PESCAN.IO - Analysis Report Basic

File Structure
Analysis Image
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
Information
Icon: Icon
Size: 3,44 MB
SHA-256 Hash: 03D623BBB0EF63709E3CC299A146093F97D3A4EE1F46B2B55465B1304B372F7E
SHA-1 Hash: 464C5178A0A9240CBAC4DA4DD4539B1B44C7C929
MD5 Hash: E8543A0575B20BFDF3E7A3EB4C717A62
Imphash: 32FBE81DFEDD5C097347C36839CA94C4
MajorOSVersion: 6
MinorOSVersion: 1
CheckSum: 00370C0B
EntryPoint (rva): 2BA67C
SizeOfHeaders: 400
SizeOfImage: 37C000
ImageBase: 400000
Architecture: x86
ExportTable: 2D2000
ImportTable: 2CD000
IAT: 2CD9F8
Characteristics: 818F
TimeDateStamp: 60C4FA11
Date: 12/06/2021 18:16:49
File Type: EXE
Number Of Sections: 10
ASLR: Disabled
Section Names: .text, .itext, .data, .bss, .idata, .didata, .edata, .tls, .rdata, .rsrc
Number Of Executable Sections: 2
Subsystem: Windows GUI
UAC Execution Level Manifest: asInvoker
Sections Info
Section Name Flags ROffset RSize VOffset VSizeEntropyChi2
.text
0x60000020
Code
Executable
Readable
 400 2B6C00 1000 2B6AF0
6.4456
27654212.51
.itext
0x60000020
Code
Executable
Readable
 2B7000 2A00 2B8000 28B0
6.1561
144336.29
.data
0xC0000040
Initialized Data
Readable
Writeable
 2B9A00 9400 2BB000 9304
6.2301
840901.38
.bss
0xC0000000
Readable
Writeable
 0 0 2C5000 76F0
N/A
N/A
.idata
0xC0000040
Initialized Data
Readable
Writeable
 2C2E00 3A00 2CD000 39C8
5.3386
258978.38
.didata
0xC0000040
Initialized Data
Readable
Writeable
 2C6800 C00 2D1000 BDE
4.3824
141420.5
.edata
0x40000040
Initialized Data
Readable
 2C7400 200 2D2000 97
1.8636
79735
.tls
0xC0000000
Readable
Writeable
 0 0 2D3000 4C
N/A
N/A
.rdata
0x40000040
Initialized Data
Readable
 2C7600 200 2D4000 5D
1.3705
93364
.rsrc
0x40000040
Initialized Data
Readable
 2C7800 A6C00 2D5000 A6C00
6.5268
9447936.81
Description
CompanyName: Wondershare Software
LegalCopyright: Copyright 2025 Wondershare. All rights reserved.
ProductName: Wondershare NativePush
FileVersion: 51.1052.0.0
ProductVersion: 1.1.1.0
Comments: ModifyPath
Language: Chinese (Peoples Republic of China) (ID=0x804)
CodePage: Unknown (0x0) (0x0)
Entry Point
The section number (2) - (.itext) have the Entry Point
Information -> EntryPoint (calculated) - 2B967C
Code -> 558BEC83C4F0535657B824F56A00E87168D5FFA1E03F6C008B008B80880100006AEC50E8E0ABD5FF8B15E03F6C008B128B92
Assembler
|PUSH EBP
|MOV EBP, ESP
|ADD ESP, -0X10
|PUSH EBX
|PUSH ESI
|PUSH EDI
|MOV EAX, 0X6AF524
|CALL 0X410F00
|MOV EAX, DWORD PTR [0X6C3FE0]
|MOV EAX, DWORD PTR [EAX]
|MOV EAX, DWORD PTR [EAX + 0X188]
|PUSH -0X14
|PUSH EAX
|CALL 0X415284
|MOV EDX, DWORD PTR [0X6C3FE0]
|MOV EDX, DWORD PTR [EDX]
Signatures
CheckSum Integrity Problem:
• Header: 3607563
• Calculated: 3632831
Certificate - Digital Signature:
• The file is signed but has been modified
Packer/Compiler
Detect It Easy (die)
• PE: compiler: Embarcadero Delphi(10.3 Rio)[-]
• PE: linker: Turbo Linker(2.25*,Delphi)[-]
• PE: Sign tool: Windows Authenticode(2.0)[PKCS 7]
• Entropy: 6.56834
Suspicious Functions
Library Function Description
KERNEL32.DLL GetProcAddress | Possible Call API By Name Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL GetVersion | Possible Call API By Name Retrieves the operating system version.
ADVAPI32.DLL RegDeleteKeyExA | Possible Call API By Name Deletes a registry key.
ADVAPI32.DLL RegDeleteKeyExW | Possible Call API By Name Deletes a registry key.
KERNEL32.DLL CreateMutexW Create a named or unnamed mutex object for controlling access to a shared resource.
KERNEL32.DLL VirtualAlloc Reserve, commit, or both, a region of memory within the virtual address space of a process.
KERNEL32.DLL CopyFileW Copies an existing file to a new file.
KERNEL32.DLL WriteFile Writes data to a specified file or input/output (I/O) device.
KERNEL32.DLL LoadLibraryA Loads the specified module into the address space of the calling process.
KERNEL32.DLL LoadLibraryW Loads the specified module into the address space of the calling process.
KERNEL32.DLL GetModuleHandleW Retrieves a handle to the specified module.
KERNEL32.DLL GetProcAddress Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
KERNEL32.DLL IsDebuggerPresent Determines if the calling process is being debugged by a user-mode debugger.
KERNEL32.DLL CreateFileW Creates or opens a file object.
KERNEL32.DLL ReadFile Reads data from a file.
KERNEL32.DLL FindFirstFileW Starts file and directory enumeration.
KERNEL32.DLL FindNextFileW Continues file and directory enumeration.
KERNEL32.DLL FindClose Closes a file search handle.
KERNEL32.DLL ExitThread Terminates the current thread.
KERNEL32.DLL CloseHandle Closes an open object handle.
KERNEL32.DLL VirtualProtect Changes memory protection attributes.
KERNEL32.DLL CreateProcessW Creates and starts a new process.
KERNEL32.DLL ResumeThread Resumes a suspended thread.
KERNEL32.DLL CreateEventW Creates or opens an event object.
KERNEL32.DLL GetSystemInfo Retrieves system hardware information.
KERNEL32.DLL GetVersion Retrieves the operating system version.
KERNEL32.DLL OpenProcess Opens an existing process.
ADVAPI32.DLL RegCreateKeyExW Creates or opens a registry key.
ADVAPI32.DLL RegOpenKeyExW Opens an existing registry key.
ADVAPI32.DLL RegSetValueExW Writes data to a registry value.
SHELL32.DLL ShellExecuteW Performs a run operation on a specific file.
SHELL32.DLL ShellExecuteExW Performs a run operation on a specific file.
Windows REG (UNICODE)
Software\Microsoft\Windows\CurrentVersion
Software\Microsoft\Windows\CurrentVersion\RunOnce
Software\Microsoft\Windows NT\CurrentVersion\Fonts
Software\Microsoft\Windows\CurrentVersion\Fonts
Software\Microsoft\Windows\CurrentVersion\SharedDLLs
Software\Embarcadero\Locales
Software\CodeGear\Locales
Software\Borland\Locales
Software\Borland\Delphi\Locales
SOFTWARE\Microsoft\Windows NT\CurrentVersion\FontSubstitutes
Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
SOFTWARE\Microsoft\.NETFramework
SOFTWARE\Microsoft\.NETFramework\Policy\v4.0
SOFTWARE\Microsoft\.NETFramework\Policy\v2.0
SOFTWARE\Microsoft\.NETFramework\Policy\v1.1
SOFTWARE\Microsoft\NET Framework Setup\NDP\
Software\Microsoft\Windows\CurrentVersion\App Paths\
Software\Microsoft\Windows\CurrentVersion\Uninstall
SOFTWARE\Microsoft\Windows NT\CurrentVersion
SYSTEM\CurrentControlSet\Control\Session Manager
SYSTEM\CurrentControlSet\Control\Keyboard Layouts\
System\CurrentControlSet\Control\Keyboard Layouts\%.8x
System\CurrentControlSet\Control\Windows
System\CurrentControlSet\Control\ProductOptions
Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Rebuilt string - SOFTWARE\Microsoft\Windows\CurrentVersion\Run
File Access
Setup.exe
TTask.Exe
TTask.Exe
version.dll
netutils.dll
netapi32.dll
mpr.dll
OLEAUT32.dll
SHELL32.dll
ADVAPI32.dll
KERNEL32.dll
SHLWAPI.dll
COMCTL32.dll
Crypt32.dll
Shcore.dll
DWMAPI.DLL
imm32.dll
uxtheme.dll
msimg32.dll
user32.dll
wtsapi32.dll
gdi32.dll
ole32.dll
winhttp.dll
msvcrt.dll
comdlg32.dll
DWinapi.MsI
Winapi.PenInputPanelWinapi.MsI
dSystem.Sys
System.Sys
SysInitSystemSystem.RTLConstsSystem.RttiSystem.Sys
TaskDialogSystem.TypInfoSystem.Sys
System.Sys
?System.Sys
&System.Dat
@.dat
System.Dat
System.Word,System.Dat
System.Dat
lttInvalidSystem.Dat
.dat
/TDefaultLoginCredentials.Log
/TDefaultLoginCredentials.Log
TDefaultLoginCredentials.Log
*TDefaultLoginCredentials.Log
System.Ini
Temp
WinDir
AppData
File Access (UNICODE)
WININIT.INI
kernel32.dll
Msctf.dll
comctl32.dll
user32.dll
advapi32.dll
uxtheme.dll
oleacc.dll
shell32.dll
cmd.exe
regsvr32.exe
winhttp.dll
ntmarta.dll
clbcatq.dll
comres.dll
profapi.dll
version.dll
cryptbase.dll
dwmapi.dll
propsys.dll
apphelp.dll
setupapi.dll
userenv.dll
_isetup\_iscrypt.dll
_isetup\_isdecmp.dll
shfolder.dll
msi.dll
Fusion.dll
OLEAUT32.DLL
Rstrtmgr.dll
sfc.dll
shlwapi.dll
RICHED20.DLL
MSFTEDIT.DLL
imm32.dll
ole32.dll
oleaut32.dll
GetLogicalProcessorInformationkernel32.dll
3u.txt
Desktop.ini
desktop.ini
win.ini
Temp
ProgramFiles
AppData
UserProfile
Interest's Words
PADDINGX
ToolBar
Encrypt
Decrypt
Encryption
PassWord
exec
attrib
start
pause
hostname
shutdown
systeminfo
ping
expand
replace
route
setx
Interest's Words (UNICODE)
ToolBar
PassWord
exec
regsvr32
netsh
attrib
start
shutdown
systeminfo
ping
expand
replace
route
URLs
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://ocsp.digicert.com
http://cacerts.digicert.com/DigiCertTrustedRootG4.crt
http://crl3.digicert.com/DigiCertTrustedRootG4.crl
http://www.digicert.com/CPS0
http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl
http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt
http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt
http://ocsp.sectigo.com
http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl
http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0
http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl
http://ocsp.usertrust.com
https://sectigo.com/CPS0
URLs (UNICODE)
http://direct:80
http://www.skygz.com
http://skygz.taobao.com
Inno Setup ;Nu
http://www.innosetup.com
http://www.remobjects.com/ps
PE Carving
Start Offset Header End Offset Size (Bytes)
0 31B1B4 31B1B4
31B1B4 370F58 55DA4
Strings/Hex Code Found With The File Rules
Rule Type Encoding Matched (Word)
Text Unicode Privileges (SeShutdownPrivilege)
Text Unicode Keyboard Key (Alt+)
Text Ascii Keyboard Key (Scroll)
Text Unicode Keyboard Key (Scroll)
Text Unicode Keyboard Key (UpArrow)
Text Ascii Keyboard Key (PageDown)
Text Ascii Keyboard Key (PageUp)
Text Ascii Information used to authenticate a user’s identity (Credential)
Text Unicode Information used to authenticate a user’s identity (Credential)
Text Ascii Ability to remain on a system after a reboot (Persistence)
Text Ascii Process of gathering information about network resources (Enumeration)
Text Ascii Information used for user authentication (Credential)
Text Unicode Information used for user authentication (Credential)
Text Ascii Malicious rerouting of traffic to an attacker-controlled site (Redirect)
Text Unicode Malicious rerouting of traffic to an attacker-controlled site (Redirect)
Text Ascii Technique used to capture communications between systems (Intercept)
Entry Point Hex Pattern Borland Delphi 4.0
Entry Point Hex Pattern Borland Delphi v3.0
Entry Point Hex Pattern Microsoft Visual C++ 8
Entry Point Hex Pattern Microsoft Visual C++ 8.0
Resources
Path DataRVA Size FileOffset CodeTextPE/Payload
\CURSOR\1\1033 2D6170 134 2C8970 070001002800000020000000400000000100010000000000000200000000000000000000000000000000000000000000FFFF....(... ...@.....................................N/A
\CURSOR\2\1033 2D62A4 134 2C8AA4 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF....(... ...@.....................................N/A
\CURSOR\3\1033 2D63D8 134 2C8BD8 000000002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF....(... ...@.....................................N/A
\CURSOR\4\1033 2D650C 134 2C8D0C 0E000C002800000020000000400000000100010000000000800000000000000000000000020000000000000000000000FFFF....(... ...@.....................................N/A
\CURSOR\5\1033 2D6640 134 2C8E40 10000E002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF....(... ...@.....................................N/A
\CURSOR\6\1033 2D6774 134 2C8F74 000000002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF....(... ...@.....................................N/A
\CURSOR\7\1033 2D68A8 134 2C90A8 020002002800000020000000400000000100010000000000800000000000000000000000000000000000000000000000FFFF....(... ...@.....................................N/A
\ICON\1\2052 2D69DC EA8 2C91DC 28000000300000006000000001000800000000000009000000000000000000000001000000010000000000000A0A0A000C0C(...0............................................N/A
\ICON\2\2052 2D7884 8A8 2CA084 2800000020000000400000000100080000000000000400000000000000000000000100000001000000000000060606000909(... ...@.........................................N/A
\ICON\3\2052 2D812C 6C8 2CA92C 2800000018000000300000000100080000000000400200000000000000000000000100000001000000000000070707001717(.......0...........@.............................N/A
\ICON\4\2052 2D87F4 568 2CAFF4 2800000010000000200000000100080000000000000100000000000000000000000100000001000000000000050505002323(....... .......................................N/A
\ICON\5\2052 2D8D5C 6511 2CB55C 89504E470D0A1A0A0000000D49484452000001000000010008060000005C72A866000000097048597300000EC300000EC301.PNG........IHDR.............\r.f....pHYs.........N/A
\ICON\6\2052 2DF270 10828 2D1A70 2800000080000000000100000100200000000000000801000000000000000000000000000000000000000000000000000000(............. ...................................N/A
\ICON\7\2052 2EFA98 94A8 2E2298 2800000060000000C00000000100200000000000809400000000000000000000000000000000000000000000000000000000(............ ...................................N/A
\ICON\8\2052 2F8F40 67E8 2EB740 2800000050000000A00000000100200000000000C06700000000000000000000000000000000000000000000000000000000(...P......... ......g............................N/A
\ICON\9\2052 2FF728 5488 2F1F28 2800000048000000900000000100200000000000605400000000000000000000000000000000000000000000000000000000(...H......... .....T............................N/A
\ICON\10\2052 304BB0 4228 2F73B0 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000(...@......... ......B............................N/A
\ICON\11\2052 308DD8 25A8 2FB5D8 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000(...0........ ......%............................N/A
\ICON\12\2052 30B380 10A8 2FDB80 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000(... ...@..... ...................................N/A
\ICON\13\2052 30C428 988 2FEC28 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000(.......0..... ..................................N/A
\ICON\14\2052 30CDB0 468 2FF5B0 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000(....... ..... .....@.............................N/A
\ICON\15\1033 30D218 4228 2FFA18 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000(...@......... ......B............................N/A
\ICON\16\1033 311440 25A8 303C40 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000(...0........ ......%............................N/A
\ICON\17\1033 3139E8 10A8 3061E8 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000(... ...@..... ...................................N/A
\ICON\18\1033 314A90 4228 307290 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000(...@......... ......B............................N/A
\ICON\19\1033 318CB8 25A8 30B4B8 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000(...0........ ......%............................N/A
\ICON\20\1033 31B260 4228 30DA60 2800000040000000800000000100200000000000004200000000000000000000000000000000000000000000000000000000(...@......... ......B............................N/A
\ICON\21\1033 31F488 25A8 311C88 2800000030000000600000000100200000000000802500000000000000000000000000000000000000000000000000000000(...0........ ......%............................N/A
\ICON\22\1033 321A30 10A8 314230 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000(... ...@..... ...................................N/A
\ICON\23\1033 322AD8 10A8 3152D8 2800000020000000400000000100200000000000801000000000000000000000000000000000000000000000000000000000(... ...@..... ...................................N/A
\ICON\24\1033 323B80 988 316380 2800000018000000300000000100200000000000600900000000000000000000000000000000000000000000000000000000(.......0..... ..................................N/A
\ICON\25\1033 324508 468 316D08 2800000010000000200000000100200000000000400400000000000000000000000000000000000000000000000000000000(....... ..... .....@.............................N/A
\STRING\4073\0 324970 24C 317170 1E004500720072006F00720020006F0062007400610069006E0069006E0067002000730065007300730069006F006E002000..E.r.r.o.r. .o.b.t.a.i.n.i.n.g. .s.e.s.s.i.o.n. .N/A
\STRING\4074\0 324BBC 44C 3173BC 250053006300680065006D00650020002200250073002200200061006C007200650061006400790020007200650067006900%.S.c.h.e.m.e. .".%.s.". .a.l.r.e.a.d.y. .r.e.g.i.N/A
\STRING\4075\0 325008 288 317808 130043006F0075006C00640020006E006F0074002000630061006C006C002000700072006F0063001A004F00750074002000..C.o.u.l.d. .n.o.t. .c.a.l.l. .p.r.o.c...O.u.t. .N/A
\STRING\4076\0 325290 214 317A90 1000430061006E006E006F007400200049006D0070006F00720074002000250073000C0049006E00760061006C0069006400..C.a.n.n.o.t. .I.m.p.o.r.t. .%.s...I.n.v.a.l.i.d.N/A
\STRING\4077\0 3254A4 294 317CA4 0600076898980D4EFD803A4E7A7A0B0037680F5F20001C20250073001D202000F25DE86C8C5110007B7C20001C2025007300...h...N..:Nzz..7h._ .. %.s.. ..].l.Q..{| .. %.s.N/A
\STRING\4078\0 325738 208 317F38 0C00CE4E5C50609711682D4E20526496A763F64EF665FA511995080020002D007E620D4E30525C5060973A530A0020002D00...N\P..h-N Rd..c.N.e.Q.... .-.~b.N0R\P.:S.. .-.N/A
\STRING\4079\0 325940 EC 318140 040048006F006D00650004004C00650066007400020055007000050052006900670068007400040044006F0077006E000300..H.o.m.e...L.e.f.t...U.p...R.i.g.h.t...D.o.w.n...N/A
\STRING\4080\0 325A2C C0 31822C 06002E5EA95228002600480029000600C87E626B28002600410029000600CD91D58B28002600520029000600FD5F65752800....R(.&.H.)....~bk(.&.A.).......(.&.R.)...._eu(.N/A
\STRING\4081\0 325AEC 118 3182EC 0600DC835553227D155F8A8D4C750700DC835553D2636551864E244E216B0800505BDC8355530D4E2857DC8355532D4E0A00....US"}._..Lu....US.ceQ.N$N!k..P[..US.N(W..US-N..N/A
\STRING\4082\0 325C04 1D8 318404 0700E06548658476FE56CF5027590F5C0D00E06548658476200049006D006100670065004C006900730074001000E0654865...eHe.v.V.P’Y.\...eHe.v .I.m.a.g.e.L.i.s.t....eHeN/A
\STRING\4083\0 325DDC 328 3185DC 240053004800410032003A002000430061006E006E006F007400200075007000640061007400650020006100200066006900$.S.H.A.2.:. .C.a.n.n.o.t. .u.p.d.a.t.e. .a. .f.i.N/A
\STRING\4084\0 326104 418 318904 1600570069006E0064006F007700730020005300650072007600650072002000320030003000330020005200320013005700..W.i.n.d.o.w.s. .S.e.r.v.e.r. .2.0.0.3. .R.2...W.N/A
\STRING\4085\0 32651C 370 318D1C 350049006E00730075006600660069006300690065006E00740020005200540054004900200061007600610069006C0061005.I.n.s.u.f.f.i.c.i.e.n.t. .R.T.T.I. .a.v.a.i.l.a.N/A
\STRING\4086\0 32688C 39C 31908C 320053006F007500720063006500200061006E0064002000440065007300740069006E006100740069006F006E00200061002.S.o.u.r.c.e. .a.n.d. .D.e.s.t.i.n.a.t.i.o.n. .a.N/A
\STRING\4087\0 326C28 4A4 319428 24004F007000650072006100740069006F006E0020006E006F007400200061006C006C006F0077006500640020006F006E00$.O.p.e.r.a.t.i.o.n. .n.o.t. .a.l.l.o.w.e.d. .o.n.N/A
\STRING\4088\0 3270CC 384 3198CC 240027002700250073002700270020006900730020006E006F007400200061002000760061006C0069006400200063006F00$.’.’.%.s.’.’. .i.s. .n.o.t. .a. .v.a.l.i.d. .c.o.N/A
\STRING\4089\0 327450 454 319C50 4E004E006F0020006D0061007000700069006E006700200066006F0072002000740068006500200055006E00690063006F00N.N.o. .m.a.p.p.i.n.g. .f.o.r. .t.h.e. .U.n.i.c.o.N/A
\STRING\4090\0 3278A4 210 31A0A4 03005300610074000600530075006E0064006100790006004D006F006E006400610079000700540075006500730064006100..S.a.t...S.u.n.d.a.y...M.o.n.d.a.y...T.u.e.s.d.a.N/A
\STRING\4091\0 327AB4 BC 31A2B4 05004D006100720063006800050041007000720069006C0003004D006100790004004A0075006E00650004004A0075006C00..M.a.r.c.h...A.p.r.i.l...M.a.y...J.u.n.e...J.u.l.N/A
\STRING\4092\0 327B70 100 31A370 1E00530079007300740065006D0020004500720072006F0072002E002000200043006F00640065003A002000250064002E00..S.y.s.t.e.m. .E.r.r.o.r... . .C.o.d.e.:. .%.d...N/A
\STRING\4093\0 327C70 338 31A470 1000560061007200690061006E00740020006F0076006500720066006C006F007700100049006E00760061006C0069006400..V.a.r.i.a.n.t. .o.v.e.r.f.l.o.w...I.n.v.a.l.i.d.N/A
\STRING\4094\0 327FA8 3F0 31A7A8 310046006F0072006D006100740020002700250073002700200069006E00760061006C006900640020006F007200200069001.F.o.r.m.a.t. .’.%.s.’. .i.n.v.a.l.i.d. .o.r. .i.N/A
\STRING\4095\0 328398 314 31AB98 1100520061006E0067006500200063006800650063006B0020006500720072006F007200100049006E007400650067006500..R.a.n.g.e. .c.h.e.c.k. .e.r.r.o.r...I.n.t.e.g.e.N/A
\STRING\4096\0 3286AC 2F8 31AEAC 2100270025007300270020006900730020006E006F007400200061002000760061006C0069006400200069006E0074006500!.’.%.s.’. .i.s. .n.o.t. .a. .v.a.l.i.d. .i.n.t.e.N/A
\RCDATA\DVCLAL\0 3289A4 10 31B1A4 263D4F38C28237B8F3244203179B3A83&=O8..7..$B...:.N/A
\RCDATA\HELPER_EXE_AMD64\1033 3289B4 1800 31B1B4 4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000000000000000000000MZ......................@.........................(Executable found)
\RCDATA\PACKAGEINFO\0 32A1B4 BC0 31C9B4 000010CC00000000C40000000171536574757000104E75505344656275676765720010EC7550535574696C730000C9537973.............qSetup..NuPSDebugger...uPSUtils...SysN/A
\RCDATA\TMAINFORM\0 32AD74 13E 31D574 5450463009544D61696E466F726D084D61696E466F726D044C656674020103546F70025F0C436C69656E7448656967687403TPF0.TMainForm.MainForm.Left...Top._.ClientHeight.N/A
\RCDATA\TNEWDISKFORM\0 32AEB4 477 31D6B4 545046300C544E65774469736B466F726D0B4E65774469736B466F726D044C65667403E20003546F7003A2000B426F726465TPF0.TNewDiskForm.NewDiskForm.Left....Top....BordeN/A
\RCDATA\TSELECTFOLDERFORM\0 32B32C 3F7 31DB2C 54504630115453656C656374466F6C646572466F726D1053656C656374466F6C646572466F726D044C65667403C80003546FTPF0.TSelectFolderForm.SelectFolderForm.Left....ToN/A
\RCDATA\TSELECTLANGUAGEFORM\0 32B724 4AC 31DF24 54504630135453656C6563744C616E6775616765466F726D1253656C6563744C616E6775616765466F726D044C65667403C8TPF0.TSelectLanguageForm.SelectLanguageForm.Left..N/A
\RCDATA\TUNINSTALLPROGRESSFORM\0 32BBD0 7DA 31E3D0 545046301654556E696E7374616C6C50726F6772657373466F726D15556E696E7374616C6C50726F6772657373466F726D04TPF0.TUninstallProgressForm.UninstallProgressForm.N/A
\RCDATA\TUNINSTSHAREDFILEFORM\0 32C3AC 553 31EBAC 545046301554556E696E737453686172656446696C65466F726D14556E696E737453686172656446696C65466F726D044C65TPF0.TUninstSharedFileForm.UninstSharedFileForm.LeN/A
\RCDATA\TWIZARDFORM\0 32C900 2AC0 31F100 545046300B5457697A617264466F726D0A57697A617264466F726D044C65667403BF0003546F70038B000B426F7264657249TPF0.TWizardForm.WizardForm.Left....Top....BorderIN/A
\GROUP_CURSOR\32761\1033 32F3C0 14 321BC0 0000020001002000400001000100340100000100...... .@.....4.....N/A
\GROUP_CURSOR\32762\1033 32F3D4 14 321BD4 0000020001002000400001000100340100000200...... .@.....4.....N/A
\GROUP_CURSOR\32763\1033 32F3E8 14 321BE8 0000020001002000400001000100340100000300...... .@.....4.....N/A
\GROUP_CURSOR\32764\1033 32F3FC 14 321BFC 0000020001002000400001000100340100000400...... .@.....4.....N/A
\GROUP_CURSOR\32765\1033 32F410 14 321C10 0000020001002000400001000100340100000500...... .@.....4.....N/A
\GROUP_CURSOR\32766\1033 32F424 14 321C24 0000020001002000400001000100340100000600...... .@.....4.....N/A
\GROUP_CURSOR\32767\1033 32F438 14 321C38 0000020001002000400001000100340100000700...... .@.....4.....N/A
\GROUP_ICON\MAINICON\2052 32F44C CA 321C4C 000001000E003030000001000800A80E000001002020000001000800A808000002001818000001000800C806000003001010......00............ ............................N/A
\GROUP_ICON\Z_DIRICON\1033 32F518 30 321D18 0000010003004040000001002000284200000F003030000001002000A825000010002020000001002000A81000001100......@@.... .(B....00.... ..%.... .... .......N/A
\GROUP_ICON\Z_DISKICON\1033 32F548 22 321D48 00000100020040400000010020002842000012003030000001002000A82500001300......@@.... .(B....00.... ..%....N/A
\GROUP_ICON\Z_GROUPICON\1033 32F56C 30 321D6C 00000100030040400000010020002842000014003030000001002000A825000015002020000001002000A81000001600......@@.... .(B....00.... ..%.... .... .......N/A
\GROUP_ICON\Z_STOPICON\1033 32F59C 30 321D9C 0000010003002020000001002000A8100000170018180000010020008809000018001010000001002000680400001900...... .... ............. ............. .h.....N/A
\VERSION\1\1033 32F5CC 4D0 321DCC D00434000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001001C04..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...............N/A
\24\1\1033 32FA9C 726 32229C 3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D225554462D3822207374616E64616C6F6E653D2279<?xml version="1.0" encoding="UTF-8" standalone="yN/A
Intelligent String
• user32.dll
• kernel32.dll
• shell32.dll
• comctl32.dll
• winhttp.dll
• version.dll
• uxtheme.dll
• .msg
• advapi32.dll
• .dat
• .lst
• .exe
• target.lnk
• .tmp
• System.Net.HttpClient.Win
• .lnk
• .pif
• WININIT.INI
• oleacc.dll
• ole32.dll
• TaskDialogIndirect
• .bss
• @.tls
• oleaut32.dll
• 3TLoginCredentialService.TLoginCredentialEventObject:l/GCreate
• TLoginCredentialServiceM/GRegisterLoginHandler
• O0GUnregisterLoginHandler
• E(kGetLoginCredentialEventDE
• X(kGetLoginCredentials
• H(kGetLoginCredentials
• Z(kGetLoginCredentials
• j(kGetLoginCredentials
• Msctf.dll
• imm32.dll
• LoginEvent
• bTLoginEventUsrPw
• MSFTEDIT.DLL
• RICHED20.DLL
• shlwapi.dll
• c:\directory
• sfc.dll
• .bat
• .cmd
• cmd.exe" /C "
• COMMAND.COM" /C
• %s Log %s %.3u.txt
• %s-%d.bin
• %s-%d%s.bin
• Rstrtmgr.dll
• OLEAUT32.DLL
• \\.\pipe\InnoSetup64BitHelper-%.8x-%.8x-%.8x-%.8x%.8x
• Fusion.dll
• .hlp
• .gid
• .fts
• .chm
• .chw
• win.ini
• http://direct:80
• desktop.ini
• .url
• Desktop.ini
• msi.dll
• runas
• cmd.exe
• COMMAND.COM
• \_setup64.tmp
• shfolder.dll
• _isetup\_isdecmp.dll
• _isetup\_iscrypt.dll
• -0.bin
• http://www.skygz.com
• http://skygz.taobao.com
• http://www.innosetup.com
• http://www.remobjects.com/ps
• /SECONDPHASE="%s" /FIRSTPHASEWND=$%x
• isRS-???.tmp
• isRS-%.3u.tmp
• userenv.dll
• setupapi.dll
• apphelp.dll
• propsys.dll
• dwmapi.dll
• cryptbase.dll
• profapi.dll
• comres.dll
• clbcatq.dll
• ntmarta.dll
• mpr.dll
• msvcrt.dll
• SetThreadLocaleole32.dll
• MessageBoxAwtsapi32.dll
• msimg32.dll
• DWMAPI.DLL
• Crypt32.dll
• COMCTL32.dll
• <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
Flow Anomalies
Offset FlowVA Section Description
C33 4300401D .text JMP [static] | Indirect jump to absolute memory address
28AB 43004043 .text JMP [static] | Indirect jump to absolute memory address
454C 6CDEF0 .text JMP [static] | Indirect jump to absolute memory address
4554 6CDF38 .text JMP [static] | Indirect jump to absolute memory address
455C 6CE0D8 .text JMP [static] | Indirect jump to absolute memory address
4564 6CE03C .text JMP [static] | Indirect jump to absolute memory address
456C 6CE040 .text JMP [static] | Indirect jump to absolute memory address
4574 6CE0AC .text JMP [static] | Indirect jump to absolute memory address
457C 6CE08C .text JMP [static] | Indirect jump to absolute memory address
4584 6CE044 .text JMP [static] | Indirect jump to absolute memory address
458C 6CE008 .text JMP [static] | Indirect jump to absolute memory address
4594 6CE060 .text JMP [static] | Indirect jump to absolute memory address
459C 6CE0E4 .text JMP [static] | Indirect jump to absolute memory address
45A4 6CDF74 .text JMP [static] | Indirect jump to absolute memory address
45AC 6CDFE8 .text JMP [static] | Indirect jump to absolute memory address
45B4 6CDFB4 .text JMP [static] | Indirect jump to absolute memory address
45BC 6CE0E0 .text JMP [static] | Indirect jump to absolute memory address
45C4 6CDF24 .text JMP [static] | Indirect jump to absolute memory address
45CC 6CDF9C .text JMP [static] | Indirect jump to absolute memory address
45D4 6CDF30 .text JMP [static] | Indirect jump to absolute memory address
45DC 6CDFEC .text JMP [static] | Indirect jump to absolute memory address
45E4 6CDF60 .text JMP [static] | Indirect jump to absolute memory address
45EC 6CDF48 .text JMP [static] | Indirect jump to absolute memory address
45F4 6CDBD4 .text JMP [static] | Indirect jump to absolute memory address
45FC 6CE05C .text JMP [static] | Indirect jump to absolute memory address
4604 6CDF64 .text JMP [static] | Indirect jump to absolute memory address
460C 6CDF44 .text JMP [static] | Indirect jump to absolute memory address
4614 6CE064 .text JMP [static] | Indirect jump to absolute memory address
461C 6CE034 .text JMP [static] | Indirect jump to absolute memory address
4624 6CDFD0 .text JMP [static] | Indirect jump to absolute memory address
462C 6CDEE4 .text JMP [static] | Indirect jump to absolute memory address
4634 6CE0B0 .text JMP [static] | Indirect jump to absolute memory address
463C 6CE0A8 .text JMP [static] | Indirect jump to absolute memory address
4644 6CE0C0 .text JMP [static] | Indirect jump to absolute memory address
464C 6CE090 .text JMP [static] | Indirect jump to absolute memory address
4654 6CE10C .text JMP [static] | Indirect jump to absolute memory address
465C 6CE138 .text JMP [static] | Indirect jump to absolute memory address
4664 6CE0F8 .text JMP [static] | Indirect jump to absolute memory address
466C 6CDB78 .text JMP [static] | Indirect jump to absolute memory address
4674 6CDF78 .text JMP [static] | Indirect jump to absolute memory address
469C 6D11D8 .text JMP [static] | Indirect jump to absolute memory address
46A4 6CDE68 .text JMP [static] | Indirect jump to absolute memory address
46AC 6CDE3C .text JMP [static] | Indirect jump to absolute memory address
46B4 6CDE58 .text JMP [static] | Indirect jump to absolute memory address
46BC 6CDF98 .text JMP [static] | Indirect jump to absolute memory address
46C4 6CE058 .text JMP [static] | Indirect jump to absolute memory address
46CC 6CE020 .text JMP [static] | Indirect jump to absolute memory address
46D4 6CE098 .text JMP [static] | Indirect jump to absolute memory address
46DC 6CDFF8 .text JMP [static] | Indirect jump to absolute memory address
46E4 6CDDF8 .text JMP [static] | Indirect jump to absolute memory address
46EC 6CDDE8 .text JMP [static] | Indirect jump to absolute memory address
46F4 6CDDE4 .text JMP [static] | Indirect jump to absolute memory address
46FC 6CE094 .text JMP [static] | Indirect jump to absolute memory address
4724 6D11D4 .text JMP [static] | Indirect jump to absolute memory address
4758 6CE054 .text JMP [static] | Indirect jump to absolute memory address
4760 6CDF1C .text JMP [static] | Indirect jump to absolute memory address
4768 6CE004 .text JMP [static] | Indirect jump to absolute memory address
4770 6CE0D8 .text JMP [static] | Indirect jump to absolute memory address
62F8 6BB770 .text CALL [static] | Indirect call to absolute memory address
6310 6BB764 .text CALL [static] | Indirect call to absolute memory address
632C 6BB768 .text CALL [static] | Indirect call to absolute memory address
634D 6BB76C .text CALL [static] | Indirect call to absolute memory address
6366 6BB768 .text CALL [static] | Indirect call to absolute memory address
637F 6BB764 .text CALL [static] | Indirect call to absolute memory address
63F3 6C5028 .text CALL [static] | Indirect call to absolute memory address
6432 6C5010 .text CALL [static] | Indirect call to absolute memory address
67B7 6BB044 .text CALL [static] | Indirect call to absolute memory address
67D5 6BB040 .text CALL [static] | Indirect call to absolute memory address
6A9C 6C503C .text CALL [static] | Indirect call to absolute memory address
771A FFC0 .text JMP [static] | Indirect jump to absolute memory address
8834 6C501C .text CALL [static] | Indirect call to absolute memory address
8852 6C501C .text CALL [static] | Indirect call to absolute memory address
886A 6C501C .text CALL [static] | Indirect call to absolute memory address
88DC 6C501C .text CALL [static] | Indirect call to absolute memory address
88FC 6C501C .text CALL [static] | Indirect call to absolute memory address
8919 6C501C .text CALL [static] | Indirect call to absolute memory address
89F6 6C5020 .text CALL [static] | Indirect call to absolute memory address
8AFB 6C5018 .text CALL [static] | Indirect call to absolute memory address
8B7E 6C5020 .text CALL [static] | Indirect call to absolute memory address
8D1E 6C501C .text JMP [static] | Indirect jump to absolute memory address
8EA4 6C5020 .text CALL [static] | Indirect call to absolute memory address
9277 6C5360 .text CALL [static] | Indirect call to absolute memory address
93F4 6C5038 .text CALL [static] | Indirect call to absolute memory address
949D 6BB038 .text CALL [static] | Indirect call to absolute memory address
9502 6BB03C .text CALL [static] | Indirect call to absolute memory address
B4D5 6BB010 .text CALL [static] | Indirect call to absolute memory address
B64D 6BB014 .text CALL [static] | Indirect call to absolute memory address
B734 6BB018 .text CALL [static] | Indirect call to absolute memory address
D1A3 FF .text JMP [static] | Indirect jump to absolute memory address
D5D7 6C7C04 .text CALL [static] | Indirect call to absolute memory address
D5F4 6C7C04 .text CALL [static] | Indirect call to absolute memory address
D615 6C7C0C .text CALL [static] | Indirect call to absolute memory address
D673 6C7C08 .text CALL [static] | Indirect call to absolute memory address
D6D0 6C7C08 .text CALL [static] | Indirect call to absolute memory address
D703 6C7C08 .text CALL [static] | Indirect call to absolute memory address
FCE4 6CDF48 .text JMP [static] | Indirect jump to absolute memory address
FCEC 6CDF44 .text JMP [static] | Indirect jump to absolute memory address
FCF4 6CE118 .text JMP [static] | Indirect jump to absolute memory address
FCFC 6CDEF4 .text JMP [static] | Indirect jump to absolute memory address
FD04 6CE0EC .text JMP [static] | Indirect jump to absolute memory address
36E400 N/A *Overlay* 582B00000002020030822B4C06092A864886F70D | X+......0.+L..*.H...
Extra Analysis
Metric Value Percentage
Ascii Code 2102969 58,2797%
Null Byte Code 689690 19,1134%
© 2026 All rights reserved.