PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,12 MBSHA-256 Hash: 797F4D6A016085CDFEBDD81E07A8DE9991F3FF5EF0EDB0372E9F457B33EA145B SHA-1 Hash: A75BE0119951FF96776503A7CD12E61FD556DB66 MD5 Hash: 9F1B99028152DCDAEA71716642BAF439 Imphash: D41D8CD98F00B204E9800998ECF8427E MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00120C94 EntryPoint (rva): EC3EA SizeOfHeaders: 400 SizeOfImage: 11E000 ImageBase: 400000 Architecture: x86 ImportTable: FEB8C Characteristics: 818E TimeDateStamp: 6B616E73 Date: 02/02/2027 5:49:39 File Type: EXE Number Of Sections: 10 ASLR: Disabled Section Names: .text, .itext, .data, .bss, .idata, .tls, .rdata, .reloc, .rsrc, RY4SHL Number Of Executable Sections: 10 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0xE0000020 Code Executable Readable Writeable |
1000 | A6000 | 1000 | A6000 |
|
|
| .itext | 0xE0000020 Code Executable Readable Writeable |
A7000 | 1000 | A7000 | 1000 |
|
|
| .data | 0xE0000020 Code Executable Readable Writeable |
A8000 | C000 | A8000 | C000 |
|
|
| .bss | 0xE0000020 Code Executable Readable Writeable |
B4000 | 7000 | B4000 | 7000 |
|
|
| .idata | 0xE0000020 Code Executable Readable Writeable |
BB000 | 3000 | BB000 | 3000 |
|
|
| .tls | 0xE0000020 Code Executable Readable Writeable |
BE000 | 1000 | BE000 | 1000 |
|
|
| .rdata | 0xE0000020 Code Executable Readable Writeable |
BF000 | 1000 | BF000 | 1000 |
|
|
| .reloc | 0xE0000020 Code Executable Readable Writeable |
C0000 | C000 | C0000 | C000 |
|
|
| .rsrc | 0xE0000020 Code Executable Readable Writeable |
CC000 | F000 | CC000 | F000 |
|
|
| RY4SHL | 0xE0000020 Code Executable Readable Writeable |
DB000 | 43000 | DB000 | 43000 |
|
|
| Entry Point |
The section number (10) - (RY4SHL) have the Entry Point Information -> EntryPoint (calculated) - EC3EA Code -> 558BEC6AFF68702A4E006898794E0064A100000000506489250000000083EC1C5356578965E833FF393D38BE4F0075465757 EP changed to another address -> (Address Of EntryPoint > Base Of Data) Assembler |PUSH EBP |MOV EBP, ESP |PUSH -1 |PUSH 0X4E2A70 |PUSH 0X4E7998 |MOV EAX, DWORD PTR FS:[0] |PUSH EAX |MOV DWORD PTR FS:[0], ESP |SUB ESP, 0X1C |PUSH EBX |PUSH ESI |PUSH EDI |MOV DWORD PTR [EBP - 0X18], ESP |XOR EDI, EDI |CMP DWORD PTR [0X4FBE38], EDI |JNE 0X1076 |PUSH EDI |PUSH EDI |
| Signatures |
| CheckSum Integrity Problem: • Header: 1182868 • Calculated: 1180421 Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual C ++ Compiler: Microsoft Visual C ++ 6 DLL Detect It Easy (die) • PE: compiler: Embarcadero Delphi(2009-2010)[-] • PE: compiler: EP:Microsoft Visual C/C++(6.0 (1720-9782))[EXE32] • PE: compiler: Microsoft Visual C/C++(-)[-] • PE: protection: Rockey4 dongle reference(-)[-] • PE: protection: Rainbow Sentinel dongle reference(-)[-] • Entropy: 7.3813 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| Windows REG |
| SYSTEM\CurrentControlSet\Control\ProductOptions |
| File Access |
| EXPLORER.EXE IEXPLORE.EXE ADVAPI32.dll USER32.dll KERNEL32.dll shell32.dll comctl32.dll ole32.dll version.dll gdi32.dll oleaut32.dll IMAGEHLP.dll psspy.dll WINSCARD.DLL \vfp6r.dll \drivers\rockeynt.sys \rockeynt.sys .dat Glyph.Dat SYSTEM.INI Temp |
| Interest's Words |
| PassWord exec attrib start ping |
| Interest's Words (UNICODE) |
| exec start hostname expand replace route |
| PE Carving |
| Start Offset Header | End Offset | Size (Bytes) |
|---|---|---|
| 0 | E2C84 | E2C84 |
| E2C84 | 11E000 | 3B37C |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Unicode | WinAPI Sockets (connect) |
| Text | Unicode | WinAPI Sockets (send) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Service (CreateService) |
| Text | Ascii | Encryption (Blowfish) |
| Text | Ascii | Encryption (Rijndael) |
| Text | Ascii | Encryption (Twofish) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (MapViewOfFile) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Unicode | Keyboard Key (Alt+) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Technique used to capture communications between systems (Intercept) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 5.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ v6.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\1033 | CCC78 | 134 | CCC78 | 070001002800000020000000400000000100010000000000000200000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\2\1033 | CCDAC | 134 | CCDAC | 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\3\1033 | CCEE0 | 134 | CCEE0 | 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\4\1033 | CD014 | 134 | CD014 | 0E000C002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\5\1033 | CD148 | 134 | CD148 | 10000E002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\6\1033 | CD27C | 134 | CD27C | 000000002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\7\1033 | CD3B0 | 134 | CD3B0 | 020002002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \BITMAP\BBABORT\1033 | CD4E4 | 1D0 | CD4E4 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBALL\1033 | CD6B4 | 1E4 | CD6B4 | 28000000240000001300000001000400000000007C0100000000000000000000100000000000000000000000000080000080 | (...$...............|............................. |
| \BITMAP\BBCANCEL\1033 | CD898 | 1D0 | CD898 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBCLOSE\1033 | CDA68 | 1D0 | CDA68 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBHELP\1033 | CDC38 | 1D0 | CDC38 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBIGNORE\1033 | CDE08 | 1D0 | CDE08 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBNO\1033 | CDFD8 | 1D0 | CDFD8 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBOK\1033 | CE1A8 | 1D0 | CE1A8 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBRETRY\1033 | CE378 | 1D0 | CE378 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \BITMAP\BBYES\1033 | CE548 | 1D0 | CE548 | 2800000024000000120000000100040000000000680100000000000000000000100000000000000000000000000080000080 | (...$...............h............................. |
| \ICON\1\1033 | CE718 | 25A8 | CE718 | 280000003000000060000000010020000000000080250000000000000000000000000000000000003030A6633030A59F3030 | (...0........ ......%..................00.c00..00 |
| \ICON\2\1033 | D0CC0 | 10A8 | D0CC0 | 280000002000000040000000010020000000000080100000000000000000000000000000000000003030A68F3030A5BF3030 | (... ...@..... .........................00..00..00 |
| \ICON\3\1033 | D1D68 | 988 | D1D68 | 280000001800000030000000010020000000000060090000000000000000000000000000000000003030A6A83030A5CF2F2F | (.......0..... ........................00..00..// |
| \ICON\4\1033 | D26F0 | 468 | D26F0 | 280000001000000020000000010020000000000040040000000000000000000000000000000000003030A6C33030A4DF3030 | (....... ..... .....@...................00..00..00 |
| \STRING\4075\0 | D2B58 | 164 | D2B58 | 0E004F004C00450020006500720072006F007200200025002E00380078002E004D006500740068006F006400200027002500 | ..O.L.E. .e.r.r.o.r. .%...8.x...M.e.t.h.o.d. .'.%. |
| \STRING\4076\0 | D2CBC | 494 | D2CBC | 3B00430061006E006E006F0074002000630061006C006C0020005400650072006D0069006E0061007400650041006E006400 | ;.C.a.n.n.o.t. .c.a.l.l. .T.e.r.m.i.n.a.t.e.A.n.d. |
| \STRING\4077\0 | D3150 | 2B4 | D3150 | 14004E006500740077006F0072006B00200075006E0072006500610063006800610062006C0065002E00110048006F007300 | ..N.e.t.w.o.r.k. .u.n.r.e.a.c.h.a.b.l.e.....H.o.s. |
| \STRING\4078\0 | D3404 | 46C | D3404 | 10004900500076003600200075006E0061007600610069006C00610062006C0065001E002500730020006900730020006E00 | ..I.P.v.6. .u.n.a.v.a.i.l.a.b.l.e...%.s. .i.s. .n. |
| \STRING\4079\0 | D3870 | 3A0 | D3870 | 130043006F006E006E0065006300740069006F006E00200072006500660075007300650064002E00220054006F006F002000 | ..C.o.n.n.e.c.t.i.o.n. .r.e.f.u.s.e.d...".T.o.o. . |
| \STRING\4080\0 | D3C10 | 3D8 | D3C10 | 22004F007000650072006100740069006F006E0020006E006F007400200073007500700070006F0072007400650064002000 | ".O.p.e.r.a.t.i.o.n. .n.o.t. .s.u.p.p.o.r.t.e.d. . |
| \STRING\4081\0 | D3FE8 | 2F0 | D3FE8 | 180049006E007400650072007200750070007400650064002000730079007300740065006D002000630061006C006C002E00 | ..I.n.t.e.r.r.u.p.t.e.d. .s.y.s.t.e.m. .c.a.l.l... |
| \STRING\4082\0 | D42D8 | 3C0 | D42D8 | 1B0020002D00200044006F0063006B0020007A006F006E006500200068006100730020006E006F00200063006F006E007400 | .. .-. .D.o.c.k. .z.o.n.e. .h.a.s. .n.o. .c.o.n.t. |
| \STRING\4083\0 | D4698 | 240 | D4698 | 020055007000050052006900670068007400040044006F0077006E00030049006E0073000300440065006C00060053006800 | ..U.p...R.i.g.h.t...D.o.w.n...I.n.s...D.e.l...S.h. |
| \STRING\4084\0 | D48D8 | C8 | D48D8 | 06002600410062006F0072007400060026005200650074007200790007002600490067006E006F0072006500040026004100 | ..&.A.b.o.r.t...&.R.e.t.r.y...&.I.g.n.o.r.e...&.A. |
| \STRING\4085\0 | D49A0 | 108 | D49A0 | 0500410062006F00720074000400260041006C006C001200430061006E006E006F0074002000640072006100670020006100 | ..A.b.o.r.t...&.A.l.l...C.a.n.n.o.t. .d.r.a.g. .a. |
| \STRING\4086\0 | D4AA8 | 2A8 | D4AA8 | 2200430061006E006E006F00740020006D0061006B006500200061002000760069007300690062006C006500200077006900 | ".C.a.n.n.o.t. .m.a.k.e. .a. .v.i.s.i.b.l.e. .w.i. |
| \STRING\4087\0 | D4D50 | 3F0 | D4D50 | 1C0055006E0073007500700070006F007200740065006400200063006C006900700062006F00610072006400200066006F00 | ..U.n.s.u.p.p.o.r.t.e.d. .c.l.i.p.b.o.a.r.d. .f.o. |
| \STRING\4088\0 | D5140 | 38C | D5140 | 1700250073002E005300650065006B0020006E006F007400200069006D0070006C0065006D0065006E007400650064002400 | ..%.s...S.e.e.k. .n.o.t. .i.m.p.l.e.m.e.n.t.e.d.$. |
| \STRING\4089\0 | D54CC | 370 | D54CC | 240027002700250073002700270020006900730020006E006F007400200061002000760061006C0069006400200063006F00 | $.'.'.%.s.'.'. .i.s. .n.o.t. .a. .v.a.l.i.d. .c.o. |
| \STRING\4090\0 | D583C | 390 | D583C | 0800540068007500720073006400610079000600460072006900640061007900080053006100740075007200640061007900 | ..T.h.u.r.s.d.a.y...F.r.i.d.a.y...S.a.t.u.r.d.a.y. |
| \STRING\4091\0 | D5BCC | D0 | D5BCC | 06004100750067007500730074000900530065007000740065006D0062006500720007004F00630074006F00620065007200 | ..A.u.g.u.s.t...S.e.p.t.e.m.b.e.r...O.c.t.o.b.e.r. |
| \STRING\4092\0 | D5C9C | A0 | D5C9C | 030041007000720003004D006100790003004A0075006E0003004A0075006C00030041007500670003005300650070000300 | ..A.p.r...M.a.y...J.u.n...J.u.l...A.u.g...S.e.p... |
| \STRING\4093\0 | D5D3C | 2B8 | D5D3C | 100049006E00760061006C0069006400200061007200670075006D0065006E007400140049006E00760061006C0069006400 | ..I.n.v.a.l.i.d. .a.r.g.u.m.e.n.t...I.n.v.a.l.i.d. |
| \STRING\4094\0 | D5FF4 | 47C | D5FF4 | 2200560061007200690061006E00740020006D006500740068006F0064002000630061006C006C00730020006E006F007400 | ".V.a.r.i.a.n.t. .m.e.t.h.o.d. .c.a.l.l.s. .n.o.t. |
| \STRING\4095\0 | D6470 | 368 | D6470 | 200049006E00760061006C0069006400200066006C006F006100740069006E006700200070006F0069006E00740020006F00 | .I.n.v.a.l.i.d. .f.l.o.a.t.i.n.g. .p.o.i.n.t. .o. |
| \STRING\4096\0 | D67D8 | 2B4 | D67D8 | 2100270025007300270020006900730020006E006F007400200061002000760061006C0069006400200069006E0074006500 | !.'.%.s.'. .i.s. .n.o.t. .a. .v.a.l.i.d. .i.n.t.e. |
| \RCDATA\DVCLAL\0 | D6A8C | 10 | D6A8C | A28CDF987B3C3A7926713F090F2A2517 | ....{<:y&q?..*%. |
| \RCDATA\PACKAGEINFO\0 | D6A9C | 6E0 | D6A9C | 000010CC000000009300000001E050726F53657276657200103154776F666973680010124443506372797074001005534841 | ..............ProServer..1Twofish...DCPcrypt...SHA |
| \RCDATA\TFORM1\0 | D717C | 244B | D717C | 545046300654466F726D3105466F726D31044C65667403020103546F7003D5000B426F726465725374796C65070862734469 | TPF0.TForm1.Form1.Left....Top....BorderStyle..bsDi |
| \RCDATA\TINFOFORM\0 | D95C8 | 712 | D95C8 | 545046300954496E666F466F726D08496E666F466F726D044C65667403B40103546F70027C0B426F726465725374796C6507 | TPF0.TInfoForm.InfoForm.Left....Top.|.BorderStyle. |
| \RCDATA\TLOGBOX\0 | D9CDC | 233 | D9CDC | 5450463007544C6F67426F78064C6F67426F78044C65667403D10103546F7002790B426F726465725374796C650708627344 | TPF0.TLogBox.LogBox.Left....Top.y.BorderStyle..bsD |
| \GROUP_CURSOR\32761\1033 | D9F10 | 14 | D9F10 | 0000020001002000400001000100340100000100 | ...... .@.....4..... |
| \GROUP_CURSOR\32762\1033 | D9F24 | 14 | D9F24 | 0000020001002000400001000100340100000200 | ...... .@.....4..... |
| \GROUP_CURSOR\32763\1033 | D9F38 | 14 | D9F38 | 0000020001002000400001000100340100000300 | ...... .@.....4..... |
| \GROUP_CURSOR\32764\1033 | D9F4C | 14 | D9F4C | 0000020001002000400001000100340100000400 | ...... .@.....4..... |
| \GROUP_CURSOR\32765\1033 | D9F60 | 14 | D9F60 | 0000020001002000400001000100340100000500 | ...... .@.....4..... |
| \GROUP_CURSOR\32766\1033 | D9F74 | 14 | D9F74 | 0000020001002000400001000100340100000600 | ...... .@.....4..... |
| \GROUP_CURSOR\32767\1033 | D9F88 | 14 | D9F88 | 0000020001002000400001000100340100000700 | ...... .@.....4..... |
| \GROUP_ICON\MAINICON\1033 | D9F9C | 3E | D9F9C | 0000010004003030000001002000A825000001002020000001002000A8100000020018180000010020008809000003001010000001002000680400000400 | ......00.... ..%.... .... ............. ............. .h..... |
| \24\1\3073 | D9FDC | 351 | D9FDC | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • KERNEL32.dll • KERNEL32.DLL • kernel32.dll • oleaut32.dll • advapi32.dll • user32.dll • .bss • .tls • gdi32.dll • version.dll • ole32.dll • comctl32.dll • shell32.dll • CaptionLast Time Login • DEFAULT_CHARSET • \\.\rockey9x.vxd • \rockeynt.sys • \drivers\rockeynt.sys • Dump of file %s • Section Hex Dumps • USER32.DLL • COMCTL32.DLL • OLE32.DLL • dumpfile • IEXPLORE.EXE • EXPLORER.EXE • WINSCARD.DLL • IMAGEHLP.dll • GetProcAddressoleaut32.dll • SysFreeStringadvapi32.dll • GetKeyboardTypekernel32.dll • UnrealizeObjectversion.dll • _TrackMouseEventshell32.dll |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 2AF6 | D9FDC | .text | JMP [static] | Indirect jump to absolute memory address |
| 7352 | 58C52B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 319B9 | 58C52B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3DCAC | 5CA73E68 | .text | JMP [static] | Indirect jump to absolute memory address |
| 3EA74 | 65839057 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44E4C | 77B4246C | .text | CALL [static] | Indirect call to absolute memory address |
| 46FD3 | 77B4246C | .text | JMP [static] | Indirect jump to absolute memory address |
| 514BE | 77B4246C | .text | CALL [static] | Indirect call to absolute memory address |
| 53A8F | 14865AE4 | .text | CALL [static] | Indirect call to absolute memory address |
| 56335 | 6B749993 | .text | CALL [static] | Indirect call to absolute memory address |
| 60CCF | 7BDD4D29 | .text | CALL [static] | Indirect call to absolute memory address |
| 60F77 | 563E921F | .text | JMP [static] | Indirect jump to absolute memory address |
| 635E0 | 637AA38 | .text | JMP [static] | Indirect jump to absolute memory address |
| 67E2A | 637AA38 | .text | CALL [static] | Indirect call to absolute memory address |
| 6D422 | 637AA38 | .text | JMP [static] | Indirect jump to absolute memory address |
| 78A99 | A67F89E | .text | CALL [static] | Indirect call to absolute memory address |
| 82945 | A67F89E | .text | CALL [static] | Indirect call to absolute memory address |
| 99202 | 358B76D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 9CBE4 | 358B76D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 9E72D | 358B76D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 9FA12 | 4A52D91C | .text | JMP [static] | Indirect jump to absolute memory address |
| A080D | 4A52D91C | .text | JMP [static] | Indirect jump to absolute memory address |
| A75FE | FF | .itext | JMP [static] | Indirect jump to absolute memory address |
| E30B6 | 401000 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E30C0 | 401050 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E379B | 4DB150 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E38A3 | 4DB164 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E38EA | 4DB008 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E394F | 4DB018 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3967 | 4DB00C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E396E | 4DB010 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3975 | 4DB020 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E398A | 4DB0D8 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E39B5 | 4DB020 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3A0C | 4DB000 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3A1D | 4DB018 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3A2A | 4DB01C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3A3C | 4DB020 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3A43 | 4DB020 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3A4E | 4DB080 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3ACD | 4DB034 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3ADD | 4DB0A8 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3B84 | 4DB0D0 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E3BAE | 4DB06C | RY4SHL | JMP [static] | Indirect jump to absolute memory address |
| E3BB4 | 4DB070 | RY4SHL | JMP [static] | Indirect jump to absolute memory address |
| E3BBA | 4DB074 | RY4SHL | JMP [static] | Indirect jump to absolute memory address |
| E7B03 | 4DB18C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E7B12 | 4DB188 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E7B70 | 4DB188 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E7D4A | 4DB15C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E7D51 | 4DB084 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E7DD2 | 4DB154 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E7E34 | 4DB190 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E82A2 | 4DB164 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E82F9 | 4DB168 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E8435 | 4DB480 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E8793 | 4DB194 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E887C | 4DB198 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9112 | 4DB1A0 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E913A | 4DB19C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E914B | 4DB0CC | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9170 | 4DB1A4 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9193 | 4DB034 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E91A1 | 4DB1AC | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E91C5 | 4DB19C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E91D6 | 4DB0CC | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E91ED | 4DB1A8 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9210 | 4DB1AC | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9290 | 4DB19C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9421 | 4DB1B0 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E943C | 4DB1B8 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9452 | 4DB1BC | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9692 | 4DB194 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E96E9 | 4DB144 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E97FA | 4DB194 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E983B | 4DB144 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E989B | 4DB144 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9992 | 4DB140 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E99EF | 4FBCA4 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9A02 | 4DB08C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9A14 | 4DB08C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9A79 | 4DB174 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9B24 | 4DB134 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9B87 | 4DB138 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9B95 | 4DB134 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9BCC | 4DB13C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9BFA | 4DB1B4 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9D07 | 4DB14C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9F60 | 4DB124 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| E9FFF | 4DB12C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA012 | 4DB124 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA050 | 4DB130 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA06D | 4DB170 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA0AF | 4DB094 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA0E4 | 4DB11C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA144 | 4DB14C | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA1E9 | 4DB114 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA228 | 4DB118 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA2C2 | 4DB110 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| EA2D4 | 4DB118 | RY4SHL | CALL [static] | Indirect call to absolute memory address |
| A8000-B3FFF | A8000 | .data | Executable section anomaly, first bytes: 0000000000000000 |
| B4000-BAFFF | B4000 | .bss | Executable section anomaly, first bytes: 0000000000000000 |
| BB000-BDFFF | BB000 | .idata | Executable section anomaly, first bytes: 0000000000000000 |
| BE000-BEFFF | BE000 | .tls | Executable section anomaly, first bytes: 0000000000000000 |
| BF000-BFFFF | BF000 | .rdata | Executable section anomaly, first bytes: 00E04B0034E04B00 |
| C0000-CBFFF | C0000 | .reloc | Executable section anomaly, first bytes: 0000000000000000 |
| CC000-DAFFF | CC000 | .rsrc | Executable section anomaly, first bytes: 000000001AA2E54A |
| DB000-11DFFF | DB000 | RY4SHL | Executable section anomaly, first bytes: D6064A02E3064A02 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 695297 | 59,3532% |
| Null Byte Code | 170753 | 14,5761% |
| NOP Cave Found | 0x9090909090 | Block Count: 82 | Total: 0,0175% |
© 2026 All rights reserved.