Executable Visualizer & PE Section Layout
State: Assembled
Memory Offset Map & Section Allocation
Total Size: 48.2 KB
DOS/PE Header
.text (Code)
.rdata (Read-Only)
.bun_src (Payload)
.poly_pad (Polymorphic)
Shannon Entropy Distribution (0.0 - 8.0 bits/byte)
Avg Entropy: 6.14
Session Cryptographic Hashes (Mutates via Padding/Nonce)
Build Target:
Windows x64 Portable Executable (PE32+)
Session Nonce:
a7f3c9e2
SHA-256 Hash:
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
MD5 Hash:
d41d8cd98f00b204e9800998ecf8427e
| Section Name | Virtual Offset | Virtual Size | Raw Offsets | Entropy |
|---|
SourTrade Client-Side Assembly Mechanics
SourTrade malvertising utilizes the target's browser to dynamically merge a legitimate signed Bun executable header with dynamic JavaScript payload bytecode and a randomized zero-execution padding section (.poly_pad).
Because the polymorphic padding is appended outside the executable entrypoint flow, every generated PE binary produces a unique cryptographic file hash (MD5/SHA-256) while retaining 100% execution parity.
Automated Static Analysis & Signature Rule Engine
Rule: Bun_Standalone_Executable_Header
MATCHED
Detects Bun single-file packaging signature and embedded Bun source marker (
0x42 0x55 0x4e 0x00).
Rule: High_Entropy_Polymorphic_Section
CLEAN
Flags unusual entropy anomalies in non-standard PE sections (threshold > 7.2 bits/byte).
Rule: SourTrade_Malvertising_Pattern
MATCHED
Detects dynamic bytecode evaluation patterns combined with modular payload assembly.
Polymorphic Variance Analysis
Session hash altered successfully! Static hash signatures bypassed via 64 bytes of non-exec padding. PE section alignment maintained at 0x1000 Virtual / 0x200 Raw boundaries.