Suspicious ^86% windows Download

Sakana-yuyu.cursor-byok

Unsigned installer, withheld C2 findings

Authenticode chain CN: Microsoft CorporationCert chain has only 2 entries

SHA-256101e36bebf5cccdf21c00849633aa507e4cb0c9e156fd74c46dbc467f03ab5b0

URLhttps://github.com/Sakana-yuyu/cursor-byok/releases/download/v1.0.9/cursor-byok-1.0.9-windows-arm64-installer.exe

MaleculeO₄(C₂DyErPr)H₁₀(Cm₁₀Cr₇Db₆DsF₁₀HfMgOs₁₄Po₈U)Md₅(Bi₉BkPaSi₄)

Evidence

NSIS self-extracting installer 0x2570–0x2640

⋯3 more rows
0x25a02e00008b45d8a9f0ffffff757c817ddc....E......u|.}.
0x25b0efbeadde7573817de8496e7374756a81....us.}.Instuj.
0x25c07de4736f66747561817de04e756c6c75}.softua.}.Nullu
0x25d0580945088b45088b0d186a410083e002X.E..E....jA....
⋯7 more rows

ShellExecuteEx API call 0x784e–0x790e

⋯3 more rows
0x787e6846726f6d49444c6973745700000a01hFromIDListW....
0x788e5368656c6c4578656375746545785700ShellExecuteExW.
0x789e5348454c4c33322e646c6c006500436fSHELL32.dll.e.Co
⋯7 more rows

Clears the clipboard to take ownership 0x7c26–0x7d06

⋯3 more rows
0x7c566f7365436c6970626f61726400004a02oseClipboard..J.
0x7c66536574436c6970626f61726444617461SetClipboardData
0x7c760000c100456d707479436c6970626f61....EmptyClipboa
0x7c8672640000f6014f70656e436c6970626frd....OpenClipbo
0x7c9661726400a402547261636b506f707570ard...TrackPopup
⋯7 more rows

Search executable path via Windows API 0x7fdc–0x82cc

⋯3 more rows
0x800c0000630147657446696c6553697a6500..c.GetFileSize.
0x801c71014765744c6173744572726f720000q.GetLastError..
0x802c7e014765744d6f64756c6546696c654e~.GetModuleFileN
0x803c616d6557000042014765744375727265ameW..B.GetCurre
⋯8 more rows
0x80cc73696f6e457857001503536574457272sionExW...SetErr
0x80dc6f724d6f64650000cd036c7374726c65orMode....lstrle
0x80ec6e570000ca036c7374726370796e5700nW....lstrcpynW.
0x80fc94035769646543686172546f4d756c74..WideCharToMult
⋯3 more rows
0x813c616c4c6f636b00006f00437265617465alLock..o.Create
0x814c54687265616400004e00437265617465Thread..N.Create
0x815c4469726563746f727957000069004372DirectoryW..i.Cr
0x816c6561746550726f63657373570000c502eateProcessW....
0x817c52656d6f76654469726563746f727957RemoveDirectoryW
0x818c0000c3036c737472636d706941005600....lstrcmpiA.V.
0x819c43726561746546696c655700d4014765CreateFileW...Ge
0x81ac7454656d7046696c654e616d65570000tTempFileNameW..
0x81bca403577269746546696c6500c6036c73..WriteFile...ls
0x81cc747263707941000070024d6f76654669trcpyA..p.MoveFi
0x81dc6c6545785700be036c73747263617457leExW...lstrcatW
0x81ec0000c20147657453797374656d446972....GetSystemDir
0x81fc6563746f72795700a00147657450726fectoryW...GetPro
0x820c634164647265737300007f014765744dcAddress....GetM
0x821c6f64756c6548616e646c654100005a01oduleHandleA..Z.
⋯11 more rows

Cleartext http:// URL 0x8430–0x8590

⋯11 more rows
0x84e06f0077006e006c006f00610064002000o.w.n.l.o.a.d. .
0x84f061006e0064002000640061006d006100a.n.d. .d.a.m.a.
0x850067006500640020006d00650064006900g.e.d. .m.e.d.i.
0x851061002e00200043006f006e0074006100a... .C.o.n.t.a.
0x85206300740020007400680065000a006900c.t. .t.h.e...i.
⋯7 more rows