078010000020200308301788E06092A864886F7 | .x......0..x...*.H.. |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 3544534 | 62,8025% |
| Null Byte Code | 656773 | 11,6368% |
© 2026 All rights reserved.