PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 724,00 KBSHA-256 Hash: EFA057416E637B4B487ACA24EF7A096F6554588F169750442BDE3115EE0DF0CF SHA-1 Hash: 472A21523F7A3696FE2F0190D484B780E77B5332 MD5 Hash: BEB04EF1D8732CE5114B797BED06D65F Imphash: 30730063DEB12412C995E3A87910E49B MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): 281CA0 SizeOfHeaders: 400 SizeOfImage: 2B0000 ImageBase: 400000 Architecture: x86 ImportTable: 2AEEC0 Characteristics: 10F TimeDateStamp: 678B4A75 Date: 18/01/2025 6:30:13 File Type: EXE Number Of Sections: 3 ASLR: Disabled Section Names: L_jI6i, L_Yqk5, .rsrc Number Of Executable Sections: 2 Subsystem: Windows GUI [Incomplete Binary or Compressor Packer - 1,98 MB Missing] |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| L_jI6i | 0xE0000080 Uninitialized Data Executable Readable Writeable |
400 | 0 | 1000 | 1F9000 |
|
|
| L_Yqk5 | 0xE0000040 Initialized Data Executable Readable Writeable |
400 | 88A00 | 1FA000 | 89000 |
|
|
| .rsrc | 0xC0000040 Initialized Data Readable Writeable |
88E00 | 2C200 | 283000 | 2D000 |
|
|
| Description |
| ProductName: iaeNlbc]wQ FileVersion: 1.7.0.0 FileDescription: 'Y}v f\-'YOeYIAeNlbc]wQ4 ProductVersion: 1.7.0.0 Comments: ,gzO(ufQ(http://www.eyuyan.com) Language: Chinese (People's Republic of China) (ID=0x804) CodePage: Unicode (UTF-16 LE) (0x4B0) Unusual Chars Found In Description File - (Polymorphic patterns or unicode characters) |
| Entry Point |
The section number (2) - (L_Yqk5) have the Entry Point Information -> EntryPoint (calculated) - 880A0 Code -> 60BE00A05F008DBE0070E0FF5789E58D9C2480C1FFFF31C05039DC75FB4646536891FC27005783C30453689E7C08005683C3 Assembler |PUSHAD |MOV ESI, 0X5FA000 |LEA EDI, [ESI - 0X1F9000] |PUSH EDI |MOV EBP, ESP |LEA EBX, [ESP - 0X3E80] |XOR EAX, EAX |PUSH EAX |CMP ESP, EBX |JNE 0X1018 |INC ESI |INC ESI |PUSH EBX |PUSH 0X27FC91 |PUSH EDI |ADD EBX, 4 |PUSH EBX |PUSH 0X87C9E |PUSH ESI |
| Signatures |
| Rich Signature Analyzer: Code -> 1BDB25A35FBA4BF05FBA4BF05FBA4BF030A540F056BA4BF030A541F059BA4BF0DCA645F073BA4BF024A647F05ABA4BF009A558F073BA4BF03DA558F045BA4BF05FBA4AF0FBB84BF0DCB216F05CBA4BF0699C41F0B7BA4BF0699C40F032BA4BF0B7A540F001BA4BF0B7A541F044BA4BF05FBA4BF06ABA4BF098BC4DF05EBA4BF0526963685FBA4BF0 Footprint md5 Hash -> D3EC0C3AF3D47EEC95DFA41E73D43CA4 • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: packer: UPX(-)[modified] • PE: compiler: Microsoft Visual C/C++(6.0)[-] • PE: linker: Microsoft Linker(6.0*)[-] • Entropy: 7.30694 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| SHELL32.DLL | ShellExecuteA | Performs a run operation on a specific file. |
| File Access |
| WS2_32.dll WLDAP32.dll WINMM.dll VERSION.dll USER32.dll SHELL32.dll OLEAUT32.dll ole32.dll KERNEL32.DLL GDI32.dll comdlg32.dll COMCTL32.dll ADVAPI32.dll |
| Interest's Words |
| exec |
| URLs (UNICODE) |
| http://www.eyuyan.com) |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Ascii | Execution (ShellExecute) |
| Entry Point | Hex Pattern | UPX - www.upx.sourceforge.net |
| Entry Point | Hex Pattern | UPX v3.0 (EXE_LZMA) - Markus Oberhumer & Laszlo Molnar & John Reiser |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \TEXTINCLUDE\1\2052 | 24FD2C | B | 5612C | 1988679A71A63F4108A7E2 | ..g.q.?A... |
| \TEXTINCLUDE\2\2052 | 24FD38 | 16 | 56138 | FC849F0DF2EA786B80381DBAB447EB70C4AE5A2C41D9 | ......xk.8...G.p..Z,A. |
| \TEXTINCLUDE\3\2052 | 24FD50 | 151 | 56150 | 713AB771A5EA5D4AF621ABAB554D21A160D205FF76B443F92BBB55696683F5909E7AA94FC2B77501E71FEA154CB7C1225213 | q:.q..]J.!..UM!....v.C.+.Uif....z.O..u.....L.."R. |
| \CURSOR\1\2052 | 24FEA4 | 134 | 562A4 | 6FEF4DF9D09FBE8ED61F9A03EDDE94A9237D46376FA0439E0FB48B19D883AE199EEB66E8CB646B2D30C1AEE6F72F26EABE87 | o.M.............}F7o.C...........f..dk-0..../&... |
| \CURSOR\2\2052 | 24FFD8 | 134 | 563D8 | 8D8ED065F379C308160774933328A13FC34FF9C62088511FD349B04AA44D2A308447C2EAE9BA15E1F7EBECEC732997DB1172 | ...e.y....t.3(.?.O.. .Q..I.J.M*0.G..........s)...r |
| \CURSOR\3\2052 | 25010C | 134 | 5650C | BC913CB9517E498CDF5193C1C0FBE25B65CC145D57D294B99CB1985A2C3DEE5BFF6310A7ACDE5B81FF7D306EB15A2DAAD6F6 | ..<.Q~I..Q.....[e..]W......Z,=.[.c....[..}0n.Z-... |
| \CURSOR\4\2052 | 250240 | B4 | 56640 | 6346F0305B3AD72B99C1BDE8E2F0CD84CFE5B525C333AB7CE996327452278003A337B1F6D0E595F824FB2C3782EA169F0A4B | cF.0[:.+...........%.3.|..2tR'...7......$.,7.....K |
| \BITMAP\IEXT_IDB_STATEIMAGES\2052 | 2502F4 | 16C | 566F4 | 99228C1220A38D33526573428C46113D491A63B197EE22C546596787199CB89D74A062759B0197007A60DB62EB5022EFA7B2 | .".. ..3ResB.F.=I.c...".FYg.....t.bu....z.b.P"... |
| \BITMAP\1031\2052 | 250460 | 248 | 56860 | DABF79CE089587D61D67ED7B99B78708762736831226C7CFC4153393A6C99D3B940AA57D670507BF2D432487FC56E8D9C579 | ..y......g.{....v'6..&....3....;...}g...-C$..V...y |
| \BITMAP\1038\2052 | 2506A8 | 144 | 56AA8 | 74FA5BC2127EF1C46BB09DC726574BA1C26DF2C0EECA3B2E966FF04396929A3A154FB999DA498DB4FDD7FB9A79952C287F1F | t.[..~..k...&WK..m....;..o.C...:.O...I......y.,(.. |
| \BITMAP\1138\2052 | 2507EC | 158 | 56BEC | 8EC21CD04CEA4050485C042FEE048EFEAFBF241B4CAC56C20BD24D19E25254ABBF7D73750B5C8E72CC2C0CA039BABD484152 | ....L.@PH\./......$.L.V...M..RT..}su.\.r.,..9..HAR |
| \BITMAP\1139\2052 | 250944 | 158 | 56D44 | 842A0620B59756ADE7FA9AAF77568A34A81623A3D30CBCF11519BCECACBD75E69A71A4F50ECD935D11B55AA25C899C3EA306 | .*. ..V.....wV.4.............u..q.....]..Z.\..>.. |
| \BITMAP\1140\2052 | 250A9C | 158 | 56E9C | BBE80A444FC1C765CC7C8BC382F8312A411743ADF514738C20FA5119A56084AEB7323998C1BDC9084DDEAFF2F04EFDC2FE1E | ...DO..e.|....1*A.C...s. .Q.....29.....M....N.... |
| \BITMAP\1141\2052 | 250BF4 | 158 | 56FF4 | 7CCF1C1EE57131420A6B6781D437E74BAA46BFD180F1515B8A7985D84E2726691DA624A3778C2588411CF35EBE9859E3AA78 | |....q1B.kg..7.K.F....Q[.y..N'&i..$.w.%.A....Y..x |
| \BITMAP\1142\2052 | 250D4C | 158 | 5714C | 4863318CA2F0D69817DEAE369BA14B9687692D012F8FAB80548AA6DF7B0FFA6E2AA8D6970CC5C4FFE6751FABEF6D4E09FBA2 | Hc1........6..K..i-./...T...{..n*........u...mN... |
| \BITMAP\1143\2052 | 250EA4 | 158 | 572A4 | F486ACF601F3B072C1FC353179B00377DE905863B377FA1E3E1AA394F972B7FC99157B927E1C64EED7AAAD1CA82599D6A78E | .......r..51y..w..Xc.w..>....r....{.~.d......%.... |
| \BITMAP\1144\2052 | 250FFC | 158 | 573FC | FCE53F1607DF02505D0A05D50C096DA6A92947AD5980561A5E19B38DFFE97702FD1428DEBB1A1F9648DF6C3A21FE39BA0A33 | ..?....P].....m..)G.Y.V......w...(.....H.l:!.9..3 |
| \BITMAP\1145\2052 | 251154 | 158 | 57554 | 01215FCCE883825320C7CBD405A052BBAE9A9F684D25CF4F41ECD50DCAC7501F2836E18AEEE0A1AF2273369F4276B7AD908F | .!_....S .....R....hM%.OA.....P.(6......"s6.Bv.... |
| \BITMAP\26567\2052 | 2512AC | 5E4 | 576AC | C786F6B3230E4FD11CCDFFCA1D5BC7A902BC5B05D76FD0D53FAC771ABB4796C77B13A55EA4D99A7308485CE2E9B4CC8209DE | .....O......[....[..o..?.w..G..{.....s.H\....... |
| \BITMAP\30994\2052 | 251890 | B8 | 57C90 | ED8C8D62BC2E9EA9AC6E04155F9352A1DA5C662B76E6AE4B1C95E66C7C3BF7EF2E45A1A57067BC908C0C78B98CDFA44F2221 | ...b.....n.._.R..\f+v..K...l|;...E..pg....x....O"! |
| \BITMAP\30995\2052 | 251948 | 16C | 57D48 | DAB248422D9A1F47EA22D7A8B846546231D9687E42537D6B2C74BC9B9C0E5CD1DBCA2D5B07D85DBA350B4E0C8AFB623139DE | ..HB-..G."...FTb1.h~BS}k,t....\...-[..].5.N...b19. |
| \BITMAP\30996\2052 | 251AB4 | 144 | 57EB4 | 72D460B4D2FE164D360279A718290DB3E8B2CA2693A98AA30D7F83BF60A095AEF5313EA80881C57A92124BB8E228839F5094 | r.....M6.y..).....&............1>....z..K..(..P. |
| \ICON\1\2052 | 251BF8 | 2E8 | 57FF8 | C53A8DD0C1F1AC4FAA2D0539D39A36FCE7D0C41782D176348B43234E433C0B050BD59D940B84662BA46DA4095AF0EC7C4020 | .:.....O.-.9..6.......v4.CNC<........f+.m..Z..|@ |
| \ICON\2\2052 | 251EE0 | 128 | 582E0 | BB9CF224439B42570220C86D77BC9456B292C45CEBF9716C19C43D5A7268417E9A00FB20212B6FA6E57701ADA787E1EFE254 | ...$C.BW. .mw..V...\..ql..=ZrhA~... !+o..w.......T |
| \ICON\3\0 | 283D30 | 468 | 89B30 | 280000001000000020000000010020000000000000040000C30E0000C30E00000000000000000000FFFFFFFFFEFFFFFFF8FB | (....... ..... ................................... |
| \ICON\4\0 | 28419C | 988 | 89F9C | 280000001800000030000000010020000000000000090000C30E0000C30E00000000000000000000FFFFFFFEFFFFFFFFFFFF | (.......0..... ................................... |
| \ICON\5\0 | 284B28 | 10A8 | 8A928 | 280000002000000040000000010020000000000000100000C30E0000C30E00000000000000000000FFFFFFFEFFFFFFFFFFFF | (... ...@..... ................................... |
| \ICON\6\0 | 285BD4 | 25A8 | 8B9D4 | 280000003000000060000000010020000000000000240000C30E0000C30E00000000000000000000FFFFFFFEFFFFFFFEFFFF | (...0........ ......$............................ |
| \ICON\7\0 | 288180 | 4228 | 8DF80 | 280000004000000080000000010020000000000000400000C30E0000C30E00000000000000000000FFFFFFFEFFFFFFFEFFFF | (...@......... ......@............................ |
| \ICON\8\0 | 28C3AC | 5488 | 921AC | 280000004800000090000000010020000000000000510000C30E0000C30E00000000000000000000FFFFFFFDFFFFFFFEFFFF | (...H......... ......Q............................ |
| \ICON\9\0 | 291838 | 94A8 | 97638 | 2800000060000000C0000000010020000000000000900000C30E0000C30E00000000000000000000FFFFFFFDFFFFFFFEFFFF | (............ ................................... |
| \ICON\10\0 | 29ACE4 | 10828 | A0AE4 | 280000008000000000010000010020000000000000000100C30E0000C30E00000000000000000000FFFFFFFCFFFFFFFEFFFF | (............. ................................... |
| \ICON\11\0 | 2AB510 | 36C3 | B1310 | 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A8660000368A4944415478DAEDBD779C5CD595 | .PNG........IHDR.............\r.f..6.IDATx...w.\.. |
| \MENU\127\2052 | 27CE8C | C | 8328C | 81958422A2517C11EAF62EEC | ...".Q|..... |
| \MENU\1039\2052 | 27CE98 | 284 | 83298 | 622E8ED4A3FABA37CF891456DAF8D51F25EDC61FDBACE856B7C898658206196782D0880E4CBDA2FF59FCAF3CB96203E5CDEE | b......7...V....%......V...e...g....L...Y..<.b.... |
| \DIALOG\150\2052 | 27D11C | 98 | 8351C | 946236881B2191A905A30AFFFDF2961CA9BA7E6EEA54BACC121D42E3CDCF9C91831B87F3AEAC0DCE8A861701BFEC19F91452 | .b6..!............~n.T....B......................R |
| \DIALOG\286\2052 | 27D1B4 | 17A | 835B4 | 74A162ECF65993244A644CCF64280DB4CB2E7462CA2CD36EC640A104CE8A537A2C8F52BE1113B7350D794F24EA258E09FA86 | t.b..Y.$JdL.d(....tb.,.n.@....Sz,.R....5.yO$.%.... |
| \DIALOG\554\2052 | 27D330 | FA | 83730 | B45E40F3735F5F55FCA1FDE0B320A4E8DEE07DD68C5126F246BBB2BC361BC80BF2EA7DBE5A9A8FD130C03FE949DAFD37B320 | .@.s__U..... ....}..Q&.F...6.....}.Z...0.?.I..7. |
| \DIALOG\1037\2052 | 27D42C | EA | 8382C | D8BEDB6BDEA4D8FA3873CECE0B852CF2389D7674705475EE11F801DF8050823D30643CEDE0BEC9BBE515E668AAD9B32D6DC7 | ...k....8s....,.8.vtpTu......P.=0d<........h...-m. |
| \DIALOG\1084\2052 | 27D518 | 8AE | 83918 | 281867F3A8057D1F994C6E0D144F014441D9276904400C7FA0447576B01E394392B770FBC500CA4DB96B8CF5102C66C30D5E | (.g...}..Ln..O.DA.'i.@...Duv..9C..p....M.k...,f.. |
| \DIALOG\1124\2052 | 27DDC8 | B2 | 841C8 | A9D235C951BE6A5D78C25D7235CFC92A441CE8FB16A46DBC8B4A3CD0F74E676AA325DC07E5EAB70C040A8DCE12A974626439 | ..5.Q.j]x.]r5..*D.....m..J<..Ngj.%............tbd9 |
| \DIALOG\1134\2052 | 27DE7C | CC | 8427C | 9C8C2B4F60A40AE201AE5BFCFBE88EEA463E2C23E9EFCF7581D83FD38B19DA5CF74CC7EB2CBE2E70E5303C5FF0111BC7164A | ..+O.....[.....F>,...u..?....\.L..,..p.0<_.....J |
| \DIALOG\1150\2052 | 27DF48 | B2 | 84348 | D1459973901F9DEFB1AEC9F996E3C682DDB5A60A252B0FA64B1C006978F89EEC3812EEECEDFE8F814B886E200F6E1AA17476 | .E.s................%+..K..ix...8.......K.n .n..tv |
| \DIALOG\30721\2052 | 27DFFC | E2 | 843FC | B1D6C5FDE74356299207861A52DFC3C35B718688A7A53A89FCE9D65C0398E8C72045D92CDE3BAB74E14B8DD2C2C55722B9B9 | .....CV)....R...[q....:....\.... E.,.;.t.K....W".. |
| \DIALOG\30722\2052 | 27E0E0 | 18C | 844E0 | 3DBD3F260845D25C1365C97BC75F3E4CBED0FE9F81CA9C637945B7E203916A60111D876FFC066AB4B15A18971774E63113DC | =.?&.E.\.e.{._>L.......cyE....j...o..j..Z...t.1.. |
| \STRING\3841\2052 | 27E26C | 50 | 8466C | 423847E66061F42AB3E039E6672F963B607F46067F16DD8F34D0D8E4220BDD2BFCE9D2BB013F4A9D00B8402149AFD5BD1C678D8C6AB8A6966E9AFEE6645B5DC29FA68EE13F03F8C16C6D5B2093F036D5 | B8G.a.*..9.g/.;.F.....4..."..+.....?J...@!I....g..j...n...d[].....?...lm[ ..6. |
| \STRING\3842\2052 | 27E2BC | 2C | 846BC | 59EBE91ABFA7B48FF202B027AA82454A4155C1252B6A8B4EE65B02785236854C817464BB8B4B23E7C5B9846D | Y..........'..EJAU.%+j.N.[.xR6.L.td..K....m |
| \STRING\3843\2052 | 27E2E8 | 78 | 846E8 | 76F61A6495DFAB81877B5FC897A9A7E7C364EC24ECBDDAD93C8C706FED0F62593AF37FA989A9C60DDBB0C084E3ED655978B9 | v..d.....{_......d.$....<.po..bY:.............eYx. |
| \STRING\3857\2052 | 27E360 | 1C4 | 84760 | 8ECF2BAAA058A6521281CE010EC0B2045A374E1EA4E18511F72CE5625A0135973F7B32C542AFBD91ED3423A6F810923F9B3F | ..+..X.R........Z7N......,.bZ.5.?{2.B....4....?.? |
| \STRING\3858\2052 | 27E524 | 12A | 84924 | DBDC486FE911AC83E1AA7B06E68DD4F2173FBD84D19EA53250821F110F29A13C339F1F5A3DA3756F789EA950747F5A231B89 | ..Ho......{......?.....2P....).<3..Z=.uox..Pt.Z.. |
| \STRING\3859\2052 | 27E650 | 146 | 84A50 | 3EA43143323FDEE7CD14C34966F4FE198DB35F24EEA8E6C1AFD497946F6D05A2665BB5D40663BB45EBA1CA4D20350693BBF0 | >.1C2?.....If....._$........om..f[...c.E...M 5.... |
| \STRING\3865\2052 | 27E798 | 40 | 84B98 | 8D057BBCD46FC1FD18E96B776866ED4176BFF1B6C9454DC4454B8B660955B757F445582907A15D299E2F232AAF157076A06084BB8AB0D3455D71E4CD4A41DE07 | ..{..o....kwhf.Av....EM.EK.f.U.W.EX)..])./*..pv......E]q..JA.. |
| \STRING\3866\2052 | 27E7D8 | 64 | 84BD8 | E6F1AFA96EA52FFDD13EFADBA42774A609F5006F0DDA15FED78BE2E674A8C3CF4B5AB859B32F65E43D2E175CC74C44191DF7 | ....n./..>...'t....o........t...KZ.Y./e.=..\.LD... |
| \STRING\3867\2052 | 27E83C | 1D8 | 84C3C | DEE697050BEBEF81B7B9B1EE20AAA2C914F8CC228E714F4B6076571133E10CE6B6B5D5770B8259A57121D6E16D751CF7FD74 | ............ ......".qOKvW.3......w..Y.q!..mu...t |
| \STRING\3868\2052 | 27EA14 | 114 | 84E14 | 6568E288E79DCD0262E0BF1E68CA86B3B7F2EDE1F4C4D5D4A45572002EAA3EB19CED5233D7E6B6EABE8BC365380A224F801D | eh......b...h............Ur...>...R3.......e8."O.. |
| \STRING\3869\2052 | 27EB28 | 24 | 84F28 | 249A337F579D1F6A36BE0354C291F94478C7F390BA1E5BB9AD47D64C0B6D043F4B9A7FA8 | $.3.W..j6..T...Dx.....[..G.L.m.?K... |
| \GROUP_CURSOR\1032\2052 | 27EB4C | 14 | 84F4C | 90AA5264E29176DEE15CEF854D7FD9CCB0F021DE | ..Rd..v..\..M.....!. |
| \GROUP_CURSOR\1033\2052 | 27EB60 | 14 | 84F60 | 0A4AC62E6281D522CE585731BD49F6CDBD24ECE7 | .J..b..".XW1.I...$.. |
| \GROUP_CURSOR\30977\2052 | 27EB74 | 22 | 84F74 | BDB99D9C3ED580AB86D7A3B0D1D06364431955B0C9BD9A8499354A97FC21A2094295 | ....>.........cdC.U......5J..!..B. |
| \GROUP_ICON\DEFAULT_ICON\0 | 2AEBD8 | 84 | B49D8 | 000001000900101000000100200068040000030018180000010020008809000004002020000001002000A810000005003030 | ............ .h........... ....... .... .......00 |
| \GROUP_ICON\1151\2052 | 27EC1C | 14 | 8501C | CE0729E012D4DCB20185B2AA9B9AB25A3DD56DE9 | ..)............Z=.m. |
| \GROUP_ICON\1152\2052 | 27EC30 | 14 | 85030 | 24DE62A47AF03F04BD12FA6116A098F94F2488CD | $.b.z.?....a....O$.. |
| \VERSION\1\2052 | 2AEC60 | 260 | B4A60 | 600234000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000000000700 | .4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • 1.7.0.0 • http://www.eyuyan.com) |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| 87A0 | 2AEC60 | L_Yqk5 | CALL [static] | Indirect call to absolute memory address |
| 911E | 569A21E4 | L_Yqk5 | CALL [static] | Indirect call to absolute memory address |
| B15D | 569A21E4 | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 11859 | 6508BBB | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 165E7 | 6508BBB | L_Yqk5 | CALL [static] | Indirect call to absolute memory address |
| 169B9 | 3495D370 | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 1ADF8 | 401BCD2F | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 24BBC | 7FB0B5C4 | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 27F12 | 7FB0B5C4 | L_Yqk5 | CALL [static] | Indirect call to absolute memory address |
| 3B80E | 470EC3FC | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 4AE98 | 1D9F6E89 | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 528C9 | 51E0288D | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 6DF87 | 4F0FA70C | L_Yqk5 | CALL [static] | Indirect call to absolute memory address |
| 73D8D | 4C8ABAE2 | L_Yqk5 | CALL [static] | Indirect call to absolute memory address |
| 756A4 | 4C8ABAE2 | L_Yqk5 | JMP [static] | Indirect jump to absolute memory address |
| 7C0D1 | 3E39D0B8 | L_Yqk5 | CALL [static] | Indirect call to absolute memory address |
| 89BDF | 5CFFFE76 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 89CEF | 5EFFFE76 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 8AEE3 | 76FFFE76 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 92B5B | 76FFFE76 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 92C7B | 76FFFE76 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 92D9B | 76FFFE76 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 92EA3 | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 92EBB | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 92FDB | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 930FB | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 9321B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 9333B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 9345B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 9357B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 9369B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 937BB | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 938DB | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 939FB | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 93B1B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 93C3B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 93D5B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 93E7B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 93F9B | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 940BB | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 942FB | 20FFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 944D7 | 1DFFFC75 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| 9907B | 21FFF874 | .rsrc | JMP [static] | Indirect jump to absolute memory address |
| B30BD | 21FFF874 | .rsrc | CALL [static] | Indirect call to absolute memory address |
| 400-88DFF | 1FA000 | L_Yqk5 | Executable section anomaly, first bytes: 1A030019B01468C4 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 424752 | 57,2924% |
| Null Byte Code | 15408 | 2,0783% |
© 2026 All rights reserved.