PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 2,08 MBSHA-256 Hash: B1C36E28B64C006A27BE16BC54378B4764DBBE72C28C04B16BC3295AF041C509 SHA-1 Hash: 55CD3613FF28FE2DCBF984C10E65D6EC32661567 MD5 Hash: BBCB78EC912EE6D3B5335E50DB7D2F9E Imphash: 88016FCDEF7F227C62171D0AFAD9AAE4 MajorOSVersion: 6 MinorOSVersion: 1 CheckSum: 00000000 EntryPoint (rva): B1E60 SizeOfHeaders: 400 SizeOfImage: E7000 ImageBase: 400000 Architecture: x86 ExportTable: C2000 ImportTable: BF000 IAT: BF2E4 Characteristics: 102 TimeDateStamp: 6A104976 Date: 22/05/2026 12:17:58 File Type: EXE Number Of Sections: 11 ASLR: Enabled Section Names: .text, .itext, .data, .bss, .idata, .didata, .edata, .tls, .rdata, .reloc, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI UAC Execution Level Manifest: asInvoker |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | AFA00 | 1000 | AF80C |
|
|
| .itext | 0x60000020 Code Executable Readable |
AFE00 | 1A00 | B1000 | 18CC |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
B1800 | 4000 | B3000 | 3F3C |
|
|
| .bss | 0xC0000000 Readable Writeable |
0 | 0 | B7000 | 734C |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
B5800 | 1200 | BF000 | 1068 |
|
|
| .didata | 0xC0000040 Initialized Data Readable Writeable |
B6A00 | 200 | C1000 | 1A4 |
|
|
| .edata | 0x40000040 Initialized Data Readable |
B6C00 | 200 | C2000 | 71 |
|
|
| .tls | 0xC0000000 Readable Writeable |
0 | 0 | C3000 | 18 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
B6E00 | 200 | C4000 | 5D |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
B7000 | 12000 | C5000 | 11FEC |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
C9000 | FA00 | D7000 | F9C0 |
|
|
| Description |
| CompanyName: MT5Bot ProductName: MT5Bot FileDescription: MT5Bot Setup Comments: This installation was built with Inno Setup. Language: Unknown (ID=0x0) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Binder/Joiner/Crypter |
| Dropper code detected (EOF) - 1,17 MB |
| Entry Point |
The section number (2) - (.itext) have the Entry Point Information -> EntryPoint (calculated) - B0C60 Code -> 558BECB90F0000006A006A004975F951535657B878BA4A00E827C8F5FF33C05568C6264B0064FF3064892033D2556880264B Assembler |PUSH EBP |MOV EBP, ESP |MOV ECX, 0XF |PUSH 0 |PUSH 0 |DEC ECX |JNE 0X4B1E68 |PUSH ECX |PUSH EBX |PUSH ESI |PUSH EDI |MOV EAX, 0X4ABA78 |CALL 0X40E6A4 |XOR EAX, EAX |PUSH EBP |PUSH 0X4B26C6 |PUSH DWORD PTR FS:[EAX] |MOV DWORD PTR FS:[EAX], ESP |XOR EDX, EDX |PUSH EBP |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: installer: Inno Setup Module(-)[-] • PE: protector: .NET Reactor(2.X-3.X)[-] • PE: compiler: Embarcadero Delphi(XE2-XE6)[-] • PE: linker: Turbo Linker(2.25*,Delphi)[-] • PE: overlay: Inno Setup Installer data(-)[-] • Entropy: 7.68718 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleW | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | GetTempPathW | Retrieves the temporary directory path. |
| KERNEL32.DLL | CreateFileW | Creates or opens a file object. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileW | Starts file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | VirtualProtect | Changes memory protection attributes. |
| KERNEL32.DLL | CreateProcessW | Creates and starts a new process. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | CreateEventW | Creates or opens an event object. |
| KERNEL32.DLL | GetSystemInfo | Retrieves system hardware information. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| ADVAPI32.DLL | RegOpenKeyExW | Opens an existing registry key. |
| Windows REG (UNICODE) |
| Software\Embarcadero\Locales Software\CodeGear\Locales Software\Borland\Locales Software\Borland\Delphi\Locales SOFTWARE\Microsoft\Windows NT\CurrentVersion |
| File Access |
| winhttp.dll version.dll textshaping.dll netutils.dll netapi32.dll mpr.dll comctl32.dll kernel32.dll user32.dll advapi32.dll oleaut32.dll System.Sys dSystem.Sys UnsignedFuncSystem.SysUtilsSystemSystem.Internal.ExcUtilsSystem.Sys UnsignedFuncSystem.Sys System.Sys ?System.Sys .dat Temp |
| File Access (UNICODE) |
| GetLogicalProcessorInformationkernel32.dll kernel32.dll Failed to load bcrypt.dll bcrypt.dll advapi32.dll oleaut32.dll NTDLL.DLL ntdll.dll Temp |
| Interest's Words |
| PADDINGX Encrypt Decrypt Encryption PassWord exec attrib start shutdown systeminfo ping expand |
| Interest's Words (UNICODE) |
| PassWord exec start shutdown ping expand |
| URLs |
| http://schemas.microsoft.com/SMI/2005/WindowsSettings |
| URLs (UNICODE) |
| https://jrsoftware.org/ishelp/index.php?topic=setupcmdline |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Unicode | Privileges (SeShutdownPrivilege) |
| Text | Ascii | Process of gathering information about network resources (Enumeration) |
| Text | Unicode | Malicious rerouting of traffic to an attacker-controlled site (Redirect) |
| Text | Ascii | Technique used to capture communications between systems (Intercept) |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \ICON\100\1033 | D7558 | 38F | C9558 | 89504E470D0A1A0A0000000D49484452000000100000001008020000009091683600000176694343504943432050726F6669 | .PNG........IHDR...............h6...viCCPICC Profi |
| \ICON\101\1033 | D78E8 | 63D | C98E8 | 89504E470D0A1A0A0000000D4948445200000020000000200802000000FC18EDA300000176694343504943432050726F6669 | .PNG........IHDR... ... ............viCCPICC Profi |
| \ICON\102\1033 | D7F28 | 9D2 | C9F28 | 89504E470D0A1A0A0000000D4948445200000030000000300802000000D8606ED000000176694343504943432050726F6669 | .PNG........IHDR...0...0......n....viCCPICC Profi |
| \ICON\103\1033 | D88FC | E5A | CA8FC | 89504E470D0A1A0A0000000D4948445200000040000000400802000000250BE68900000176694343504943432050726F6669 | .PNG........IHDR...@...@.....%......viCCPICC Profi |
| \ICON\104\1033 | D9758 | 2740 | CB758 | 89504E470D0A1A0A0000000D49484452000000800000008008020000004C5CF69C00000176694343504943432050726F6669 | .PNG........IHDR.............L\.....viCCPICC Profi |
| \ICON\105\1033 | DBE98 | 7669 | CDE98 | 89504E470D0A1A0A0000000D4948445200000100000001000802000000D3103F3100000176694343504943432050726F6669 | .PNG........IHDR...............?1...viCCPICC Profi |
| \STRING\4085\0 | E3504 | 24C | D5504 | 47004E006F002000730069006E0067006C0065002000630061007300740020006F0062007300650072007600650072002000 | G.N.o. .s.i.n.g.l.e. .c.a.s.t. .o.b.s.e.r.v.e.r. . |
| \STRING\4086\0 | E3750 | 2E4 | D5750 | 0C00570069006E0064006F0077007300200032003000300030000A00570069006E0064006F00770073002000580050001300 | ..W.i.n.d.o.w.s. .2.0.0.0...W.i.n.d.o.w.s. .X.P... |
| \STRING\4087\0 | E3A34 | 400 | D5A34 | 350049006E00730075006600660069006300690065006E00740020005200540054004900200061007600610069006C006100 | 5.I.n.s.u.f.f.i.c.i.e.n.t. .R.T.T.I. .a.v.a.i.l.a. |
| \STRING\4088\0 | E3E34 | 3D0 | D5E34 | 18004500720072006F0072002000720065006100640069006E00670020002500730025007300250073003A00200025007300 | ..E.r.r.o.r. .r.e.a.d.i.n.g. .%.s.%.s.%.s.:. .%.s. |
| \STRING\4089\0 | E4204 | 3FC | D6204 | 1A00430061006E006E006F0074002000610073007300690067006E0020006100200025007300200074006F00200061002000 | ..C.a.n.n.o.t. .a.s.s.i.g.n. .a. .%.s. .t.o. .a. . |
| \STRING\4090\0 | E4600 | 2D4 | D6600 | 06004D006F006E006400610079000700540075006500730064006100790009005700650064006E0065007300640061007900 | ..M.o.n.d.a.y...T.u.e.s.d.a.y...W.e.d.n.e.s.d.a.y. |
| \STRING\4091\0 | E48D4 | B8 | D68D4 | 03004D006100790004004A0075006E00650004004A0075006C00790006004100750067007500730074000900530065007000 | ..M.a.y...J.u.n.e...J.u.l.y...A.u.g.u.s.t...S.e.p. |
| \STRING\4092\0 | E498C | 9C | D698C | 03004A0061006E00030046006500620003004D0061007200030041007000720003004D006100790003004A0075006E000300 | ..J.a.n...F.e.b...M.a.r...A.p.r...M.a.y...J.u.n... |
| \STRING\4093\0 | E4A28 | 38C | D6A28 | 140049006E00760061006C00690064002000760061007200690061006E0074002000740079007000650017004F0070006500 | ..I.n.v.a.l.i.d. .v.a.r.i.a.n.t. .t.y.p.e...O.p.e. |
| \STRING\4094\0 | E4DB4 | 398 | D6DB4 | 2200560061007200690061006E00740020006D006500740068006F0064002000630061006C006C00730020006E006F007400 | ".V.a.r.i.a.n.t. .m.e.t.h.o.d. .c.a.l.l.s. .n.o.t. |
| \STRING\4095\0 | E514C | 368 | D714C | 200049006E00760061006C0069006400200066006C006F006100740069006E006700200070006F0069006E00740020006F00 | .I.n.v.a.l.i.d. .f.l.o.a.t.i.n.g. .p.o.i.n.t. .o. |
| \STRING\4096\0 | E54B4 | 2A4 | D74B4 | 2100270025007300270020006900730020006E006F007400200061002000760061006C0069006400200069006E0074006500 | !.’.%.s.’. .i.s. .n.o.t. .a. .v.a.l.i.d. .i.n.t.e. |
| \RCDATA\DVCLAL\0 | E5758 | 10 | D7758 | 263D4F38C28237B8F3244203179B3A83 | &=O8..7..$B...:. |
| \RCDATA\PACKAGEINFO\0 | E5768 | 490 | D7768 | 000010CC000000003E000000010A53657475704C64720010A053797374656D2E576964655374725574696C73001025537973 | ........>.....SetupLdr...System.WideStrUtils..%Sys |
| \RCDATA\11111\1033 | E5BF8 | 40 | D7BF8 | 72446C507453CDE6D77B0B2A02000000BC3621000000000054940E000000000000FA4200AF21A94D09410E0000000000008A0D0000000000000000005068EA51 | rDlPtS...{.*.....6!.....T.........B..!.M.A..................Ph.Q |
| \GROUP_ICON\MAINICON\1033 | E5C38 | 5A | D7C38 | 00000100060010100000000020008F030000640020200000000020003D06000065003030000000002000D2090000660040400000000020005A0E0000670080800000000020004027000068000000000000002000697600006900 | ............ .....d. .... .=...e.00.... .....f.@@.... .Z...g....... .@’..h....... .iv..i. |
| \VERSION\1\1033 | E5C94 | 584 | D7C94 | 840534000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| \24\1\1033 | E6218 | 7A8 | D8218 | 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279 | <?xml version="1.0" encoding="UTF-8" standalone="y |
| Intelligent String |
| • user32.dll • kernel32.dll • oleaut32.dll • C:\Coding\Is\issrc-build\Components\ChaCha20.pas • .bss • @.tls • ntdll.dll • NTDLL.DLL • advapi32.dll • bcrypt.dll • /FORCECLOSEAPPLICATIONS, /FORCENOCLOSEAPPLICATIONS • x:\dirname" • For more detailed information, please visit https://jrsoftware.org/ishelp/index.php?topic=setupcmdline • .tmp • GetThreadLocalecomctl32.dll • VariantChangeTypeadvapi32.dll • MessageBoxAkernel32.dll • <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware> |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 2B70 | 4BF2EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B78 | 4BF328 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B80 | 4BF448 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B88 | 4BF420 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B90 | 4BF404 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2B98 | 4BF3BC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BA0 | 4BF3A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BA8 | 4BF3E0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BB0 | 4BF450 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BB8 | 4BF350 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BC0 | 4BF38C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BC8 | 4BF378 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BD0 | 4BF44C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BD8 | 4BF30C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BE0 | 4BF370 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BE8 | 4BF31C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BF0 | 4BF390 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2BF8 | 4BF340 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C00 | 4BF330 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C08 | 4BF4C8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C10 | 4BF3D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C18 | 4BF344 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C20 | 4BF32C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C28 | 4BF3E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C30 | 4BF3B0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C38 | 4BF384 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C40 | 4BF2E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C48 | 4BF424 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C50 | 4BF41C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C58 | 4BF434 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C60 | 4BF408 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C68 | 4BF468 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C70 | 4BF480 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C78 | 4BF45C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C80 | 4BF4C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2C88 | 4BF354 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CB0 | 4C1094 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CB8 | 4BF548 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CC0 | 4BF528 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CC8 | 4BF53C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CD0 | 4BF368 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CD8 | 4BF3D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CE0 | 4BF3AC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CE8 | 4BF394 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CF0 | 4BF4F8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2CF8 | 4BF4EC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D00 | 4BF4E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D08 | 4BF40C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D30 | 4C1090 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D38 | 4BF308 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D40 | 4BF310 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D48 | 4BF418 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D50 | 4BF3FC | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D58 | 4BF3F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D8C | 4BF3D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D94 | 4BF300 | .text | JMP [static] | Indirect jump to absolute memory address |
| 2D9C | 4BF39C | .text | JMP [static] | Indirect jump to absolute memory address |
| 2DA4 | 4BF448 | .text | JMP [static] | Indirect jump to absolute memory address |
| 47A4 | 4B3768 | .text | CALL [static] | Indirect call to absolute memory address |
| 47BC | 4B375C | .text | CALL [static] | Indirect call to absolute memory address |
| 47D8 | 4B3760 | .text | CALL [static] | Indirect call to absolute memory address |
| 47F9 | 4B3764 | .text | CALL [static] | Indirect call to absolute memory address |
| 4814 | 4B3760 | .text | CALL [static] | Indirect call to absolute memory address |
| 4832 | 4B375C | .text | CALL [static] | Indirect call to absolute memory address |
| 4883 | 4B7028 | .text | CALL [static] | Indirect call to absolute memory address |
| 48C2 | 4B7010 | .text | CALL [static] | Indirect call to absolute memory address |
| 4EEC | 4B703C | .text | CALL [static] | Indirect call to absolute memory address |
| 5342 | FFC0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 64EC | 4B701C | .text | CALL [static] | Indirect call to absolute memory address |
| 650A | 4B701C | .text | CALL [static] | Indirect call to absolute memory address |
| 6522 | 4B701C | .text | CALL [static] | Indirect call to absolute memory address |
| 6594 | 4B701C | .text | CALL [static] | Indirect call to absolute memory address |
| 65B4 | 4B701C | .text | CALL [static] | Indirect call to absolute memory address |
| 65D1 | 4B701C | .text | CALL [static] | Indirect call to absolute memory address |
| 66AE | 4B7020 | .text | CALL [static] | Indirect call to absolute memory address |
| 67B3 | 4B7018 | .text | CALL [static] | Indirect call to absolute memory address |
| 6836 | 4B7020 | .text | CALL [static] | Indirect call to absolute memory address |
| 69D6 | 4B701C | .text | JMP [static] | Indirect jump to absolute memory address |
| 6B5C | 4B7020 | .text | CALL [static] | Indirect call to absolute memory address |
| 6F43 | 4B7360 | .text | CALL [static] | Indirect call to absolute memory address |
| 70C0 | 4B7038 | .text | CALL [static] | Indirect call to absolute memory address |
| 7135 | 4B7034 | .text | CALL [static] | Indirect call to absolute memory address |
| 71A5 | 4B3034 | .text | CALL [static] | Indirect call to absolute memory address |
| 720A | 4B3038 | .text | CALL [static] | Indirect call to absolute memory address |
| 86E1 | 4B300C | .text | CALL [static] | Indirect call to absolute memory address |
| 8D99 | 4B3010 | .text | CALL [static] | Indirect call to absolute memory address |
| 8E80 | 4B3014 | .text | CALL [static] | Indirect call to absolute memory address |
| AC07 | FF | .text | JMP [static] | Indirect jump to absolute memory address |
| B043 | 4B9C04 | .text | CALL [static] | Indirect call to absolute memory address |
| B060 | 4B9C04 | .text | CALL [static] | Indirect call to absolute memory address |
| B081 | 4B9C0C | .text | CALL [static] | Indirect call to absolute memory address |
| B0DF | 4B9C08 | .text | CALL [static] | Indirect call to absolute memory address |
| B13C | 4B9C08 | .text | CALL [static] | Indirect call to absolute memory address |
| B16F | 4B9C08 | .text | CALL [static] | Indirect call to absolute memory address |
| D2C5 | 4B3044 | .text | CALL [static] | Indirect call to absolute memory address |
| D444 | 4BF330 | .text | JMP [static] | Indirect jump to absolute memory address |
| D44C | 4BF32C | .text | JMP [static] | Indirect jump to absolute memory address |
| D454 | 4BF470 | .text | JMP [static] | Indirect jump to absolute memory address |
| D45C | 4BF2F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| D464 | 4BF454 | .text | JMP [static] | Indirect jump to absolute memory address |
| D8A00 | N/A | *Overlay* | 7A6C621A16E0C006B6FC5D000060027FFA8DE97F | zlb.......]........ |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 1449480 | 66,5907% |
| Null Byte Code | 154771 | 7,1104% |
© 2026 All rights reserved.