PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 4,77 MB SHA-256 Hash: 20BFCF45AB4915606A37E28366F649B24D57CE7DAB100E0F95F10362C9E4A295 SHA-1 Hash: 8C48D6E38A9CE784D5FDC7CEAD415E64985E3B13 MD5 Hash: 9FDDE200ECA152AD7ED79F26084356D4 Imphash: 69182D872F9403C97C088BDBA03EAB01 MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 1D06F2 SizeOfHeaders: 1000 SizeOfImage: 4CD000 ImageBase: 10000000 Architecture: x86 ExportTable: 197B40 ImportTable: 1CC044 Characteristics: 2102 TimeDateStamp: 56D4EEFC Date: 01/03/2016 1:23:08 File Type: DLL Number Of Sections: 7 ASLR: Disabled Section Names: 0000001, 0000002, 0000003, .rsrc, 0000005, 0000006, 0000007 Number Of Executable Sections: 2 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| 0000001 | 0xE0000020 Code Executable Readable Writeable |
1000 | 112000 | 1000 | 112000 |
|
|
| 0000002 | 0xC0000040 Initialized Data Readable Writeable |
113000 | 86000 | 113000 | 86000 |
|
|
| 0000003 | 0xC0000040 Initialized Data Readable Writeable |
199000 | 7000 | 199000 | C5E8 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
1A0000 | 4000 | 1A6000 | 4000 |
|
|
| 0000005 | 0xC2000040 Initialized Data GP-Relative Readable Writeable |
1A4000 | 13000 | 1AA000 | 13000 |
|
|
| 0000006 | 0xC0000040 Initialized Data Readable Writeable |
1B7000 | D000 | 1BD000 | E6AC |
|
|
| 0000007 | 0xE0000020 Code Executable Readable Writeable |
1C4000 | 301000 | 1CC000 | 301000 |
|
|
| Description |
| OriginalFilename: nkcCore2.DLL LegalCopyright: Copyright (C) 2006 FileDescription: nkcCore2 DLL ProductVersion: 3. 0. 0. 6 Language: Japanese (Japan) (ID=0x411) CodePage: Unicode (UTF-16 LE) (0x4B0) Unusual Chars Found In Description File - (Polymorphic patterns or unicode characters) |
| Entry Point |
The section number (7) - (0000007) have the Entry Point Information -> EntryPoint (calculated) - 1C86F2 Code -> 558BEC81EC0C010000535657C78504FFFFFF00000000C745FC00000000C745EC00000000C745F800000000C78508FFFFFF00 EP changed to another address -> (Address Of EntryPoint > Base Of Data) Assembler |PUSH EBP |MOV EBP, ESP |SUB ESP, 0X10C |PUSH EBX |PUSH ESI |PUSH EDI |MOV DWORD PTR [EBP - 0XFC], 0 |MOV DWORD PTR [EBP - 4], 0 |MOV DWORD PTR [EBP - 0X14], 0 |MOV DWORD PTR [EBP - 8], 0 |
| Signatures |
| Rich Signature Analyzer: Code -> 9B2DBDA3DF4CD3F0DF4CD3F0DF4CD3F01C438CF0D84CD3F01C438EF0C84CD3F0DF4CD2F0294ED3F04888ADF0DB4CD3F0F88AAEF0C14CD3F0F88ABEF0604CD3F03753D9F0EB4CD3F0F88ABDF01A4CD3F0F88AA9F0DE4CD3F0F88AAFF0DE4CD3F0F88AABF0DE4CD3F052696368DF4CD3F0 Footprint md5 Hash -> 5F75AE5B96A257A527CDAEA975FDF66F • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual .NET - (You can use a decompiler for this...) • AnyCPU: False Compiler: Microsoft Visual C ++ Detect It Easy (die) • PE: compiler: Microsoft Visual C/C++(2005)[-] • PE: protection: Sentinel SuperPro dongle reference(-)[-] • PE: linker: Microsoft Linker(8.0 or 11.0)[-] • Entropy: 7.73608 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| Ws2_32.DLL | connect | Establish a connection to a specified socket. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| Windows REG |
| SOFTWARE\Noritsukoki\EZ Controller\InstallInfo SOFTWARE\NoritsuKoki\EZ Controller\InstallInfo SOFTWARE\Noritsukoki\NMPS\SettingModule\InstallInfo Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32 Software\Microsoft\Windows\CurrentVersion\Policies\Network Software\Microsoft\Windows\CurrentVersion\Policies\Explorer SOFTWARE\Microsoft\.NETFramework Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer - NoRun |
| File Access |
| WSOCK32.dll MSVCRT.dll WS2_32.dll OLEAUT32.dll ole32.dll SHLWAPI.dll SHELL32.dll ADVAPI32.dll comdlg32.dll GDI32.dll USER32.dll ?KERNEL32.dll KERNEL32.dll mscoree.dll nkcCore280.dll OLEACC.dll MSPDB80.DLL mscoree.dll mfcm80d.dll UxTheme.dll comdlg32.dll comctl32.dll %s%s.dll ntdll.dll nkcKey.dat .INI MSG_JAPANESE.ini MSG_ENGLISH.ini %s\Common\MSG_%s.INI wi.JsE Temp |
| File Access (UNICODE) |
| nkcCore2.DLL GetLastActivePopupGetActiveWindowMessageBoxWUSER32.DLL |
| Interest's Words |
| PADDINGX ToolBar PassWord exec attrib start ping openfiles replace |
| Interest's Words (UNICODE) |
| start expand |
| URLs |
| http://www.w3.org/XML/1998/namespace |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Hex | Hex Pattern | PEB AntiDebug (Flag BeingDebugged) |
| Text | Ascii | Antivirus Software (gdata) |
| Text | Ascii | Keyboard Key (LBUTTON) |
| Text | Ascii | Keyboard Key (MBUTTON) |
| Text | Ascii | Keyboard Key (RBUTTON) |
| Text | Ascii | Keyboard Key (Scroll) |
| Entry Point | Hex Pattern | Microsoft Visual C++ v7.0 |
| Entry Point | Hex Pattern | PE Pack v1.0 |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \CURSOR\1\1041 | 1A6A78 | 134 | 1A0A78 | 020002002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\2\1041 | 1A6BAC | B4 | 1A0BAC | 010001002800000010000000200000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(....... ..................................... |
| \CURSOR\3\1041 | 1A6C60 | 134 | 1A0C60 | 0F0014002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\4\1041 | 1A6D94 | 134 | 1A0D94 | 100008002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\5\1041 | 1A6EC8 | 134 | 1A0EC8 | 0A000E002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\6\1041 | 1A6FFC | 134 | 1A0FFC | 15000E002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\7\1041 | 1A7130 | 134 | 1A1130 | 0C0012002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\8\1041 | 1A7264 | 134 | 1A1264 | 140012002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\9\1041 | 1A7398 | 134 | 1A1398 | 0C000B002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\10\1041 | 1A74CC | 134 | 1A14CC | 13000A002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\11\1041 | 1A7600 | 134 | 1A1600 | 10000F002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\12\1041 | 1A7734 | 134 | 1A1734 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\13\1041 | 1A7868 | 134 | 1A1868 | 0F000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\14\1041 | 1A799C | 134 | 1A199C | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\15\1041 | 1A7AD0 | 134 | 1A1AD0 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\16\1041 | 1A7C04 | 134 | 1A1C04 | 10000F002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \BITMAP\30994\1041 | 1A7D38 | B8 | 1A1D38 | 280000000C0000000A0000000100040000000000500000000000000000000000000000000000000000000000000080000080 | (...................P............................. |
| \BITMAP\30996\1041 | 1A7DF0 | 144 | 1A1DF0 | 28000000210000000B0000000100040000000000DC0000000000000000000000000000000000000000000000000080000080 | (...!............................................. |
| \DIALOG\8000\0 | 1A7F34 | 112 | 1A1F34 | C000C0800000000005000000000018018C0000000000D130B930EF30FC30C9308D8AEF5300000C002DFF33FF200030FFB430 | .......................0.0.0.0.0...S....-.3. .0..0 |
| \DIALOG\8001\0 | 1A8048 | 1FA | 1A2048 | C000C080000000000A00000000001E018C0000000000AA30FC30CA30FC30D130B930EF30FC30C9302D8A9A5B00000C002DFF | .......................0.0.0.0.0.0.0.0.0-..[....-. |
| \DIALOG\30721\1041 | 1A8244 | E8 | 1A2244 | C400C88000000000050009001A00B700460000000000B0658F89000008004D00530020005300680065006C006C0020004400 | ................F......e......M.S. .S.h.e.l.l. .D. |
| \DIALOG\30734\1041 | 1A832C | 34 | 1A232C | C800C88000000000000009001A00B700460000000000000008004D00530020005300680065006C006C00200044006C0067000000 | ................F.........M.S. .S.h.e.l.l. .D.l.g... |
| \STRING\3841\1041 | 1A8360 | 62 | 1A2360 | 02008B954F3008000D544D529230D84E51306630DD4F585B0E005930793066306E30D530A130A430EB30200028002A002E002A002900020021714C9800000000070021714C986E30D530A130A430EB30000000000000000000000000000000000000 | ....O0...TMR.0.NQ0f0.OX[..Y0y0f0n0.0.0.0.0 .(.*...*.)...!qL.......!qL.n0.0.0.0.0.................. |
| \STRING\3842\1041 | 1A83C4 | 2E | 1A23C4 | 000007005E9768883A79280026004800290000000000000000000000000000000000000000000000000000000000 | .....h.:y(.&.H.)............................. |
| \STRING\3843\1041 | 1A83F4 | DC | 1A23F4 | 1000A830E930FC302000E130C330BB30FC30B8306F3042308A307E305B30933002301400B530DD30FC30C83055308C306630 | ...0.0.0 ..0.0.0.0.0o0B0.0~0[0.0.0...0.0.0.0U0.0f0 |
| \STRING\3857\1041 | 1A84D0 | 34A | 1A24D0 | 0B002171B9526A30D530A130A430EB300D546730593002301300C930AD30E530E130F330C83092308B954F30533068306B30 | ..!q.Rj0.0.0.0.0.Tg0Y0.0...0.0.0.0.0.0.0..O0S0h0k0 |
| \STRING\3858\1041 | 1A881C | 1BC | 1A281C | 0C0074657065923065519B52573066304F3060305530443002300C007065575B923065519B52573066304F30603055304430 | ..tepe.0eQ.RW0f0O00U0D0.0..peW[.0eQ.RW0f0O00U0D0 |
| \STRING\3859\1041 | 1A89D8 | 18E | 1A29D8 | 0E00884E1F6757306A304430D530A130A430EB30625F0F5F6730593002302B00250031000A0053306E30D530A130A430EB30 | ...N.gW0j0D0.0.0.0.0b_._g0Y0.0+.%.1...S0n0.0.0.0.0 |
| \STRING\3860\1041 | 1A8B68 | 74 | 1A2B68 | 1C00250031003A002000250032000A0043006F006E00740069006E0075006500B930AF30EA30D730C83092309F5B4C882D4E | ..%.1.:. .%.2...C.o.n.t.i.n.u.e..0.0.0.0.0.0.[L.-N |
| \STRING\3865\1041 | 1A8BDC | 76 | 1A2BDC | 0000000000000000000000000000000000000000000000001600F8664D30BC8F7F30025C2875D730ED30D130C630A3304B30 | ...........................fM0...0.\(u.0.0.0.0.0K0 |
| \STRING\3866\1041 | 1A8C54 | 8E | 1A2C54 | 1600E130FC30EB302000B730B930C630E0302000B530DD30FC30C8309230AD8A7F30BC8F81307E305B30933002301300E130 | ...0.0.0 ..0.0.0.0 ..0.0.0.0.0...0...0~0[0.0.0...0 |
| \STRING\3867\1041 | 1A8CE4 | 2DC | 1A2CE4 | 0D00A830E930FC306F3042308A307E305B309330673057305F300230190025003100200078306E30A230AF30BB30B9302D4E | ...0.0.0o0B0.0~0[0.0g0W0_0.0..%.1. .x0n0.0.0.0.0-N |
| \STRING\3868\1041 | 1A8FC0 | 160 | 1A2FC0 | 0D00A830E930FC306F3042308A307E305B309330673057305F300230190025003100200078306E30A230AF30BB30B9302D4E | ...0.0.0o0B0.0~0[0.0g0W0_0.0..%.1. .x0n0.0.0.0.0-N |
| \STRING\3869\1041 | 1A9120 | 28 | 1A3120 | 0400D430AF30BB30EB30000000000000000000000000000000000000000000000000000000000000 | ...0.0.0.0.............................. |
| \STRING\3887\1041 | 1A9148 | 2C | 1A3148 | 00000200AA30D5300200AA30F3300200F76D0854000000000000000000000000000000000000000000000000 | .....0.0...0.0...m.T........................ |
| \GROUP_CURSOR\30977\1041 | 1A9174 | 22 | 1A3174 | 00000200020020004000010001003401000001001000200001000100B40000000200 | ...... .@.....4....... ........... |
| \GROUP_CURSOR\30998\1041 | 1A9198 | 14 | 1A3198 | 0000020001002000400001000100340100000800 | ...... .@.....4..... |
| \GROUP_CURSOR\30999\1041 | 1A91AC | 14 | 1A31AC | 0000020001002000400001000100340100000300 | ...... .@.....4..... |
| \GROUP_CURSOR\31000\1041 | 1A91C0 | 14 | 1A31C0 | 0000020001002000400001000100340100000700 | ...... .@.....4..... |
| \GROUP_CURSOR\31001\1041 | 1A91D4 | 14 | 1A31D4 | 0000020001002000400001000100340100000600 | ...... .@.....4..... |
| \GROUP_CURSOR\31002\1041 | 1A91E8 | 14 | 1A31E8 | 0000020001002000400001000100340100000D00 | ...... .@.....4..... |
| \GROUP_CURSOR\31003\1041 | 1A91FC | 14 | 1A31FC | 0000020001002000400001000100340100000500 | ...... .@.....4..... |
| \GROUP_CURSOR\31004\1041 | 1A9210 | 14 | 1A3210 | 0000020001002000400001000100340100000A00 | ...... .@.....4..... |
| \GROUP_CURSOR\31005\1041 | 1A9224 | 14 | 1A3224 | 0000020001002000400001000100340100000400 | ...... .@.....4..... |
| \GROUP_CURSOR\31006\1041 | 1A9238 | 14 | 1A3238 | 0000020001002000400001000100340100000900 | ...... .@.....4..... |
| \GROUP_CURSOR\31007\1041 | 1A924C | 14 | 1A324C | 0000020001002000400001000100340100000B00 | ...... .@.....4..... |
| \GROUP_CURSOR\31008\1041 | 1A9260 | 14 | 1A3260 | 0000020001002000400001000100340100000C00 | ...... .@.....4..... |
| \GROUP_CURSOR\31009\1041 | 1A9274 | 14 | 1A3274 | 0000020001002000400001000100340100000E00 | ...... .@.....4..... |
| \GROUP_CURSOR\31010\1041 | 1A9288 | 14 | 1A3288 | 0000020001002000400001000100340100000F00 | ...... .@.....4..... |
| \GROUP_CURSOR\31011\1041 | 1A929C | 14 | 1A329C | 0000020001002000400001000100340100001000 | ...... .@.....4..... |
| \VERSION\1\1041 | 1A92B0 | 350 | 1A32B0 | 500334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | P.4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\2\1033 | 1A9600 | 56 | 1A3600 | 3C617373656D626C7920786D6C6E733D2275726E3A736368656D61732D6D6963726F736F66742D636F6D3A61736D2E763122206D616E696665737456657273696F6E3D22312E30223E0D0A3C2F617373656D626C793E | <assembly xmlns="urn:schemas-microsoft-com:asm.v1" manifestVersion="1.0">..</assembly> |
| Intelligent String |
| • MSVCRT.dll • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlwin.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcom.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\allocate.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atltime.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atlbase.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atldebugapi.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\output.c • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtempl.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmini.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olereg.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\barcool.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl6.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bardock.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\doccore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dockcont.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\tooltip.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl2.cpp • KERNEL32.DLL • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\ccdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oledisp2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olefact.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filest.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\docmgr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\doctempl.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filelist.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui3.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winbtn.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\trckrect.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\bartool.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgprop.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcomm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_ss.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\elements.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afx.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_so.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_sp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wo.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pw.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_wp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_s.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_o.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_p.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_u.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_d.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_w.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\array_b.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcobj.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtrace.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arccore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olevar.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olecnvrt.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oleunk.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\map_pp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpcont.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgtempl.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl3.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winctrl1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\list_p.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\objcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlbase.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winmenu.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\apphelp.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winutil.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdi.cpp • GDI32.DLL • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appinit.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winhand.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxtls.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxstate.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filecore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui1.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appui2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\thrdcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winstr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\cmdtarg.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wincore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\except.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olemisc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winocc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgdata.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dllmodul.cpp • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\cstringt.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlexcept.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlsimpstr.h • %s\Common\MSG_%s.INI • .\nkcCore2.cpp • nkcKey.dat • MSG_ENGLISH.iniMSG_JAPANESE.ini • .\nkcCore2KeyCheck.cpp • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlconv.h • C:\Program Files (x86)\Microsoft Visual Studio 8\VC\atlmfc\include\atlalloc.h • http://www.w3.org/XML/1998/namespace • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpstr.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlalloc.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomcli.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\cstringt.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlconv.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxtls_.hf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\strcore.cpp • hhctrl.ocx • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcomctl32.hInitCommonControls • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afximpl.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcoll.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxdlgs.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxext.inl • kernel32.dll • ntdll.dll • %s%s.dll • <comctl32.dll • ;<comdlg32.dll • user32.dll • .CHM • .HLP • .INI • CDumpContext • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\afxcrit.cpp • Unable to dump object in static release builds • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxole.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcommem.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcomtime.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cpp m_cause = • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppCArchive exception: %hs. • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppf:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcex.cppCArchiveException • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\olelock.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cppm_cause = • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\filex.cppUnknownCFile exception: %hs, File %s, OS error information = %ld. • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgfile.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\barcore.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\appdlg.cpp • :%df:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxpriv.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\fixalloc.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\wingdix.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\plex.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\arcstrm.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpout.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dlgclr.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn.inl • f:\dd\vctools\vc7libs\ship\atlmfc\include\afxcmn2.inl • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\timecore.cpp • CLSID\%1\InprocHandler32ole32.dll • mscoree.dllfaulted while dumping object at $%p, %u bytes long • faulted while dumping object at $%p, %u bytes long • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\dumpinit.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\winfrm2.cpp • f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\oletyplb.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\dbgrpt.c • f:\dd\vctools\crt_bld\self_x86\crt\src\vsprintf.c • Object dump complete. • File Error(%d) : Dumping objects -> • _CrtMemDumpStatistics • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcscpy_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\malloc.h • f:\dd\vctools\crt_bld\self_x86\crt\src\sscanf.c • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcsncpy_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tcscat_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tsplitpath_s.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\tmakepath_s.inl • f:\dd\vctools\crt_bld\self_x86\crt\src\mbscspn.c • f:\dd\vctools\crt_bld\self_x86\crt\src\crtmbox.c • ftypname.cpp • f:\dd\vctools\crt_bld\self_x86\crt\src\input.c • F:\dd\vctools\crt_bld\SELF_X86\crt\src\ungetc_nolock.inl • F:\dd\vctools\crt_bld\SELF_X86\crt\src\mbsncpy_s.inl • f:\dd\vctools\crt_bld\self_x86\crt\src\vswprint.c • f:\dd\vctools\crt_bld\self_x86\crt\src\xtoa.c • tzset.cTZ • ../include\strgtold12.inl • f:\dd\vctools\crt_bld\self_x86\crt\src\_flsbuf.c • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlsimpcoll.h • f:\dd\vctools\vc7libs\ship\atlmfc\include\atlcore.h • f:\dd\vctools\vc7libs\ship\atlmfc\src\atl\atls\atltracemodulemanager.h • OLEACC.dll • ]n.bKM • ?KERNEL32.dll • USER32.dll • GDI32.dll • comdlg32.dll • WINSPOOL.DRV • ADVAPI32.dll • SHELL32.dll • SHLWAPI.dll • ole32.dll • OLEAUT32.dll • WS2_32.dll • WSOCK32.dll |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 2F65 | 1A9600 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 5347 | 4C0A45C8 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| C441 | 4C0A45C8 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 175CE | 4C0A45C8 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 1B8B7 | 67B4E711 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 20FCB | 7CA6AAC8 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 25420 | 6E6D7CDC | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 2B3D6 | 24724D84 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 2E972 | 4CB336C0 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 37342 | 4CB336C0 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 3FCFD | 4CB336C0 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 425DB | A9CE4EE | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 4AFBD | A9CE4EE | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 4B9E7 | A9CE4EE | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 509C2 | 431107FE | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 52B61 | 431107FE | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 54584 | 431107FE | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 6B9F6 | 431107FE | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 6BAE6 | 1A01F2D | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 7036C | 1A01F2D | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 76A81 | 38AB290E | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 82DA2 | 38AB290E | 0000001 | CALL [static] | Indirect call to absolute memory address |
| 95632 | 38AB290E | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 9D2FA | 38AB290E | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| B1CE1 | 38AB290E | 0000001 | CALL [static] | Indirect call to absolute memory address |
| B73BD | 797DD880 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| BDC21 | 797DD880 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| C7EA3 | 797DD880 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| C80C3 | 73B25CAD | 0000001 | CALL [static] | Indirect call to absolute memory address |
| CB48E | 73B25CAD | 0000001 | CALL [static] | Indirect call to absolute memory address |
| CB4A6 | 277CED5 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| CD52E | 277CED5 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| D3AA6 | 277CED5 | 0000001 | CALL [static] | Indirect call to absolute memory address |
| D5276 | 277CED5 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| DB54A | 267FB226 | 0000001 | JMP [static] | Indirect jump to absolute memory address |
| 18F2A7 | 221010EB | 0000002 | CALL [static] | Indirect call to absolute memory address |
| 18FDC3 | 1100781 | 0000002 | CALL [static] | Indirect call to absolute memory address |
| 190E0B | 101102 | 0000002 | CALL [static] | Indirect call to absolute memory address |
| 1949D8 | 2E006E81 | 0000002 | CALL [static] | Indirect call to absolute memory address |
| 1A0FFB | 28000E00 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 1B8E01 | 3ED18D62 | 0000006 | JMP [static] | Indirect jump to absolute memory address |
| 1CB531 | F000063 | 0000007 | JMP [static] | Indirect jump to absolute memory address |
| 1CB782 | 7F000075 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CB78E | F000075 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC267 | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC292 | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC2CC | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC342 | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC3D0 | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC448 | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC4DD | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC55D | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CC5CA | 101CB378 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CCB7B | 101C9BE0 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD014 | 101CB658 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD064 | 101CB6A8 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD07F | 101CB658 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD0D3 | 101CB65C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD650 | 101CC02C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD676 | 101CC014 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD68B | 101CC02C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD6A9 | 101CC014 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CD6B7 | 101CC030 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CDE2E | 101CC004 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CDE9F | 101CC000 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CDED3 | 101CC008 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1CDEE7 | 101CC008 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D2D52 | 101CC01C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D2E5A | 101CC01C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D2F3A | 101CC01C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D3015 | 101CC01C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D311D | 101CC01C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D3170 | 101CC004 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D319D | 101CC038 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D31B7 | 101CC018 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1D75FA | 101CC010 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1DE33C | 101CC038 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1E4B06 | 101CC03C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1E5FB9 | 101CC020 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1E6546 | 101CC01C | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1E656E | 101CC018 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1E6594 | 101CC018 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1E65A1 | 101CC018 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1F0CED | 101CC018 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 20573C | 101CC018 | 0000007 | JMP [static] | Indirect jump to absolute memory address |
| 226342 | 101CC018 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 227C8E | 713AE072 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 232452 | 713AE072 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 2453EF | 713AE072 | 0000007 | JMP [static] | Indirect jump to absolute memory address |
| 247EC7 | 713AE072 | 0000007 | JMP [static] | Indirect jump to absolute memory address |
| 249CAC | 713AE072 | 0000007 | JMP [static] | Indirect jump to absolute memory address |
| 24CAF4 | 37AB5205 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 257E96 | B6FBCA6 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 265E78 | B6FBCA6 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 26F322 | 8139BC0 | 0000007 | JMP [static] | Indirect jump to absolute memory address |
| 284146 | 599ED02F | 0000007 | JMP [static] | Indirect jump to absolute memory address |
| 286112 | 599ED02F | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 28B7AD | 599ED02F | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 296E1A | 599ED02F | 0000007 | JMP [static] | Indirect jump to absolute memory address |
| 2A66EE | 6DC3A5E7 | 0000007 | CALL [static] | Indirect call to absolute memory address |
| 1C9350-1C9360 | N/A | 0000007 | Potential obfuscated jump sequence detected, count: 7 |
| 1CBE2B-1CBE3B | N/A | 0000007 | Potential obfuscated jump sequence detected, count: 7 |
| 1CCE67-1CCE77 | N/A | 0000007 | Potential obfuscated jump sequence detected, count: 7 |
| 1D9470-1D9483 | N/A | 0000007 | Potential obfuscated jump sequence detected, count: 8 |
| 1DD323-1DD33A | N/A | 0000007 | Potential obfuscated jump sequence detected, count: 9 |
| 1E01AF-1E01C1 | N/A | 0000007 | Potential obfuscated jump sequence detected, count: 8 |
| 1000-112FFF | 1000 | 0000001 | Executable section anomaly, first bytes: D0B6AD23F5261100 |
| 1C4000-4C4FFF | 1CC000 | 0000007 | Executable section anomaly, first bytes: A0C11C00B4C11C00 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 3321754 | 66,4189% |
| Null Byte Code | 371331 | 7,4248% |
| NOP Cave Found | 0x9090909090 | Block Count: 6 | Total: 0,0003% |
© 2026 All rights reserved.