Suspicious ^80% windows Download

Lody.Lody

Unsigned installer, obfuscated payload

Obfuscated MSXML HTTP fragmentsString extraction truncated due to limits (count: 100000, total bytes: 50 MB)

SHA-256049991bf5744e3e2d5b1e5c66ec349acedaab6f80e2c9a400f3c4cfb3db418ef

URLhttps://updates.lody.ai/production/Lody-0.91.0-x64-setup.exe

MaleculeO₃(AsC₂Dy)H₅(Cm₂F₉Os₆Po₃U)Md₄(Bi₅PaSi)

Evidence

English function-word token "this" 0x0–0xb0

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯6 more rows

NSIS self-extracting installer 0x237c–0x244c

⋯3 more rows
0x23ac2d00008b45d8a9f0ffffff7572817ddc-...E......ur.}.
0x23bcefbeadde7569817de8496e7374756081....ui.}.Instu`.
0x23cc7de4736f66747557817de04e756c6c75}.softuW.}.Nullu
0x23dc4e0945088b45088b0df881420083e002N.E..E.....B....
⋯7 more rows

Modify file creation/access/write times 0x768a–0x774a

⋯3 more rows
0x76ba3400436c6f736548616e646c65001f034.CloseHandle...
0x76ca53657446696c6554696d65003900436fSetFileTime.9.Co
0x76da6d7061726546696c6554696d6500dc02mpareFileTime...
⋯7 more rows

CreateFile API string reference 0x77cc–0x7a1c

⋯3 more rows
0x77fc77734469726563746f7279570000d601wsDirectoryW....
0x780c47657454656d70506174685700001101GetTempPathW....
0x781c476574436f6d6d616e644c696e655700GetCommandLineW.
⋯12 more rows
0x78ec0000c3036c737472636d706941005600....lstrcmpiA.V.
0x78fc43726561746546696c655700d4014765CreateFileW...Ge
0x790c7454656d7046696c654e616d65570000tTempFileNameW..
0x791ca403577269746546696c6500c6036c73..WriteFile...ls
⋯16 more rows

Clears the clipboard to take ownership 0x7c7c–0x7d8c

⋯5 more rows
0x7ccc65004200436c6f7365436c6970626f61e.B.CloseClipboa
0x7cdc726400004a02536574436c6970626f61rd..J.SetClipboa
0x7cec7264446174610000c100456d70747943rdData....EmptyC
0x7cfc6c6970626f6172640000f6014f70656elipboard....Open
0x7d0c436c6970626f61726400a40254726163Clipboard...Trac
0x7d1c6b506f7075704d656e75000009004170kPopupMenu....Ap
⋯7 more rows