PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,51 MBSHA-256 Hash: 62ED1C21A6A22EA2A35625659D6A208C8028C009B876E08E8915283B9C578FF3 SHA-1 Hash: 917FCCA0400A24A13BD27CE1E84F597BBA0867A4 MD5 Hash: A38781AE371AB82A4A749E14BA04BE3F Imphash: D42595B695FC008EF2C56AABD8EFD68E MajorOSVersion: 6 MinorOSVersion: 1 CheckSum: 0028E870 EntryPoint (rva): 73600 SizeOfHeaders: 600 SizeOfImage: 2D0000 ImageBase: 0000000140000000 Architecture: x64 ImportTable: 2A3000 IAT: 2431A0 Characteristics: 22 TimeDateStamp: 0 Date: 01/01/1970 File Type: EXE Number Of Sections: 9 ASLR: Disabled Section Names (Optional Header): .text, .rdata, .data, .pdata, .xdata, .idata, .reloc, .symtab, .rsrc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
600 | FA800 | 1000 | FA6B1 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
FAE00 | 146800 | FC000 | 1466C8 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
241600 | F600 | 243000 | 589C8 |
|
|
| .pdata | 0x40000040 Initialized Data Readable |
250C00 | 5200 | 29C000 | 50F4 |
|
|
| .xdata | 0x40000040 Initialized Data Readable |
255E00 | 200 | 2A2000 | B4 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
256000 | 600 | 2A3000 | 53E |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
256600 | 4400 | 2A4000 | 421C |
|
|
| .symtab | 0x42000000 GP-Relative Readable |
25AA00 | 1C800 | 2A9000 | 1C757 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
277200 | A000 | 2C6000 | 9F74 |
|
|
| Entry Point |
The section number (1) have the Entry Point Information -> EntryPoint (calculated) - 72C00 Code -> E9FBC6FFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCCC554889E59CFC4881ECE000000048893C2448 Assembler |JMP 0X14006FD00 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |INT3 |PUSH RBP |MOV RBP, RSP |PUSHFQ |CLD |SUB RSP, 0XE0 |MOV QWORD PTR [RSP], RDI |
| Packer/Compiler |
| Detect It Easy (die) • PE+(64): compiler: Go(1.15.0-X.XX.X) • PE+(64): Sign tool: Windows Authenticode(2.0)[PKCS 7] • Entropy: 6.22691 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| Ws2_32.DLL | socket | Create a communication endpoint for networking applications. |
| File Access |
| os.Exe internal/poll.exe kernel32.dll seconds/godebug/non-default-behavior/bcryptprimitives.dll itab.sys time.Dat time.absDays.dat internal/abi.Name.Dat @.dat main.ini internal/poll.Ini internal/syscall/windows.ini fmt.ini os.ini io/fs.ini time.ini time.map.ini internal/syscall/windows/registry.ini internal/godebug.ini reflect.ini math.ini iter.ini unicode.ini errors.ini sync.ini internal/syscall/windows/sysdll.ini internal/bytealg.ini internal/cpu.Ini Temp WinDir SysDir UserProfile |
| File Access (UNICODE) |
| bcryptprimitives.dll powrprof.dll winmm.dll ntdll.dll |
| Interest's Words |
| zombie exec netsh attrib start pause shutdown systeminfo ping expand replace route |
| Anti-VM/Sandbox/Debug Tricks |
| LabTools - procexp |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (WSACleanup) |
| Text | Ascii | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (listen) |
| Text | Ascii | WinAPI Sockets (accept) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | WinAPI Sockets (recv) |
| Text | Ascii | WinAPI Sockets (send) |
| Text | Ascii | Registry (RegCreateKeyEx) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | Registry (RegSetValueEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Service (OpenSCManager) |
| Text | Ascii | Encryption API (CryptAcquireContext) |
| Text | Ascii | Encryption API (CryptReleaseContext) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Anti-Analysis VM (CreateToolhelp32Snapshot) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindNextFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (GetThreadContext) |
| Text | Ascii | Stealth (SetThreadContext) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (UnmapViewOfFile) |
| Text | Ascii | Stealth (MapViewOfFile) |
| Text | Ascii | Stealth (CreateFileMappingW) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Ascii | Execution (CreateProcessA) |
| Text | Ascii | Execution (CreateProcessW) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (CreateEventA) |
| Text | Ascii | Execution (CreateEventW) |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (DLL) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\1\1033 | 2C6190 | 333 | 277390 | 89504E470D0A1A0A0000000D49484452000000100000001008060000001FF3FF61000002FA49444154789C85934B6C556514 | .PNG........IHDR................a....IDATx...KlUe. |
| \ICON\2\1033 | 2C64C4 | 7A2 | 2776C4 | 89504E470D0A1A0A0000000D4948445200000020000000200806000000737A7AF40000076949444154789CAD977F8C5C5515 | .PNG........IHDR... ... .....szz....iIDATx.....\U. |
| \ICON\3\1033 | 2C6C68 | C8B | 277E68 | 89504E470D0A1A0A0000000D49484452000000300000003008060000005702F98700000C5249444154789CB55A7D705CD575 | .PNG........IHDR...0...0.....W......RIDATx..Z}p\.u |
| \ICON\4\1033 | 2C78F4 | 1157 | 278AF4 | 89504E470D0A1A0A0000000D4948445200000040000000400806000000AA6971DE0000111E49444154789CED5B7B905C5599 | .PNG........IHDR...@...@......iq.....IDATx..[{.\U. |
| \ICON\5\1033 | 2C8A4C | 244B | 279C4C | 89504E470D0A1A0A0000000D4948445200000080000000800806000000C33E61CB0000241249444154789CED7D799C55C595 | .PNG........IHDR..............>a...$.IDATx..}y.U.. |
| \ICON\6\1033 | 2CAE98 | 507F | 27C098 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A8660000504649444154789CEDBD79985D5595 | .PNG........IHDR.............\r.f..PFIDATx...y.]U. |
| \GROUP_ICON\1\1033 | 2CFF18 | 5A | 281118 | 00000100060010100000000020003303000001002020000000002000A2070000020030300000000020008B0C00000300404000000000200057110000040080800000000020004B240000050000000000000020007F5000000600 | ............ .3..... .... .......00.... .......@@.... .W........... .K$.......... ..P.... |
| Intelligent String |
| • ntdll.dll • winmm.dll • powrprof.dll • bcryptprimitives.dll • kernel32.dll • io.EOF |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| D155 | N/A | .text | JMP QWORD PTR [RIP+0xE8840F] |
| 37663 | N/A | .text | JMP QWORD PTR [RIP+0x8B4D6500] |
| ABE8B | N/A | .text | JMP QWORD PTR [RIP+0xFFF826E9] |
| E1396 | N/A | .text | JMP QWORD PTR [RIP+0x7BF0004] |
| 114847 | N/A | .rdata | CALL QWORD PTR [RIP+0xFF000001] |
| 1180E7 | N/A | .rdata | JMP QWORD PTR [RIP+0x40000030] |
| 1181A7 | N/A | .rdata | CALL QWORD PTR [RIP+0xFF000035] |
| 121B87 | N/A | .rdata | CALL QWORD PTR [RIP+0xFF000017] |
| 1229C7 | N/A | .rdata | CALL QWORD PTR [RIP+0xFF000017] |
| 134181 | N/A | .rdata | CALL QWORD PTR [RIP+0x10] |
| 134187 | N/A | .rdata | CALL QWORD PTR [RIP+0x0] |
| 17DD0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF91327A1] |
| 17FD0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF81327A1] |
| 18120B | N/A | .rdata | CALL QWORD PTR [RIP+0xF91327A1] |
| 181DD0 | N/A | .rdata | CALL QWORD PTR [RIP+0x19DC37CB] |
| 182C0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF71327A1] |
| 182D0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF91327A1] |
| 18310B | N/A | .rdata | CALL QWORD PTR [RIP+0xC31324A1] |
| 18330B | N/A | .rdata | CALL QWORD PTR [RIP+0xDD1324A1] |
| 18340B | N/A | .rdata | CALL QWORD PTR [RIP+0x83D45A1] |
| 18560B | N/A | .rdata | CALL QWORD PTR [RIP+0xF91327A1] |
| 18610B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 186C0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 18700B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 187A0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 18860B | N/A | .rdata | CALL QWORD PTR [RIP+0x3A9340A1] |
| 18910B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 18970B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 18A30B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 18A70B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 18C60B | N/A | .rdata | CALL QWORD PTR [RIP+0x1D1327A0] |
| 18C766 | N/A | .rdata | CALL QWORD PTR [RIP+0xD070568E] |
| 18EF0B | N/A | .rdata | JMP QWORD PTR [RIP+0xB18B29A1] |
| 18F0D3 | N/A | .rdata | JMP QWORD PTR [RIP+0x8D6CBA00] |
| 18FA0B | N/A | .rdata | CALL QWORD PTR [RIP+0x3E0E67A1] |
| 191D0B | N/A | .rdata | JMP QWORD PTR [RIP+0xB08B27A1] |
| 192A0B | N/A | .rdata | CALL QWORD PTR [RIP+0x1D1324B2] |
| 192E0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 19390B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 193D0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 193E0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 19410B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 19490B | N/A | .rdata | CALL QWORD PTR [RIP+0x1C1248B2] |
| 19540B | N/A | .rdata | CALL QWORD PTR [RIP+0x612FABA6] |
| 19550B | N/A | .rdata | CALL QWORD PTR [RIP+0x612FABA6] |
| 1978DB | N/A | .rdata | JMP QWORD PTR [RIP+0x7E635011] |
| 197B0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 19ABD3 | N/A | .rdata | JMP QWORD PTR [RIP+0x8D6CB900] |
| 19AD0B | N/A | .rdata | CALL QWORD PTR [RIP+0xFFCC276F] |
| 19B40B | N/A | .rdata | CALL QWORD PTR [RIP+0xFDCC27CF] |
| 19B70B | N/A | .rdata | JMP QWORD PTR [RIP+0xB08B27A1] |
| 19C70B | N/A | .rdata | CALL QWORD PTR [RIP+0x591327A1] |
| 19D30B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 19ED0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 19F10B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 19F9D3 | N/A | .rdata | JMP QWORD PTR [RIP+0x41EB2FE6] |
| 19FE0B | N/A | .rdata | CALL QWORD PTR [RIP+0x7C132569] |
| 1A02D3 | N/A | .rdata | JMP QWORD PTR [RIP+0x8D6CB900] |
| 1A090B | N/A | .rdata | JMP QWORD PTR [RIP+0xB08B27A1] |
| 1A110B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1A114B | N/A | .rdata | CALL QWORD PTR [RIP+0x7DEF2BA4] |
| 1A2B0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1A3C0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1A3F0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1A670B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1A760B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1A7F0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1A840B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1AA3D3 | N/A | .rdata | JMP QWORD PTR [RIP+0x899B42E0] |
| 1AA50B | N/A | .rdata | JMP QWORD PTR [RIP+0xB18BEBA1] |
| 1AA5C3 | N/A | .rdata | CALL QWORD PTR [RIP+0xADFCC870] |
| 1AC60B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1ACB0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1AD60B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1AE00B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1AE10B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1AF70B | N/A | .rdata | CALL QWORD PTR [RIP+0xC59340A1] |
| 1B040B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1B230B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1B280B | N/A | .rdata | CALL QWORD PTR [RIP+0xF613ABA1] |
| 1B290B | N/A | .rdata | CALL QWORD PTR [RIP+0xF91327A1] |
| 1B2B0B | N/A | .rdata | CALL QWORD PTR [RIP+0xF91327A1] |
| 1B2C0B | N/A | .rdata | CALL QWORD PTR [RIP+0xB91327A1] |
| 1C7E4F | N/A | .rdata | JMP QWORD PTR [RIP+0x7200000A] |
| 1DBFF2 | N/A | .rdata | CALL QWORD PTR [RIP+0x1016840F] |
| 234917 | IAT 0 | .rdata | CALL QWORD PTR [RIP+0x0] |
| 236C6F | IAT 0 | .rdata | JMP QWORD PTR [RIP+0xC200001C] |
| 27F296 | IAT 0 | .rsrc | JMP QWORD PTR [RIP+0xDADCF434] |
| 74622-74720 | N/A | .text | Potential obfuscated jump sequence detected, count: 51 |
| 681-69F | N/A | .text | Unusual BP Cave, count: 31 |
| 2362-237F | N/A | .text | Unusual BP Cave, count: 30 |
| EE62-EE7F | N/A | .text | Unusual BP Cave, count: 30 |
| 10562-1057F | N/A | .text | Unusual BP Cave, count: 30 |
| 135A2-135BF | N/A | .text | Unusual BP Cave, count: 30 |
| 13CE1-13CFF | N/A | .text | Unusual BP Cave, count: 31 |
| 147E1-147FF | N/A | .text | Unusual BP Cave, count: 31 |
| 148C1-148DF | N/A | .text | Unusual BP Cave, count: 31 |
| 157E2-157FF | N/A | .text | Unusual BP Cave, count: 30 |
| 17C42-17C5F | N/A | .text | Unusual BP Cave, count: 30 |
| 1B9E2-1B9FF | N/A | .text | Unusual BP Cave, count: 30 |
| 1BFC2-1BFDF | N/A | .text | Unusual BP Cave, count: 30 |
| 1D142-1D15F | N/A | .text | Unusual BP Cave, count: 30 |
| 20362-2037F | N/A | .text | Unusual BP Cave, count: 30 |
| 22142-2215F | N/A | .text | Unusual BP Cave, count: 30 |
| 24C62-24C7F | N/A | .text | Unusual BP Cave, count: 30 |
| 32F82-32F9F | N/A | .text | Unusual BP Cave, count: 30 |
| 33E81-33E9F | N/A | .text | Unusual BP Cave, count: 31 |
| 37721-3773F | N/A | .text | Unusual BP Cave, count: 31 |
| 377A1-377BF | N/A | .text | Unusual BP Cave, count: 31 |
| 37821-3783F | N/A | .text | Unusual BP Cave, count: 31 |
| 378A1-378BF | N/A | .text | Unusual BP Cave, count: 31 |
| 37921-3793F | N/A | .text | Unusual BP Cave, count: 31 |
| 379A1-379BF | N/A | .text | Unusual BP Cave, count: 31 |
| 37A21-37A3F | N/A | .text | Unusual BP Cave, count: 31 |
| 37AA1-37ABF | N/A | .text | Unusual BP Cave, count: 31 |
| 3AEA2-3AEBF | N/A | .text | Unusual BP Cave, count: 30 |
| 3D0A2-3D0BF | N/A | .text | Unusual BP Cave, count: 30 |
| 3D9C1-3D9DF | N/A | .text | Unusual BP Cave, count: 31 |
| 3DA01-3DA1F | N/A | .text | Unusual BP Cave, count: 31 |
| 46F62-46F7F | N/A | .text | Unusual BP Cave, count: 30 |
| 4CC42-4CC5F | N/A | .text | Unusual BP Cave, count: 30 |
| 4FA01-4FA1F | N/A | .text | Unusual BP Cave, count: 31 |
| 50081-5009F | N/A | .text | Unusual BP Cave, count: 31 |
| 54561-5457F | N/A | .text | Unusual BP Cave, count: 31 |
| 55EC2-55EDF | N/A | .text | Unusual BP Cave, count: 30 |
| 56682-5669F | N/A | .text | Unusual BP Cave, count: 30 |
| 59782-5979F | N/A | .text | Unusual BP Cave, count: 30 |
| 59FA2-59FBF | N/A | .text | Unusual BP Cave, count: 30 |
| 5AF62-5AF7F | N/A | .text | Unusual BP Cave, count: 30 |
| 5FFA1-5FFBF | N/A | .text | Unusual BP Cave, count: 31 |
| 60322-6033F | N/A | .text | Unusual BP Cave, count: 30 |
| 61F42-61F5F | N/A | .text | Unusual BP Cave, count: 30 |
| 636E2-636FF | N/A | .text | Unusual BP Cave, count: 30 |
| 68781-6879F | N/A | .text | Unusual BP Cave, count: 31 |
| 693E2-693FF | N/A | .text | Unusual BP Cave, count: 30 |
| 69F62-69F7F | N/A | .text | Unusual BP Cave, count: 30 |
| 6CE01-6CE1F | N/A | .text | Unusual BP Cave, count: 31 |
| 6E601-6E61F | N/A | .text | Unusual BP Cave, count: 31 |
| 6F4C1-6F4DF | N/A | .text | Unusual BP Cave, count: 31 |
| 6F6E2-6F6FF | N/A | .text | Unusual BP Cave, count: 30 |
| 711A1-711BF | N/A | .text | Unusual BP Cave, count: 31 |
| 71402-7141F | N/A | .text | Unusual BP Cave, count: 30 |
| 72021-7203F | N/A | .text | Unusual BP Cave, count: 31 |
| 75DC2-75DDF | N/A | .text | Unusual BP Cave, count: 30 |
| 75E42-75E5F | N/A | .text | Unusual BP Cave, count: 30 |
| 767A1-767BF | N/A | .text | Unusual BP Cave, count: 31 |
| 79F81-79F9F | N/A | .text | Unusual BP Cave, count: 31 |
| 7AC81-7AC9F | N/A | .text | Unusual BP Cave, count: 31 |
| 7B3C2-7B3DF | N/A | .text | Unusual BP Cave, count: 30 |
| 80E02-80E1F | N/A | .text | Unusual BP Cave, count: 30 |
| 80EA2-80EBF | N/A | .text | Unusual BP Cave, count: 30 |
| 8BD22-8BD3F | N/A | .text | Unusual BP Cave, count: 30 |
| 8D3E2-8D3FF | N/A | .text | Unusual BP Cave, count: 30 |
| 92021-9203F | N/A | .text | Unusual BP Cave, count: 31 |
| 92F82-92F9F | N/A | .text | Unusual BP Cave, count: 30 |
| A2902-A291F | N/A | .text | Unusual BP Cave, count: 30 |
| A2FA1-A2FBF | N/A | .text | Unusual BP Cave, count: 31 |
| FAC6D-FACB0 | N/A | .text | Unusual BP Cave, count: 68 |
| 72C00 | 14006FD00 | .text | Possible Original Entry Point Relocation | Score=3/7 - Redirects=1 - PreJumpInstructions=0 - JumpType=JMP_NEAR - TargetOffset=6F300 - TargetSection=.text |
| 281200 | N/A | *Overlay* | 58090000000202003082094B06092A864886F70D | X.......0..K..*.H... |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1414313 | 53,8081% |
| Null Byte Code | 653484 | 24,862% |
| NOP Cave Found | 0x9090909090 | Block Count: 5 | Total: 0,0005% |
© 2026 All rights reserved.