PREMIUM PESCAN.IO - Analysis Report |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
| Size: 4,20 MB SHA-256 Hash: 8A49A7A85261BE6333936338752674A901CE4AA144F889C7099A2C43DF5C9E5D SHA-1 Hash: 918B9CD0A3BF37AC8B5F1A29E46B4121FC0CE1F1 MD5 Hash: E17DA3AE5A6DE8DAE5FEAE7387AF1010 Imphash: BEFF4EEF203DC94C1DFE99DDB10A8D4D MajorOSVersion: 5 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): D4808 SizeOfHeaders: 400 SizeOfImage: 441000 ImageBase: 400000 Architecture: x86 ExportTable: E1000 ImportTable: DF000 IAT: DF27C Characteristics: A18E TimeDateStamp: 6A4E5337 Date: 08/07/2026 13:40:07 File Type: DLL Number Of Sections: 11 ASLR: Disabled Section Names: .text, .itext, .data, .bss, .idata, .didata, .edata, .rdata, .reloc, .rsrc, .debug Number Of Executable Sections: 2 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
400 | D2400 | 1000 | D23E0 |
|
|
| .itext | 0x60000020 Code Executable Readable |
D2800 | A00 | D4000 | 824 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
D3200 | 3E00 | D5000 | 3DC0 |
|
|
| .bss | 0xC0000000 Readable Writeable |
0 | 0 | D9000 | 5DE4 |
|
|
| .idata | 0xC0000040 Initialized Data Readable Writeable |
D7000 | E00 | DF000 | CCE |
|
|
| .didata | 0xC0000040 Initialized Data Readable Writeable |
D7E00 | 200 | E0000 | 1EA |
|
|
| .edata | 0x40000040 Initialized Data Readable |
D8000 | 400 | E1000 | 20E |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
D8400 | 200 | E2000 | 45 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
D8600 | 14200 | E3000 | 14148 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
EC800 | 2E00 | F8000 | 2E00 |
|
|
| .debug | 0x40000040 Initialized Data Readable |
EF600 | 345062 | FB000 | 345062 |
|
|
| Description |
| ProductName: libcurl FileVersion: 1.0.0.0 FileDescription: libcurl ProductVersion: 1.0.0.0 Language: English (United States) (ID=0x409) CodePage: Western European (Windows 1252) (0x4E4) |
| Entry Point |
The section number (2) - (.itext) have the Entry Point Information -> EntryPoint (calculated) - D3008 Code -> 558BEC83C4C0B8FC044D00E800BCF3FFE873BCFFFFE86650F3FF8BC000000000000000000000000000000000000000000000 Assembler |PUSH EBP |MOV EBP, ESP |ADD ESP, -0X40 |MOV EAX, 0X4D04FC |CALL 0XFFF3CC10 |CALL 0XFFFFCC88 |CALL 0XFFF36080 |MOV EAX, EAX |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |ADD BYTE PTR [EAX], AL |
| Signatures |
| Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Detect It Easy (die) • PE: compiler: Embarcadero Delphi(10.2 Tokyo)[-] • PE: linker: Turbo Linker(2.25*,Delphi)[-] • Entropy: 5.60632 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | VirtualAlloc | Possible Call API By Name | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | LoadLibraryA | Possible Call API By Name | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Possible Call API By Name | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | LoadLibraryW | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | IsDebuggerPresent | Determines if the calling process is being debugged by a user-mode debugger. |
| Windows REG (UNICODE) |
| Software\Embarcadero\Locales Software\CodeGear\Locales Software\Borland\Locales Software\Borland\Delphi\Locales |
| File Access |
| libcurl.dll kernel32.dll user32.dll advapi32.dll netapi32.dll oleaut32.dll version.dll System.Sys dSystem.Sys System.Sys SysInitSystemSystem.TypesuCodeSystem.IOUtilsSystem.MathSystem.Sys ?System.Sys System.Dat &System.Dat .dat Temp RootDir AppData |
| File Access (UNICODE) |
| kernel32.dll oleaut32.dll GetLogicalProcessorInformationkernel32.dll |
| Interest's Words |
| ToolBar Encrypt Decrypt Encryption PassWord exec createobject tasklist attrib start pause hostname shutdown cacls systeminfo ping dism expand openfiles pushd replace route setx |
| Interest's Words (UNICODE) |
| exec start ping expand |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | WinAPI Sockets (bind) |
| Text | Ascii | WinAPI Sockets (connect) |
| Text | Ascii | Registry (RegOpenKeyEx) |
| Text | Ascii | File (GetTempPath) |
| Text | Ascii | File (CreateFile) |
| Text | Ascii | File (WriteFile) |
| Text | Ascii | File (ReadFile) |
| Text | Ascii | Anti-Analysis VM (IsDebuggerPresent) |
| Text | Ascii | Anti-Analysis VM (GetSystemInfo) |
| Text | Ascii | Anti-Analysis VM (GetVersion) |
| Text | Ascii | Reconnaissance (FindFirstFileW) |
| Text | Ascii | Reconnaissance (FindClose) |
| Text | Ascii | Stealth (ExitThread) |
| Text | Ascii | Stealth (CloseHandle) |
| Text | Ascii | Stealth (VirtualAlloc) |
| Text | Unicode | Stealth (VirtualAlloc) |
| Text | Ascii | Stealth (VirtualProtect) |
| Text | Unicode | Stealth (VirtualProtect) |
| Text | Ascii | Execution (ResumeThread) |
| Text | Ascii | Execution (CreateEventW) |
| Text | Ascii | Privileges (SE_GROUP_ENABLED) |
| Text | Ascii | Privileges (SE_GROUP_ENABLED_BY_DEFAULT) |
| Text | Ascii | Privileges (SE_GROUP_INTEGRITY) |
| Text | Ascii | Privileges (SE_GROUP_INTEGRITY_ENABLED) |
| Text | Ascii | Privileges (SE_GROUP_LOGON_ID) |
| Text | Ascii | Privileges (SE_GROUP_OWNER) |
| Text | Ascii | Privileges (SE_GROUP_RESOURCE) |
| Text | Ascii | Privileges (SE_GROUP_USE_FOR_DENY_ONLY) |
| Text | Ascii | Privileges (SE_PRIVILEGE_ENABLED) |
| Text | Ascii | Privileges (SE_PRIVILEGE_ENABLED_BY_DEFAULT) |
| Text | Ascii | Privileges (SE_PRIVILEGE_REMOVED) |
| Text | Ascii | Privileges (SE_PRIVILEGE_USED_FOR_ACCESS) |
| Text | Ascii | Keyboard Key (ALTDOWN) |
| Text | Ascii | Keyboard Key (LBUTTON) |
| Text | Ascii | Keyboard Key (MBUTTON) |
| Text | Ascii | Keyboard Key (RBUTTON) |
| Text | Ascii | Keyboard Key (NUMPAD0) |
| Text | Ascii | Keyboard Key (NUMPAD1) |
| Text | Ascii | Keyboard Key (NUMPAD2) |
| Text | Ascii | Keyboard Key (NUMPAD3) |
| Text | Ascii | Keyboard Key (NUMPAD4) |
| Text | Ascii | Keyboard Key (NUMPAD5) |
| Text | Ascii | Keyboard Key (NUMPAD6) |
| Text | Ascii | Keyboard Key (NUMPAD7) |
| Text | Ascii | Keyboard Key (NUMPAD8) |
| Text | Ascii | Keyboard Key (NUMPAD9) |
| Text | Ascii | Keyboard Key (Scroll) |
| Text | Ascii | Keyboard Key (UpArrow) |
| Text | Ascii | Keyboard Key (PageDown) |
| Text | Ascii | Keyboard Key (PageUp) |
| Text | Ascii | Ability of malware to remain on a system after a reboot (Persistence) |
| Text | Ascii | Process of gathering information about network resources (Enumeration) |
| Text | Ascii | Malware that monitors and collects user data (Spy) |
| Text | Ascii | Information used for user authentication (Credential) |
| Text | Ascii | Unauthorized movement of funds or data (Transfer) |
| Text | Ascii | Technique used to capture communications between systems (Intercept) |
| Entry Point | Hex Pattern | Borland Delphi 4.0 |
| Entry Point | Hex Pattern | Borland Delphi v3.0 |
| Entry Point | Hex Pattern | Borland Delphi v3.0 |
| Entry Point | Hex Pattern | Borland Delphi v6.0 - v7.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 - Debug |
| Entry Point | Hex Pattern | Microsoft Visual C++ 8.0 (MFC) |
| Entry Point | Hex Pattern | TrueVision Targa Graphics format |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \STRING\4085\0 | F83A0 | 408 | ECBA0 | 0900570069006E0064006F0077007300200038000B00570069006E0064006F0077007300200038002E0031000A0057006900 | ..W.i.n.d.o.w.s. .8...W.i.n.d.o.w.s. .8...1...W.i. |
| \STRING\4086\0 | F87A8 | 294 | ECFA8 | 22002500730020002800560065007200730069006F006E002000250064002E00250064002C0020004200750069006C006400 | ".%.s. .(.V.e.r.s.i.o.n. .%.d...%.d.,. .B.u.i.l.d. |
| \STRING\4087\0 | F8A3C | 51C | ED23C | 2C00430061006E006E006F00740020007700610069007400200066006F007200200061006E00200065007800740065007200 | ,.C.a.n.n.o.t. .w.a.i.t. .f.o.r. .a.n. .e.x.t.e.r. |
| \STRING\4088\0 | F8F58 | 3A8 | ED758 | 160049006E00760061006C00690064002000700072006F00700065007200740079002000760061006C007500650020004C00 | ..I.n.v.a.l.i.d. .p.r.o.p.e.r.t.y. .v.a.l.u.e. .L. |
| \STRING\4089\0 | F9300 | 42C | EDB00 | 4E004E006F0020006D0061007000700069006E006700200066006F0072002000740068006500200055006E00690063006F00 | N.N.o. .m.a.p.p.i.n.g. .f.o.r. .t.h.e. .U.n.i.c.o. |
| \STRING\4090\0 | F972C | 210 | EDF2C | 03005300610074000600530075006E0064006100790006004D006F006E006400610079000700540075006500730064006100 | ..S.a.t...S.u.n.d.a.y...M.o.n.d.a.y...T.u.e.s.d.a. |
| \STRING\4091\0 | F993C | BC | EE13C | 05004D006100720063006800050041007000720069006C0003004D006100790004004A0075006E00650004004A0075006C00 | ..M.a.r.c.h...A.p.r.i.l...M.a.y...J.u.n.e...J.u.l. |
| \STRING\4092\0 | F99F8 | 100 | EE1F8 | 1E00530079007300740065006D0020004500720072006F0072002E002000200043006F00640065003A002000250064002E00 | ..S.y.s.t.e.m. .E.r.r.o.r... . .C.o.d.e.:. .%.d... |
| \STRING\4093\0 | F9AF8 | 338 | EE2F8 | 1000560061007200690061006E00740020006F0076006500720066006C006F007700100049006E00760061006C0069006400 | ..V.a.r.i.a.n.t. .o.v.e.r.f.l.o.w...I.n.v.a.l.i.d. |
| \STRING\4094\0 | F9E30 | 478 | EE630 | 050057007200690074006500090045007800650063007500740069006F006E000E0049006E00760061006C00690064002000 | ..W.r.i.t.e...E.x.e.c.u.t.i.o.n...I.n.v.a.l.i.d. . |
| \STRING\4095\0 | FA2A8 | 354 | EEAA8 | 1F0046006C006F006100740069006E006700200070006F0069006E00740020006400690076006900730069006F006E002000 | ..F.l.o.a.t.i.n.g. .p.o.i.n.t. .d.i.v.i.s.i.o.n. . |
| \STRING\4096\0 | FA5FC | 2B8 | EEDFC | 09003C0075006E006B006E006F0077006E003E002100270025007300270020006900730020006E006F007400200061002000 | ..<.u.n.k.n.o.w.n.>.!.'.%.s.'. .i.s. .n.o.t. .a. . |
| \RCDATA\DVCLAL\0 | FA8B4 | 10 | EF0B4 | 263D4F38C28237B8F3244203179B3A83 | &=O8..7..$B...:. |
| \RCDATA\PACKAGEINFO\0 | FA8C4 | 230 | EF0C4 | 0000108C000000002000000001676C69626375726C00100453797374656D2E4D61736B730010E953797374656D2E52544C43 | ........ ....glibcurl...System.Masks...System.RTLC |
| \RCDATA\PLATFORMTARGETS\1033 | FAAF4 | 2 | EF2F4 | 0100 | .. |
| \VERSION\1\1033 | FAAF8 | 1F4 | EF2F8 | F40134000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000000 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • 1.0.0.0 • kernel32.dll • oleaut32.dll • .bss • :\NKLastIndexOf@ • SetThreadLocaleversion.dll • SafeArrayCreatenetapi32.dll • advapi32.dll • user32.dll • MessageBoxAkernel32.dll • FLoginFunc |
| Flow Anomalies |
| Offset | RVA | Section | Description |
|---|---|---|---|
| BFB | 4200401C | .text | JMP [static] | Indirect jump to absolute memory address |
| 445C | 4DF288 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4464 | 4DF2F0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 446C | 4DF38C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4474 | 4DF34C | .text | JMP [static] | Indirect jump to absolute memory address |
| 447C | 4DF31C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4484 | 4DF2B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 448C | 4DF27C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4494 | 4DF2E8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 449C | 4DF394 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44A4 | 4DF33C | .text | JMP [static] | Indirect jump to absolute memory address |
| 44AC | 4DF3B8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44B4 | 4DF374 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44BC | 4DF390 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44C4 | 4DF2B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44CC | 4DF36C | .text | JMP [static] | Indirect jump to absolute memory address |
| 44D4 | 4DF2D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44DC | 4DF3BC | .text | JMP [static] | Indirect jump to absolute memory address |
| 44E4 | 4DF32C | .text | JMP [static] | Indirect jump to absolute memory address |
| 44EC | 4DF300 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44F4 | 4DF414 | .text | JMP [static] | Indirect jump to absolute memory address |
| 44FC | 4DF2D8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4504 | 4DF328 | .text | JMP [static] | Indirect jump to absolute memory address |
| 450C | 4DF2FC | .text | JMP [static] | Indirect jump to absolute memory address |
| 4514 | 4DF2E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 451C | 4DF2B0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4524 | 4DF3A8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 452C | 4DF284 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4534 | 4DF348 | .text | JMP [static] | Indirect jump to absolute memory address |
| 453C | 4DF344 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4544 | 4DF364 | .text | JMP [static] | Indirect jump to absolute memory address |
| 454C | 4DF318 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4554 | 4DF3AC | .text | JMP [static] | Indirect jump to absolute memory address |
| 455C | 4DF3D4 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4564 | 4DF3A0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 456C | 4DF40C | .text | JMP [static] | Indirect jump to absolute memory address |
| 4574 | 4DF338 | .text | JMP [static] | Indirect jump to absolute memory address |
| 459C | 4E0094 | .text | JMP [static] | Indirect jump to absolute memory address |
| 45A4 | 4DF460 | .text | JMP [static] | Indirect jump to absolute memory address |
| 45AC | 4DF464 | .text | JMP [static] | Indirect jump to absolute memory address |
| 45B4 | 4DF45C | .text | JMP [static] | Indirect jump to absolute memory address |
| 45BC | 4DF368 | .text | JMP [static] | Indirect jump to absolute memory address |
| 45C4 | 4DF2DC | .text | JMP [static] | Indirect jump to absolute memory address |
| 45CC | 4DF29C | .text | JMP [static] | Indirect jump to absolute memory address |
| 45D4 | 4DF3C0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 45DC | 4DF420 | .text | JMP [static] | Indirect jump to absolute memory address |
| 45E4 | 4DF440 | .text | JMP [static] | Indirect jump to absolute memory address |
| 45EC | 4DF43C | .text | JMP [static] | Indirect jump to absolute memory address |
| 45F4 | 4DF330 | .text | JMP [static] | Indirect jump to absolute memory address |
| 461C | 4E0090 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4650 | 4DF2CC | .text | JMP [static] | Indirect jump to absolute memory address |
| 4658 | 4DF2A8 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4660 | 4DF3D0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 4668 | 4DF38C | .text | JMP [static] | Indirect jump to absolute memory address |
| 61F0 | 4D5760 | .text | CALL [static] | Indirect call to absolute memory address |
| 6208 | 4D5754 | .text | CALL [static] | Indirect call to absolute memory address |
| 6224 | 4D5758 | .text | CALL [static] | Indirect call to absolute memory address |
| 6245 | 4D575C | .text | CALL [static] | Indirect call to absolute memory address |
| 625E | 4D5758 | .text | CALL [static] | Indirect call to absolute memory address |
| 6277 | 4D5754 | .text | CALL [static] | Indirect call to absolute memory address |
| 62CB | 4D9028 | .text | CALL [static] | Indirect call to absolute memory address |
| 630A | 4D9010 | .text | CALL [static] | Indirect call to absolute memory address |
| 69FC | 4D903C | .text | CALL [static] | Indirect call to absolute memory address |
| 6DFA | FFC0 | .text | JMP [static] | Indirect jump to absolute memory address |
| 8150 | 4D901C | .text | CALL [static] | Indirect call to absolute memory address |
| 816E | 4D901C | .text | CALL [static] | Indirect call to absolute memory address |
| 8186 | 4D901C | .text | CALL [static] | Indirect call to absolute memory address |
| 81F8 | 4D901C | .text | CALL [static] | Indirect call to absolute memory address |
| 8218 | 4D901C | .text | CALL [static] | Indirect call to absolute memory address |
| 8235 | 4D901C | .text | CALL [static] | Indirect call to absolute memory address |
| 8312 | 4D9020 | .text | CALL [static] | Indirect call to absolute memory address |
| 8417 | 4D9018 | .text | CALL [static] | Indirect call to absolute memory address |
| 849A | 4D9020 | .text | CALL [static] | Indirect call to absolute memory address |
| 863A | 4D901C | .text | JMP [static] | Indirect jump to absolute memory address |
| 87C0 | 4D9020 | .text | CALL [static] | Indirect call to absolute memory address |
| 8C13 | 4D935C | .text | CALL [static] | Indirect call to absolute memory address |
| 8D8C | 4D9038 | .text | CALL [static] | Indirect call to absolute memory address |
| 8E39 | 4D5030 | .text | CALL [static] | Indirect call to absolute memory address |
| 8E9E | 4D5034 | .text | CALL [static] | Indirect call to absolute memory address |
| A159 | 4D500C | .text | CALL [static] | Indirect call to absolute memory address |
| A2C5 | 4D5010 | .text | CALL [static] | Indirect call to absolute memory address |
| A3A1 | 4D5014 | .text | CALL [static] | Indirect call to absolute memory address |
| B67B | FF | .text | JMP [static] | Indirect jump to absolute memory address |
| BAAF | 4DBC00 | .text | CALL [static] | Indirect call to absolute memory address |
| BACC | 4DBC00 | .text | CALL [static] | Indirect call to absolute memory address |
| BAED | 4DBC08 | .text | CALL [static] | Indirect call to absolute memory address |
| BB4B | 4DBC04 | .text | CALL [static] | Indirect call to absolute memory address |
| BBA8 | 4DBC04 | .text | CALL [static] | Indirect call to absolute memory address |
| BBDB | 4DBC04 | .text | CALL [static] | Indirect call to absolute memory address |
| F16C | 4DF300 | .text | JMP [static] | Indirect jump to absolute memory address |
| F174 | 4DF3B4 | .text | JMP [static] | Indirect jump to absolute memory address |
| F17C | 4DF28C | .text | JMP [static] | Indirect jump to absolute memory address |
| F184 | 4DF298 | .text | JMP [static] | Indirect jump to absolute memory address |
| F18C | 4DF320 | .text | JMP [static] | Indirect jump to absolute memory address |
| F194 | 4DF39C | .text | JMP [static] | Indirect jump to absolute memory address |
| F19C | 4DF3A4 | .text | JMP [static] | Indirect jump to absolute memory address |
| F1A4 | 4DF32C | .text | JMP [static] | Indirect jump to absolute memory address |
| F1AC | 4DF354 | .text | JMP [static] | Indirect jump to absolute memory address |
| F1B4 | 4DF36C | .text | JMP [static] | Indirect jump to absolute memory address |
| F1BC | 4DF2E4 | .text | JMP [static] | Indirect jump to absolute memory address |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 2498165 | 56,6615% |
| Null Byte Code | 1425325 | 32,3281% |
© 2026 All rights reserved.