PESCAN.IO - Analysis Report Basic |
|||||||
| File Structure |
|
PE Chart Code
Header PE (light blue)
Executable sections (pink)
Non-executable sections (black)
External injected code (red)
File Structure in red = malformed or corrupted header
Chart Code For Other Files
Printable characters (blue)
Non-printable characters (black)
| Information |
Icon: Size: 1,43 MBSHA-256 Hash: E3C139102460DB764ED0C0A7070DFDCCE3B34C965D19238FF0B895A3E47EE28A SHA-1 Hash: 4BA8CD8545DB0E727FC16C44432950736C9DF929 MD5 Hash: EE0A26272F3A1EE27C2C821F20829648 Imphash: 63E594B5B2A9839C292C6794C726545A MajorOSVersion: 4 MinorOSVersion: 0 CheckSum: 00000000 EntryPoint (rva): D14CF SizeOfHeaders: 1000 SizeOfImage: 176000 ImageBase: 10000000 Architecture: x86 ExportTable: 12AE40 ImportTable: 1282C0 IAT: 100000 Characteristics: 210E TimeDateStamp: 4B8A7813 Date: 28/02/2010 14:05:07 File Type: DLL Number Of Sections: 5 ASLR: Disabled Section Names: .text, .rdata, .data, .rsrc, .reloc Number Of Executable Sections: 1 Subsystem: Windows GUI |
| Sections Info |
| Section Name | Flags | ROffset | RSize | VOffset | VSize | Entropy | Chi2 |
|---|---|---|---|---|---|---|---|
| .text | 0x60000020 Code Executable Readable |
1000 | FF000 | 1000 | FE655 |
|
|
| .rdata | 0x40000040 Initialized Data Readable |
100000 | 2B000 | 100000 | 2AEE4 |
|
|
| .data | 0xC0000040 Initialized Data Readable Writeable |
12B000 | 2C000 | 12B000 | 33BB4 |
|
|
| .rsrc | 0x40000040 Initialized Data Readable |
157000 | 4000 | 15F000 | 39F0 |
|
|
| .reloc | 0x42000040 Initialized Data GP-Relative Readable |
15B000 | 13000 | 163000 | 12C90 |
|
|
| Description |
| OriginalFilename: PDFView.OCX CompanyName: YCANPDF LegalCopyright: Copyright (C) 2008 ProductName: YCANPDF PDFView ActiveX Control Module FileDescription: PDFView ActiveX Control Module Language: English (United States) (ID=0x409) CodePage: Unicode (UTF-16 LE) (0x4B0) |
| Entry Point |
The section number (1) - (.text) have the Entry Point Information -> EntryPoint (calculated) - D14CF Code -> 558BEC538B5D08568B750C578B7D1085F67509833DE4CF151000EB2683FE01740583FE027522A17CDB151085C07409575653 Assembler |PUSH EBP |MOV EBP, ESP |PUSH EBX |MOV EBX, DWORD PTR [EBP + 8] |PUSH ESI |MOV ESI, DWORD PTR [EBP + 0XC] |PUSH EDI |MOV EDI, DWORD PTR [EBP + 0X10] |TEST ESI, ESI |JNE 0X100D14EB |CMP DWORD PTR [0X1015CFE4], 0 |JMP 0X100D1511 |CMP ESI, 1 |JE 0X100D14F5 |CMP ESI, 2 |JNE 0X100D1517 |MOV EAX, DWORD PTR [0X1015DB7C] |TEST EAX, EAX |JE 0X100D1507 |PUSH EDI |PUSH ESI |PUSH EBX |
| Signatures |
| Rich Signature Analyzer: Code -> CFFD64B38B9C0AE08B9C0AE08B9C0AE0E48300E08A9C0AE0E48301E08C9C0AE0F08006E08E9C0AE08B9C0AE0B49C0AE0088004E0A29C0AE08B9C0BE00D9E0AE0489357E0949C0AE0BDBA00E0DC9D0AE0BDBA01E0599C0AE04C9A0CE08A9C0AE074BC0EE08A9C0AE0526963688B9C0AE0 Footprint md5 Hash -> 20F28642D7AF2F40D284E8D39169766C • The Rich header apparently has not been modified Certificate - Digital Signature Not Found: • The file is not signed |
| Packer/Compiler |
| Compiler: Microsoft Visual C ++ Compiler: Microsoft Visual C ++ 6 DLL Detect It Easy (die) • PE: compiler: EP:Microsoft Visual C/C++(6.0 (1720-8966))[DLL32] • PE: compiler: Microsoft Visual C/C++(6.0)[libcmt] • PE: linker: Microsoft Linker(6.0)[-] • Entropy: 6.49184 |
| Suspicious Functions |
| Library | Function | Description |
|---|---|---|
| KERNEL32.DLL | GetModuleFileNameA | Retrieve the fully qualified path for the executable file of a specified module. |
| KERNEL32.DLL | VirtualAlloc | Reserve, commit, or both, a region of memory within the virtual address space of a process. |
| KERNEL32.DLL | CopyFileA | Copies an existing file to a new file. |
| KERNEL32.DLL | WriteFile | Writes data to a specified file or input/output (I/O) device. |
| KERNEL32.DLL | LoadLibraryA | Loads the specified module into the address space of the calling process. |
| KERNEL32.DLL | GetModuleHandleA | Retrieves a handle to the specified module. |
| KERNEL32.DLL | GetProcAddress | Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL). |
| KERNEL32.DLL | CreateFileA | Creates or opens a file or I/O device. |
| KERNEL32.DLL | DeleteFileA | Deletes an existing file. |
| KERNEL32.DLL | GetTempPathA | Retrieves the temporary directory path. |
| KERNEL32.DLL | ReadFile | Reads data from a file. |
| KERNEL32.DLL | FindFirstFileA | Starts file and directory enumeration. |
| KERNEL32.DLL | FindNextFileA | Continues file and directory enumeration. |
| KERNEL32.DLL | FindClose | Closes a file search handle. |
| KERNEL32.DLL | ExitThread | Terminates the current thread. |
| KERNEL32.DLL | CloseHandle | Closes an open object handle. |
| KERNEL32.DLL | IsBadReadPtr | Checks whether memory is readable. |
| KERNEL32.DLL | WinExec | Launches a specified application. |
| KERNEL32.DLL | ResumeThread | Resumes a suspended thread. |
| KERNEL32.DLL | CreateEventA | Creates or opens an event object. |
| KERNEL32.DLL | GetVersion | Retrieves the operating system version. |
| USER32.DLL | CallWindowProcA | Invokes the window procedure for the specified window and messages. |
| URLMON.DLL | URLDownloadToFileA | Download a file from the internet and save it to a local file. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates a new registry key or opens an existing one. |
| ADVAPI32.DLL | RegDeleteKeyA | Used to delete a subkey and its values from the Windows registry. |
| ADVAPI32.DLL | RegSetValueExA | Sets the data and type of a specified value under a registry key. |
| ADVAPI32.DLL | RegCreateKeyExA | Creates or opens a registry key. |
| ADVAPI32.DLL | RegOpenKeyExA | Opens an existing registry key. |
| WININET.DLL | InternetConnectA | Opens an File Transfer Protocol (FTP) or HTTP session for a given site. |
| WININET.DLL | InternetOpenA | Initializes an application’s use of the WinINet functions. |
| WININET.DLL | InternetReadFile | Reads data from an Internet resource. |
| File Access |
| shell32.dll WININET.dll urlmon.dll OLEAUT32.dll OLEPRO32.DLL ole32.dll COMCTL32.dll ADVAPI32.dll comdlg32.dll GDI32.dll USER32.dll KERNEL32.dll gdiplus.dll CRYPT32.dll WININET.DLL @.dat \YCanPDF\YCPConfig.ini \YCPConfig.ini h.INI PDF Files(*.PDF PDFVIEW.PDF Temp |
| Interest's Words |
| JFIF Encrypt PassWord exec attrib start shutdown systeminfo ping replace |
| Interest's Words (UNICODE) |
| PassWord |
| URLs |
| http://www.ycanpdf.cn |
| Known IP/Domains |
| gmail.com |
| Strings/Hex Code Found With The File Rules |
| Rule Type | Encoding | Matched (Word) |
|---|---|---|
| Text | Ascii | Keyboard Key (Scroll) |
| Entry Point | Hex Pattern | Armadillov1xxv2xx |
| Entry Point | Hex Pattern | Microsoft Visual C++ 6.0 |
| Entry Point | Hex Pattern | Microsoft Visual C++ v6.0 DLL |
| Resources |
| Path | DataRVA | Size | FileOffset | Code | Text |
|---|---|---|---|---|---|
| \TYPELIB\1\1033 | 1612C0 | 155C | 1592C0 | 4D53465402000100000000000904000000000000510000000100000002000000030000001000000000000000000000005200 | MSFT................Q...........................R. |
| \CURSOR\3\1033 | 1609A0 | 134 | 1589A0 | 0A0007002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\4\1033 | 160AF0 | 134 | 158AF0 | 0B000C002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\5\1033 | 160C40 | 134 | 158C40 | 050005002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\6\1033 | 160D90 | 134 | 158D90 | 050005002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \CURSOR\7\1033 | 160EE0 | 134 | 158EE0 | 050000002800000020000000400000000100010000000000000100000000000000000000000000000000000000000000FFFF | ....(... ...@..................................... |
| \BITMAP\1\1033 | 15FE60 | E0 | 157E60 | 28000000100000000F0000000100040000000000780000000000000000000000000000000000000000000000000080000080 | (...................x............................. |
| \BITMAP\214\1033 | 15FF40 | 328 | 157F40 | 2800000010000000100000000100180000000000000300000000000000000000000000000000000080808080808080808080 | (................................................. |
| \BITMAP\215\1033 | 160268 | 328 | 158268 | 2800000010000000100000000100180000000000000300000000000000000000000000000000000080808080808080808080 | (................................................. |
| \ICON\1\1033 | 15FA28 | 2E8 | 157A28 | 2800000020000000400000000100040000000000000200000000000000000000000000000000000000000000000080000080 | (... ...@......................................... |
| \ICON\2\1033 | 15FD10 | 128 | 157D10 | 2800000010000000200000000100040000000000800000000000000000000000000000000000000000000000000080000080 | (....... ......................................... |
| \MENU\205\1033 | 161030 | 216 | 159030 | 0000000090005200690067006800740000000000048046006900720073007400200050006100670065000000000005805000 | ......R.i.g.h.t.......F.i.r.s.t. .P.a.g.e.......P. |
| \MENU\213\1033 | 161248 | 78 | 159248 | 000000009000530065006C00650063007400200054006F006F006C00000000001680530065006C0065006300740020005400 | ......S.e.l.e.c.t. .T.o.o.l.......S.e.l.e.c.t. .T. |
| \DIALOG\1\1033 | 160590 | 146 | 158590 | C000C880000000000400220016000401370000000000410062006F0075007400200050004400460056006900650077002000 | ..........".....7.....A.b.o.u.t. .P.D.F.V.i.e.w. . |
| \DIALOG\135\1033 | 160808 | 104 | 158808 | C000C88000000000040000000000B50045000000000050006C006500610073006500200065006E0074006500720020007400 | ................E.....P.l.e.a.s.e. .e.n.t.e.r. .t. |
| \DIALOG\200\1033 | 1606D8 | A6 | 1586D8 | 400000400000000003000000000009019E0000000000000008004D0053002000530061006E00730020005300650072006900 | @..@......................M.S. .S.a.n.s. .S.e.r.i. |
| \DIALOG\206\1033 | 160780 | 86 | 158780 | C008008000000000010000000000F1001E0000000000000008004D0053002000530061006E00730020005300650072006900 | ..........................M.S. .S.a.n.s. .S.e.r.i. |
| \DIALOG\207\1033 | 160910 | 8E | 158910 | C008008000000000020000000000BB00390000000000000008004D0053002000530061006E00730020005300650072006900 | ................9.........M.S. .S.a.n.s. .S.e.r.i. |
| \STRING\1\1033 | 162820 | 68 | 15A820 | 00000F005000440046005600690065007700200043006F006E00740072006F006C0015005000440046005600690065007700 | ....P.D.F.V.i.e.w. .C.o.n.t.r.o.l...P.D.F.V.i.e.w. |
| \STRING\13\1033 | 162888 | 2E | 15A888 | 000000000000000000000000000000000700470065006E006500720061006C000000000000000000000000000000 | ..................G.e.n.e.r.a.l............... |
| \STRING\2050\1033 | 1628B8 | 134 | 15A8B8 | 0000000000000000000000003400440072006100670020006F00720020006D00610072007100750065006500200073006500 | ............4.D.r.a.g. .o.r. .m.a.r.q.u.e.e. .s.e. |
| \GROUP_CURSOR\203\1033 | 160AD8 | 14 | 158AD8 | 0000020001002000400001000100340100000300 | ...... .@.....4..... |
| \GROUP_CURSOR\204\1033 | 160C28 | 14 | 158C28 | 0000020001002000400001000100340100000400 | ...... .@.....4..... |
| \GROUP_CURSOR\209\1033 | 160D78 | 14 | 158D78 | 0000020001002000400001000100340100000500 | ...... .@.....4..... |
| \GROUP_CURSOR\210\1033 | 160EC8 | 14 | 158EC8 | 0000020001002000400001000100340100000600 | ...... .@.....4..... |
| \GROUP_CURSOR\212\1033 | 161018 | 14 | 159018 | 0000020001002000400001000100340100000700 | ...... .@.....4..... |
| \GROUP_ICON\1\1033 | 15FE38 | 22 | 157E38 | 0000010002002020100001000400E802000001001010100001000400280100000200 | ...... ....................(..... |
| \VERSION\1\1033 | 15F650 | 3D4 | 157650 | D40334000000560053005F00560045005200530049004F004E005F0049004E0046004F0000000000BD04EFFE000001000800 | ..4...V.S._.V.E.R.S.I.O.N._.I.N.F.O............... |
| Intelligent String |
| • SimKai.ttf • SimFang.ttf • COMCTL32.DLL • .HLP • CLSID\%1\InprocHandler32ole32.dll • KERNEL32.DLL • GetParentDestroyWindowRCreateDialogIndirectParamA • WINSPOOL.DRV • COMCTL32.dll • OLEAUT32.dll • urlmon.dll • \shell\open\command.htm • http://www.ycanpdf.cn • PDF*.PDF • .ttf • .ps.pfb • .pfa • SimHei.ttf • SimSun.ttc • SimLi.ttf • yes%src.cab • d050000l.pfb • times.ttf • n021003l.pfb • timesi.ttf • n021023l.pfb • timesbi.ttfn021024l.pfb • timesbd.ttfn021004l.pfb • s050000l.pfb • ariali.ttf • n019023l.pfb • arialbi.ttfn019024l.pfb • arialbd.ttfn019004l.pfb • arial.ttf • n019003l.pfb • couri.ttf • n022023l.pfb • courbi.ttf • n022024l.pfb • courbd.ttf • n022004l.pfb • cour.ttf • n022003l.pfb • %s\batang.ttf • %s\batang.ttc • %s\msmincho.ttf%s\msmincho.ttc%s\mingliu.ttf • %s\mingliu.ttc • %s\simsun.ttf • %s\simsun.ttc • shell32.dll • >> /CCITTFaxDecode filter • << >> /FlateDecode filter • l:YCanPDF@gmail.comhttp://www.YCanPDF.cn • \YCPConfig.ini • \YCanPDF\YCPConfig.ini • .PAX • PDFView.OCX |
| Flow Anomalies |
| Offset | FlowVA | Section | Description |
|---|---|---|---|
| 1021 | 101007B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 10DF | 101007B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 11B6 | 10100604 | .text | CALL [static] | Indirect call to absolute memory address |
| 11C6 | 10100604 | .text | CALL [static] | Indirect call to absolute memory address |
| 138C | 10100600 | .text | CALL [static] | Indirect call to absolute memory address |
| 16A0 | 101005F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1953 | 10100420 | .text | CALL [static] | Indirect call to absolute memory address |
| 1B30 | 101005E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 1BE0 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 1E28 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 1EC9 | 101003C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1F8B | 10100420 | .text | CALL [static] | Indirect call to absolute memory address |
| 2055 | 101003B8 | .text | CALL [static] | Indirect call to absolute memory address |
| 21FF | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 23A5 | 101003B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2579 | 101003AC | .text | CALL [static] | Indirect call to absolute memory address |
| 270E | 101003B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 27F2 | 101005E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 280E | 10100088 | .text | CALL [static] | Indirect call to absolute memory address |
| 2838 | 10100084 | .text | CALL [static] | Indirect call to absolute memory address |
| 2888 | 10100080 | .text | CALL [static] | Indirect call to absolute memory address |
| 28E5 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 29B9 | 101003AC | .text | CALL [static] | Indirect call to absolute memory address |
| 29C8 | 101003B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2A4A | 10100184 | .text | CALL [static] | Indirect call to absolute memory address |
| 2AAB | 10100184 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C0C | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 2C3F | 10100184 | .text | CALL [static] | Indirect call to absolute memory address |
| 2C5F | 101003AC | .text | CALL [static] | Indirect call to absolute memory address |
| 2CA7 | 101003B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 2EDE | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 2F11 | 10100184 | .text | CALL [static] | Indirect call to absolute memory address |
| 2F85 | 10100184 | .text | CALL [static] | Indirect call to absolute memory address |
| 2FF5 | 101005F0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3029 | 101005E0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3030 | 101005E4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3066 | 101005E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 32C3 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 32E7 | 101005D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3331 | 101005D8 | .text | CALL [static] | Indirect call to absolute memory address |
| 3342 | 101005DC | .text | CALL [static] | Indirect call to absolute memory address |
| 34B9 | 101005D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3582 | 101005E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 35EF | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 35F9 | 101005CC | .text | CALL [static] | Indirect call to absolute memory address |
| 369F | 10100184 | .text | CALL [static] | Indirect call to absolute memory address |
| 36B4 | 101005C0 | .text | CALL [static] | Indirect call to absolute memory address |
| 36BC | 101005DC | .text | CALL [static] | Indirect call to absolute memory address |
| 37EA | 10100600 | .text | CALL [static] | Indirect call to absolute memory address |
| 37F8 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 387D | 101005B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 3893 | 101005B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 38B7 | 101005B0 | .text | CALL [static] | Indirect call to absolute memory address |
| 38CD | 101005B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3B3D | 101005BC | .text | CALL [static] | Indirect call to absolute memory address |
| 3D31 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 3D61 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 3D91 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 3E7F | 101005C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3E9C | 101005AC | .text | CALL [static] | Indirect call to absolute memory address |
| 3ECB | 101003AC | .text | CALL [static] | Indirect call to absolute memory address |
| 3EF8 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 3F07 | 101003AC | .text | CALL [static] | Indirect call to absolute memory address |
| 3FCA | 101005C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 3FE7 | 101005AC | .text | CALL [static] | Indirect call to absolute memory address |
| 4016 | 101003AC | .text | CALL [static] | Indirect call to absolute memory address |
| 4043 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 405B | 101003AC | .text | CALL [static] | Indirect call to absolute memory address |
| 40F8 | 101003B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4181 | 101005E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 420E | 101003B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4256 | 101003AC | .text | CALL [static] | Indirect call to absolute memory address |
| 4265 | 101003B4 | .text | CALL [static] | Indirect call to absolute memory address |
| 42E4 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 43E4 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 4560 | 101005A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 45E0 | 101005A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4748 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 47F6 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 48B5 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 4A86 | 10100598 | .text | CALL [static] | Indirect call to absolute memory address |
| 4AA0 | 101005E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B39 | 101005C4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B7E | 1010059C | .text | CALL [static] | Indirect call to absolute memory address |
| 4B87 | 101005A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4B8D | 101005A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4BD3 | 101005E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CBB | 10100598 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CD0 | 1010039C | .text | CALL [static] | Indirect call to absolute memory address |
| 4CD9 | 101003A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CED | 1010059C | .text | CALL [static] | Indirect call to absolute memory address |
| 4CF4 | 101003A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4CFD | 101005A0 | .text | CALL [static] | Indirect call to absolute memory address |
| 4D03 | 101005A4 | .text | CALL [static] | Indirect call to absolute memory address |
| 4D0A | 101003A8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4D48 | 101005EC | .text | CALL [static] | Indirect call to absolute memory address |
| 4E8C | 101005E8 | .text | CALL [static] | Indirect call to absolute memory address |
| 4F97 | 10100394 | .text | CALL [static] | Indirect call to absolute memory address |
| 4FBD | 10100398 | .text | CALL [static] | Indirect call to absolute memory address |
| 542E | 101003D0 | .text | CALL [static] | Indirect call to absolute memory address |
| 1105C5-1105D2 | N/A | .rdata | Potential obfuscated jump sequence detected, count: 7 |
| Extra Analysis |
| Metric | Value | Percentage |
|---|---|---|
| Ascii Code | 864807 | 57,687% |
| Null Byte Code | 273957 | 18,2743% |
| NOP Cave Found | 0x9090909090 | Block Count: 3479 | Total: 0,5802% |
© 2026 All rights reserved.