Suspicious 80% Download

instdoload.1.3.15.exe

Unsigned, obfuscated, input-hooking binary

Dominant low-entropy writable .data padding geometryUnsigned mixed-mode tray helper
SHA-256218e743d49c1060a7d9e1d250ed4fb4372aefc2a0892fadd70f09c4f68a25d16
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeK₂(Li₄Lu)O₇(As₇P₃AlC₂Er₃LaXe)H₁₀(Cm₁₀CrDb₅F₆Hf₄Mg₂Os₉Po₆TiU₃)Md₇(Bi₉HePaPtSi)

Evidence

MSVC /clr DllMain diagnostic 0x2b878–0x2b9e8
⋯5 more rows
0x2b8c86c0069006e006700200061006e002000l.i.n.g. .a.n. .
0x2b8d84d00530049004c002d0063006f006d00M.S.I.L.-.c.o.m.
0x2b8e8700069006c0065006400200028002f00p.i.l.e.d. .(./.
0x2b8f863006c00720029002000660075006e00c.l.r.). .f.u.n.
0x2b9086300740069006f006e00200066007200c.t.i.o.n. .f.r.
0x2b9186f006d002000610020006e0061007400o.m. .a. .n.a.t.
0x2b928690076006500200063006f006e007300i.v.e. .c.o.n.s.
⋯4 more rows
0x2b97832000d000a002d0020006e006f0074002.....-. .n.o.t.
0x2b988200065006e006f007500670068002000 .e.n.o.u.g.h. .
0x2b99873007000610063006500200066006f00s.p.a.c.e. .f.o.
⋯5 more rows
GUI import cluster BeginPaint 0x2bfc0–0x2c2b0
⋯3 more rows
0x2bff00a0000000000000050d2024001000000........P..@....
0x2c0001000000000000000f0d1024001000000...........@....
0x2c010110000000000000090d1024001000000...........@....
0x2c020120000000000000040d1024001000000........@..@....
0x2c0301300000000000000e0d0024001000000...........@....
0x2c040180000000000000070d0024001000000........p..@....
0x2c050190000000000000020d0024001000000........ ..@....
0x2c0601a00000000000000b0cf024001000000...........@....
0x2c0701b0000000000000040cf024001000000........@..@....
0x2c0801c00000000000000f0ce024001000000...........@....
0x2c0901e00000000000000a8ce024001000000...........@....
0x2c0a01f00000000000000e0cd024001000000...........@....
0x2c0b0200000000000000070cd024001000000 .......p..@....
0x2c0c0210000000000000080cb024001000000!..........@....
0x2c0d0780000000000000058cb024001000000x.......X..@....
0x2c0e0790000000000000038cb024001000000y.......8..@....
0x2c0f07a0000000000000018cb024001000000z..........@....
0x2c100fc0000000000000010cb024001000000...........@....
0x2c110ff00000000000000f0ca024001000000...........@....
0x2c1204d006900630072006f0073006f006600M.i.c.r.o.s.o.f.
0x2c13074002000560069007300750061006c00t. .V.i.s.u.a.l.
0x2c140200043002b002b002000520075006e00 .C.+.+. .R.u.n.
0x2c150740069006d00650020004c0069006200t.i.m.e. .L.i.b.
0x2c1607200610072007900000000000a000a00r.a.r.y.........
0x2c17000000000000000002e002e002e000000................
0x2c1803c00700072006f006700720061006d00<.p.r.o.g.r.a.m.
0x2c19020006e0061006d006500200075006e00 .n.a.m.e. .u.n.
0x2c1a06b006e006f0077006e003e0000000000k.n.o.w.n.>.....
0x2c1b0520075006e00740069006d0065002000R.u.n.t.i.m.e. .
0x2c1c04500720072006f00720021000a000a00E.r.r.o.r.!.....
0x2c1d0500072006f006700720061006d003a00P.r.o.g.r.a.m.:.
0x2c1e020000000000000000000000000000000 ...............
0x2c1f0050000c00b0000000000000000000000................
0x2c2001d0000c0040000000000000000000000................
0x2c210960000c0040000000000000000000000................
0x2c2208d0000c0080000000000000000000000................
0x2c2308e0000c0080000000000000000000000................
0x2c2408f0000c0080000000000000000000000................
0x2c250900000c0080000000000000000000000................
0x2c260910000c0080000000000000000000000................
⋯5 more rows
Binary imports ADVAPI32.dll 0x3b0fe–0x3b30e
⋯5 more rows
0x3b14e6e4b6579457841006d02526567517565nKeyExA.m.RegQue
0x3b15e727956616c7565457841000041445641ryValueExA..ADVA
0x3b16e504933322e646c6c00002e015368656cPI32.dll....Shel
0x3b17e6c5f4e6f7469667949636f6e5700df00l_NotifyIconW...
0x3b18e53484765745370656369616c466f6c64SHGetSpecialFold
0x3b19e65724c6f636174696f6e0000d7005348erLocation....SH
0x3b1ae4765745061746846726f6d49444c6973GetPathFromIDLis
0x3b1be7457000022015368656c6c4578656375tW..".ShellExecu
0x3b1ce746557001a0044726167416363657074teW...DragAccept
0x3b1de46696c6573001f004472616751756572Files...DragQuer
⋯19 more rows
Massive low-entropy writable .data section 0x3bba0–0x3be90
⋯5 more rows
0x3bbf000000000000000000000000000000000................
0x3bc0060c90240010000000000000000000000`..@............
0x3bc102e3f41566c6f6769635f6572726f7240.?AVlogic_error@
0x3bc20737464404000000060c9024001000000std@@...`..@....
0x3bc3000000000000000002e3f41566c656e67.........?AVleng
0x3bc4074685f6572726f724073746440400000th_error@std@@..
0x3bc5060c90240010000000000000000000000`..@............
0x3bc602e3f41566f75745f6f665f72616e6765.?AVout_of_range
0x3bc7040737464404000000000000000000000@std@@..........
0x3bc8060c90240010000000000000000000000`..@............
0x3bc902e3f4156747970655f696e666f404000.?AVtype_info@@.
0x3bca0020000000000000032a2df2d992b0000........2..-.+..
0x3bcb0cd5d20d266d4ffff0000000000000000.] .f...........
0x3bcc0e0190440010000000000000000000000...@............
0x3bcd0e0190440010000000101000000000000...@............
0x3bce000000000001000000000000000000000................
0x3bcf000000000000000000000000000000000................
0x3bd0000000000000000000200000001000000................
0x3bd1000000000000000000000000000000000................
0x3bd2000000000000000000000000000000000................
0x3bd3000000000000000000200000002000000................
0x3bd4000000000000000000000000000000000................
0x3bd5000000000000000000000000000000000................
0x3bd6000000000000000000000000000000000................
0x3bd7000000000000000000000000000000000................
0x3bd8000000000000000000000000000000000................
0x3bd9000000000000000000000000000000000................
0x3bda000000000000000000000000000000000................
0x3bdb000000000000000000000000000000000................
0x3bdc000000000000000000000000000000000................
0x3bdd000000000000000000000000000000000................
0x3bde000000000000000000000000000000000................
0x3bdf000000000000000000000000000000000................
0x3be0000000000000000000000000000000000................
0x3be1000000000000000000000000000000000................
0x3be2000000000000000000000000000000000................
0x3be3000000000000000000000000000000000................
0x3be4000000000000000000000000000000000................
0x3be5000000000000000000000000000000000................
0x3be6000000000000000000000000000000000................
0x3be7000000000000000000000000000000000................
0x3be8000000000000000000000000000000000................
0x3be9000000000000000000000000000000000................
Largest section over ninety-five percent of file 0x4cb8a–0x4cc1a
0x4cb8a76706a62646f464e732b614b3744586cvpjbdoFNs+aK7DXl
0x4cb9a6a693054773d0a646570096769746875ji0Tw=.dep.githu
0x4cbaa622e636f6d2f676f6f676c652f676f2db.com/google/go-
0x4cbba636d700976302e352e360968313a424bcmp.v0.5.6.h1:BK
0x4cbca624b4371765036492b726d4648743036bKCqvP6I+rmFHt06
0x4cbda5a6d79517476423878416b5764684679ZmyQtvB8xAkWdhFy
0x4cbea72305a554e5a6378513d0a6465700967r0ZUNZcxQ=.dep.g
0x4cbfa69746875622e636f6d2f676f6f676c65ithub.com/google
0x4cc0a2f676f66757a7a0976312e322e300968/gofuzz.v1.2.0.h
0x4cc1a313a7852 1:xR

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.