PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 4,24 MB SHA-256 Hash: DF318A3137B6AACAE44140F3884D0907E62B98439AF6174B2E987B1186246799 SHA-1 Hash: 67B8257918FBFA39DD9B292C588735D93F0246EB MD5 Hash: 9A405582E8C7B9EC1F1C26F11BC5F018 Imphash: 21A44579F3251B35C2294168532214F3 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 000102D6 EntryPoint (rva): 13B0 SizeOfHeaders: 400 SizeOfImage: 11000 ImageBase: 70A00000 Architecture: x86 ExportTable: C000 ImportTable: D000 IAT: D124 Characteristics: 230E TimeDateStamp: 68BCAA32 Date: 06/09/2025 21:40:02 File Type: DLL Number Of Sections: 9 ASLR: Enabled Section Names: .text, .data, .rdata, .bss, .edata, .idata, .CRT, .tls, .reloc Number Of Executable Sections: 1 Subsystem: Windows Console |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60500060 Code Initialized Data Executable Readable |
400 | 7400 | 1000 | 7274 |
|
|
| .data | 0xC0300040 Initialized Data Readable Writeable |
7800 | 200 | 9000 | 50 |
|
|
| .rdata | 0x40600040 Initialized Data Readable |
7A00 | 800 | A000 | 798 |
|
|
| .bss | 0xC0600080 Uninitialized Data Readable Writeable |
0 | 0 | B000 | A30 |
|
|
| .edata | 0x40300040 Initialized Data Readable |
8200 | 200 | C000 | 46 |
|
|
| .idata | 0xC0300040 Initialized Data Readable Writeable |
8400 | 600 | D000 | 58C |
|
|
| .CRT | 0xC0300040 Initialized Data Readable Writeable |
8A00 | 200 | E000 | 2C |
|
|
| .tls | 0xC0300040 Initialized Data Readable Writeable |
8C00 | 200 | F000 | 8 |
|
|
| .reloc | 0x42300040 Initialized Data GP-Relative Readable |
8E00 | 400 | 10000 | 3C8 |
|
|
| Description |
| OriginalFilename: FlxCore.dll LegalCopyright: Copyright (c) 2010-2020 Flexera Software LLC. All Rights Reserved. ProductName: FlexNet Embedded Core FileVersion: 2023.09.1.0 FileDescription: FlexNet Embedded Core Library ProductVersion: 2023.09.1.0 |
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 4,18 MB |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - 7B0 Code -> 83EC0CC70534B0A070000000008B4C24188B5424148B442410E852FEFFFF83C40CC20C008DB426000000008D7426009083EC Assembler |SUB ESP, 0XC |MOV DWORD PTR [0X70A0B034], 0 |MOV ECX, DWORD PTR [ESP + 0X18] |MOV EDX, DWORD PTR [ESP + 0X14] |MOV EAX, DWORD PTR [ESP + 0X10] |CALL 0XE70 |ADD ESP, 0XC |RET 0XC |LEA ESI, [ESI] |LEA ESI, [ESI] |NOP |
| Signatures |
| CheckSum Integrity Problem: • Header: 66262 • Calculated: 4494761 Certificate - Digital Signature: • The file is signed but has been modified |
| Packer/Compiler |
| Compiler: Microsoft Visual Studio Compiler: Microsoft Visual C ++ Compiler: Microsoft Visual C ++ 6 DLL Detect It Easy (die) • PE: compiler: MinGW(GCC: (GNU) 10.3.0)[-] • PE: linker: GNU linker ld (GNU Binutils)(2.36)[-] • Entropy: 7.0026 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | CreateMutexA | Create a named or unnamed mutex object for controlling access to a shared resource. |
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | CopyFileW | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | CreateToolhelp32Snapshot | Creates a snapshot of the specified processes, heaps, threads, and modules. |
| KERNEL32.DLL | ReadProcessMemory | Reads data from an area of memory in a specified process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| ADVAPI32.DLL | CryptDecrypt | Performs a cryptographic operation on data in a data block. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegDeleteKeyA | Used to delete a subkey and its values from the Windows registry. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegDeleteValueA | Removes a named value from the specified registry key. Note that value names are not case sensitive. |
| ET Functions (carving) |
| Original Name -> FlxCore.dll _Java_com_flexnet_licensing_DllEntryPoint_entry@12 marshall |
| Windows REG |
| SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318} |
| File Access |
| .exe cmd.exe FlxCore.dll dhcpcsvc.DLL CRYPT32.dll SHELL32.dll WININET.dll USER32.dll OLEAUT32.dll ole32.dll WINTRUST.dll KERNEL32.dll WS2_32.dll ADVAPI32.dll IPHLPAPI.DLL %s.dll !\?.dll;!\loadall.dll;.\?.dll !\?.dll;!\loadall.dll !\?.dll shlwapi.dll WKWIN32.DLL .dll msvcrt.dll wjnmfdonsc.dll .bat Temp |
| File Access (UNICODE) |
| msvcrt.dll KERNEL32.DLL (AACorExitProcessmscoree.dll \wkwin32.dll \haspsrm_win32.dll %ls\haspsrm_win32.dll create_directoryCreateHardLinkWkernel32.dll FlxCore.dll update.exe |
| SQL Queries |
| SELECT * FROM Win32_NetworkAdapter SELECT SystemName FROM Win32_Processor SELECT * FROM Win32_BIOS SELECT * FROM Win32_DiskDrive SELECT Name FROM Win32_PROCESSOR SELECT HypervisorPresent FROM Win32_ComputerSystem SELECT UUID FROM Win32_ComputerSystemProduct |
| Interest's Words |
| smtp Encrypt Decrypt Encryption PassWord exec attrib start pause comspec cipher hostname wmic certreq netcfg ping expand getmac replace route |
| URLs |
| http://ocsp.digicert.com http://cacerts.digicert.com/DigiCertTrustedRootG4.crt http://crl3.digicert.com/DigiCertTrustedRootG4.crl http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl http://www.digicert.com/CPS0 http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl http://crt.usertrust.com/USERTrustRSAAddTrustCA.crt http://ocsp.usertrust.com http://crl.sectigo.com/SectigoRSATimeStampingCA.crl http://crt.sectigo.com/SectigoRSATimeStampingCA.crt http://ocsp.sectigo.com http://s.symcd.com http://s.symcb.com/universal-root.crl http://ts-crl.ws.symantec.com/sha256-tss-ca.crl http://ts-ocsp.ws.symantec.com http://ts-aia.ws.symantec.com/sha256-tss-ca.cer https://sectigo.com/CPS0 https://d.symcb.com/cps0% https://d.symcb.com/rpa0. https://d.symcb.com/rpa0@ |
| IP Addresses |
| 169.254.169.254 1.3.101.113 1.3.101.112 1.3.101.111 1.3.101.110 |
| Known IP/Domains |
| Cloudflare DNS - 1.1.1.1 |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (listen) |
| Text | Ascii | WinAPI Sockets (accept) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | WinAPI Sockets (send) |
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CopyFile) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Service (OpenSCManager) |
| Text | Unicode | Encryption (Intel Hardware Cryptographic Service Provider) |
| Text | Unicode | Encryption (Microsoft Enhanced Cryptographic Provider v1.0) |
| Text | Unicode | Encryption (Microsoft Enhanced RSA and AES Cryptographic Provider) |
| Text | Ascii | Encryption API (CryptAcquireContext) |
| Text | Ascii | Encryption API (CryptDecrypt) |
| Text | Ascii | Encryption API (CryptReleaseContext) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Stealth (ReadProcessMemory) |
| Text | Ascii | Execution (CreateProcessA) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Antivirus Software (gdata) |
| Text | Ascii | Antivirus Software (Symantec) |
| Text | Unicode | WMI execution (ROOT\CIMV2) |
| Text | Ascii | Stealer malware focused on obtaining CVV codes to conduct unauthorized transactions (CVV) |
| Text | Ascii | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Intelligent String |
| • .exe • .com • .bat • .cmd • msvcrt.dll • @@.bss • .CRT • .tls • KERNEL32.dll • USER32.dll • C:\build\fne\main\itafnewinb32\main\wrapper\callouts\glue\FlxExtGlueOpenSsl.c • Global\e • update.exe • .dll • KERNEL32.DLL • mscoree.dll • \wkwin32.dll • hasp_legacy_decrypthasp_legacy_encrypthasp_login_scope • hasp_logouthasp_login • haspsrm_win32.dll • \haspsrm_win32.dll • %ls\haspsrm_win32.dll • C:\build\fne\main\itafnewinb32\main\prebuilt\boost\1.74.0\include\boost/property_tree/string_path.hpp • C:\build\fne\main\itafnewinb32\main\prebuilt\boost\1.74.0\include\boost/property_tree/detail/ptree_implementation.hpp • C:\build\fne\main\itafnewinb32\main\prebuilt\boost\1.74.0\include\boost/property_tree/detail/xml_parser_write.hpp • C:\build\fne\main\itafnewinb32\main\prebuilt\boost\1.74.0\include\boost/property_tree/detail/xml_parser_read_rapidxml.hpp • C:\build\fne\main\itafnewinb32\main\prebuilt\boost\1.74.0\include\boost/exception/detail/exception_ptr.hpp • dump • !\?.dll • ;!\loadall.dll • ;.\?.dll • !\lua\?.lua;!\lua\?\init.lua;!\?.lua;!\?\init.lua;.\?.lua • .CMD • .BAT • .COM • .EXE • c:\users\fnebuild\tmp\x86\openssl-3.0.11\crypto\err\err_local.hcrypto\err\err_blocks.cDSADHXX9.42 DH • C:\Users\fnebuild\tmp\prebuilt\openssl\3.0.11\i86_n3\lib\ossl-modules • Microsoft Smartcard Login • msSmartcardLogin • C:\Users\fnebuild\tmp\prebuilt\openssl\3.0.11\i86_n3\lib\engines-3 • c:\users\fnebuild\tmp\x86\openssl-3.0.11\engines\e_capi_err.c • %s.dll • .cnf • C:\Users\fnebuild\tmp\prebuilt\openssl\3.0.11\i86_n3 • [HEX DUMP]::%u:BAD BOOLEAN • invalid cmd number • invalid cmd name • command takes inputcmd not executable • c:\users\fnebuild\tmp\x86\openssl-3.0.11\providers\implementations\macs\blake2_mac_impl.c • c:\users\fnebuild\tmp\x86\openssl-3.0.11\providers\implementations\ciphers\cipher_camellia_cts.inc • c:\users\fnebuild\tmp\x86\openssl-3.0.11\providers\implementations\ciphers\cipher_aes_cts.inc • c:\users\fnebuild\tmp\x86\openssl-3.0.11\providers\implementations\ciphers\cipher_aes_hw_aesni.inc • value.bag • COMSPECPATH • C:\build\fne\main\itafnewinb32\output-Fne-Windows-Wrapper-x86-Main\i86_n3\lib\FlxCore.pdb • IPHLPAPI.DLL • ADVAPI32.dll • getaddrinfoWS2_32.dll • WINTRUST.dll • OLEAUT32.dll • FlxCore.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 457 | 70A0D14C | .text | CALL [static] | Indirect call to absolute memory address |
| EBB | 70A0D160 | .text | CALL [static] | Indirect call to absolute memory address |
| F23 | 70A0D15C | .text | CALL [static] | Indirect call to absolute memory address |
| F30 | 70A0D12C | .text | CALL [static] | Indirect call to absolute memory address |
| 11FE | 70A0D128 | .text | CALL [static] | Indirect call to absolute memory address |
| 124C | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 12A2 | 70A0D128 | .text | CALL [static] | Indirect call to absolute memory address |
| 12C0 | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 1307 | 70A0D128 | .text | CALL [static] | Indirect call to absolute memory address |
| 1347 | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 141C | 70A0D124 | .text | CALL [static] | Indirect call to absolute memory address |
| 1447 | 70A0D13C | .text | CALL [static] | Indirect call to absolute memory address |
| 5CA8 | 70A0D128 | .text | CALL [static] | Indirect call to absolute memory address |
| 5DB8 | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 5E77 | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 5FFD | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 62C1 | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 6359 | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 6A10 | 70A0D1E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A18 | 70A0D1E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A20 | 70A0D1E0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A28 | 70A0D1DC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A30 | 70A0D1D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A38 | 70A0D1D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A40 | 70A0D1D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A48 | 70A0D1C8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A50 | 70A0D1BC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A58 | 70A0D1B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A60 | 70A0D1B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A68 | 70A0D1B0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A70 | 70A0D1AC | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A78 | 70A0D1A8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A80 | 70A0D1A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A88 | 70A0D1A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A90 | 70A0D198 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6A98 | 70A0D190 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AA0 | 70A0D18C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AA8 | 70A0D188 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AB0 | 70A0D17C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AB8 | 70A0D178 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AC0 | 70A0D174 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6AC8 | 70A0D170 | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B22 | 70A0D140 | .text | CALL [static] | Indirect call to absolute memory address |
| 6B65 | 70A0D148 | .text | CALL [static] | Indirect call to absolute memory address |
| 6C1B | 70A0D148 | .text | CALL [static] | Indirect call to absolute memory address |
| 7043 | 70A0D164 | .text | CALL [static] | Indirect call to absolute memory address |
| 721E | 70A0D128 | .text | CALL [static] | Indirect call to absolute memory address |
| 728E | 70A0D144 | .text | CALL [static] | Indirect call to absolute memory address |
| 733C | 70A0D134 | .text | CALL [static] | Indirect call to absolute memory address |
| 73B0 | 70A0904C | .text | JMP [static] | Indirect jump to absolute memory address |
| 73C0 | 70A0D1CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 73C8 | 70A0D1C4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 73D0 | 70A0D1C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 73D8 | 70A0D19C | .text | JMP [static] | Indirect jump to absolute memory address |
| 73E0 | 70A0D194 | .text | JMP [static] | Indirect jump to absolute memory address |
| 73E8 | 70A0D184 | .text | JMP [static] | Indirect jump to absolute memory address |
| 1339E | 102EE01C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 133C4 | 102EE018 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13434 | 102EE010 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13453 | 102EE01C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 1350E | 102EE00C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13578 | 102EE00C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13587 | 102EE00C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 135B8 | 102EE00C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13C3B | 102EE4EC | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13C6B | 102EE4E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13C81 | 102EE4D8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13D06 | 102EE4E4 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13D1C | 102EE4D8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 13F18 | 102EE4D8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 143E2 | 102EE1E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 152F9 | 102EE02C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 1533C | 102EE028 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 1534D | 102EE024 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 15369 | 102EE024 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 157C9 | 102EE1AC | *padding* | CALL [static] | Indirect call to absolute memory address |
| 157DD | 102EE1E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 15838 | 102EE1A8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 1584B | 102EE1E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 15CF1 | 102EE1B0 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 166E2 | 102EE1E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 16760 | 102EE1E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22870 | 102EE1E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22930 | 102EE1E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 229BE | 102EE034 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22A25 | 102EE030 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22A60 | 102EE038 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22AA7 | 102EE03C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22AFF | 102EE040 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22B05 | 102EE1E8 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22BE6 | 102EE040 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22C74 | 102EE03C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22C9E | 102EE050 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22CBF | 102EE04C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22CE5 | 102EE048 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22D12 | 102EE044 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22D71 | 102EE054 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22DAC | 102EE05C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22DDB | 102EE03C | *padding* | CALL [static] | Indirect call to absolute memory address |
| 22E3A | 102EE058 | *padding* | CALL [static] | Indirect call to absolute memory address |
| 112300-11231F | N/A | *padding* | Unusual BP Cave, count: 32 |
| 1600CA-1600FF | N/A | *padding* | Unusual BP Cave, count: 54 |
| 165B9B-165BBF | N/A | *padding* | Unusual BP Cave, count: 37 |
| 168CD2-168CFF | N/A | *padding* | Unusual NOPS Space, count: 46 |
| 16BD99-16BDBF | N/A | *padding* | Unusual NOPS Space, count: 39 |
| 1A55D4-1A55FF | N/A | *padding* | Unusual BP Cave, count: 44 |
| 1A6860-1A687F | N/A | *padding* | Unusual NOPS Space, count: 32 |
| 1A9A8A-1A9ABF | N/A | *padding* | Unusual NOPS Space, count: 54 |
| 1A9B60-1A9B7F | N/A | *padding* | Unusual BP Cave, count: 32 |
| 1D63AE-1D63CF | N/A | *padding* | Unusual BP Cave, count: 34 |
| 1E08C4-1E08FF | N/A | *padding* | Unusual BP Cave, count: 60 |
| 1FC2D0-1FC2FF | N/A | *padding* | Unusual BP Cave, count: 48 |
| 1FCE26-1FD3FF | N/A | *padding* | Unusual BP Cave, count: 1498 |
| 22249C-2224BF | N/A | *padding* | Unusual NOPS Space, count: 36 |
| 235016-23503F | N/A | *padding* | Unusual BP Cave, count: 42 |
| 23545D-23547F | N/A | *padding* | Unusual NOPS Space, count: 35 |
| 2354D4-2354FF | N/A | *padding* | Unusual NOPS Space, count: 44 |
| 235D61-235D7F | N/A | *padding* | Unusual BP Cave, count: 31 |
| 270D62-270D7F | N/A | *padding* | Unusual BP Cave, count: 30 |
| 27149B-2714BF | N/A | *padding* | Unusual NOPS Space, count: 37 |
| 272017-27203F | N/A | *padding* | Unusual BP Cave, count: 41 |
| 278D44-278D7F | N/A | *padding* | Unusual NOPS Space, count: 60 |
| 278DA0-278DBF | N/A | *padding* | Unusual NOPS Space, count: 32 |
| 27F860-27F87F | N/A | *padding* | Unusual NOPS Space, count: 32 |
| 27FA60-27FA7F | N/A | *padding* | Unusual NOPS Space, count: 32 |
| 29F945-29F97F | N/A | *padding* | Unusual BP Cave, count: 59 |
| 2A1191-2A11BF | N/A | *padding* | Unusual BP Cave, count: 47 |
| 2A450C-2A453F | N/A | *padding* | Unusual BP Cave, count: 52 |
| 2A7316-2A733F | N/A | *padding* | Unusual BP Cave, count: 42 |
| 2D733C-2D735F | N/A | *padding* | Unusual BP Cave, count: 36 |
| 9200 | N/A | *Overlay* | 5F5E5B59C3CCCCCCCCCCCCCCCCCCCCCC83EC2053 | _[Y.............. S |
| 8A18 | 1920 | .CRT | TLS Callback | Pointer to 70A01920 *Memory* |
| 8A1C | 18D0 | .CRT | TLS Callback | Pointer to 70A018D0 *Memory* |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 2857136 | 64,1993% |
| Null Byte Code | 512940 | 11,5257% |
| NOP Cave Found | 0x9090909090 | Block Count: 552 | Total: 0,031% |
© 2026 All rights reserved.