Benign windows Download

Mozilla.Firefox.ESR.zh-CN

Authenticode chain CN: Mozilla CorporationBinary contains high-entropy data regions

SHA-2560535de62739a59a21572fb5c3c0fce36e48496f7b637b046c249fcccd2b5ec4e

URLhttps://download-installer.cdn.mozilla.net/pub/firefox/releases/153.3.0esr/win64-aarch64/zh-CN/Firefox%20Setup%20153.3.0esr.exe

MaleculeK(Am)O₆(As₆C₅DyEr₃LaS)H₆(DbF₅MgOs₃Po₄Ti)Md₃(Bi₁₂PaSi₃)

Evidence

Large PE with elevated code entropy 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400f00100f010020091100240f91f0010eb..........@.....
0x41041000054c0035fd6fd7bbea9fd030091A..T.._..{......
0x420f00100f010020091f10100f031220091............1"..
0x430100240f9310240f9f04701a96b780094[email protected][email protected]..
0x44000003ed4000000000000000000000000..>.............
0x45000000000000000000000000000000000................
0x460030001cb7f0002ebc30b0054c30100b4...........T....
0x470210080f95f2000f1e30300aa22020054!..._ ......"..T
0x480620010362020ff0d6020bf0d62000836b..6  ..` ..b..6
0x4902000ff0d6000bf0d6200003622004039 ...`...b..6".@9
0x4a062000039c0035fd60000000000000000b..9.._.........
0x4b000000000000000000000000000000000................
0x4c0fd7bbfa9fd030091428000f123060054.{......B...#..T
0x4d0428000f183050054214080f9216080f9B......T!@..!`..
0x4e0420001f1c3040054244000912070404cB......T$@.. p@L
0x4f0258000918170404c26c00091a270404c%....p@L&....p@L
0x50027000191c370404c28400191e470404c'....p@L(@...p@L
0x510298001910571404c2ac001912671404c)....q@L*...&q@L
0x520210002914771404c214080f9216080f9!...Gq@L!@..!`..
0x530644000916070004c658000918170004cd@..`p.Le....p.L
0x54066c00091a270004c67000191c370004cf....p.Lg....p.L
0x55068400191e470004c698001910571004c[email protected]
0x5606ac001912671004c630002914771004cj...&q.Lc...Gq.L
0x570420002f1a2fbff54620030362020df4cB......Tb.06  .L
0x58060209f4c6200283620a0df4c60a09f4c` .Lb.(6 ..L`..L
0x590620020362070df4c60709f4c62001836b. 6 p.L`p.Lb..6
0x5a02070df0c60709f0c620010362020ff0d p..`p..b..6  ..
0x5b06020bf0d620008362000ff0d6000bf0d` ..b..6 ...`...
0x5c0620000362200403962000039fd7bc1a8b..6"[email protected].{..
0x5d0c0035fd6000000000000000000000000.._.............
0x5e02100028b210080f85f2000f10300028b!...!..._ ......
0x5f082020054a2001036211000d1631000d1...T...6!...c...
0x6002020600d6020200da2000836210800d1  `.`  ....6!...
0x610630800d12000600d6000200d62000036c... .`.`. .b..6
0x62022fc5f3862fc1f38c0035fd600000000"._8b..8.._.....
0x63000000000000000000000000000000000................
0x640fd7bbfa9fd030091210098f8428000f1.{......!...B...
0x65083060054428000f1a3050054210090f8...TB......T!...
0x660420001f1a3040054210002d124400091B......T!...$@..
0x6702070404c258000918170404c26c00091 p@L%....p@L&...

OLE automation DLL import 0x2ce30–0x2cf40

⋯3 more rows
0x2ce605348454c4c33322e646c6c0000000000SHELL32.dll.....
0x2ce704f4c4541555433322e646c6c00000000OLEAUT32.dll....
0x2ce805553455233322e646c6c000000000000USER32.dll......
⋯12 more rows

References the .NET mscoree loader name 0x2dad8–0x2db98

⋯3 more rows
0x2db0803000000000000000900000000000000................
0x2db186d00730063006f007200650065002e00m.s.c.o.r.e.e...
0x2db2864006c006c000000436f724578697450d.l.l...CorExitP
⋯7 more rows

Dense api-ms-win-core string cluster 0x2de10–0x2e100

⋯3 more rows
0x2de40e0f802400100000028f9024001000000...@....(..@....
0x2de506100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2de6069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2de706400610074006500740069006d006500d.a.t.e.t.i.m.e.
0x2de802d006c0031002d0031002d0031000000-.l.1.-.1.-.1...
0x2de906100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2dea069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2deb06600690062006500720073002d006c00f.i.b.e.r.s.-.l.
0x2dec031002d0031002d0031000000000000001.-.1.-.1.......
0x2ded06100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2dee069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2def0660069006c0065002d006c0031002d00f.i.l.e.-.l.1.-.
0x2df0032002d003200000000000000000000002.-.2...........
0x2df106100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2df2069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2df306c006f00630061006c0069007a006100l.o.c.a.l.i.z.a.
0x2df40740069006f006e002d006c0031002d00t.i.o.n.-.l.1.-.
0x2df5032002d003100000000000000000000002.-.1...........
0x2df606100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2df7069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2df806c006f00630061006c0069007a006100l.o.c.a.l.i.z.a.
0x2df90740069006f006e002d006f0062007300t.i.o.n.-.o.b.s.
0x2dfa06f006c006500740065002d006c003100o.l.e.t.e.-.l.1.
0x2dfb02d0032002d0030000000000000000000-.2.-.0.........
0x2dfc06100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2dfd069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2dfe0700072006f0063006500730073007400p.r.o.c.e.s.s.t.
0x2dff06800720065006100640073002d006c00h.r.e.a.d.s.-.l.
0x2e00031002d0031002d0032000000000000001.-.1.-.2.......
0x2e0106100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2e02069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2e03073007400720069006e0067002d006c00s.t.r.i.n.g.-.l.
0x2e04031002d0031002d0030000000000000001.-.1.-.0.......
0x2e0506100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2e06069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2e070730079006e00630068002d006c003100s.y.n.c.h.-.l.1.
0x2e0802d0032002d0030000000000000000000-.2.-.0.........
0x2e0906100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2e0a069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2e0b073007900730069006e0066006f002d00s.y.s.i.n.f.o.-.
0x2e0c06c0031002d0032002d00310000000000l.1.-.2.-.1.....
0x2e0d06100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x2e0e069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x2e0f0770069006e00720074002d006c003100w.i.n.r.t.-.l.1.
0x2e1002d0031002d0030000000000000000000-.1.-.0.........

Archive open or extract instruction 0x33bf8–0x33cc8

⋯3 more rows
0x33c28650000000000000043616e206e6f7420e.......Can not 
0x33c386f70656e207468652066696c65206173open the file as
0x33c4820617263686976650000000000000000 archive........
0x33c5844656661756c740037007a0053000000Default.7.z.S...
⋯7 more rows