Benign windows Download

NordSecurity.NordLocker

Legitimate signed NordLocker installer

Authenticode chain CN: nordvpn s.a.Binary contains high-entropy data regions

SHA-256225dbd1396f2d245186877b9cec92beab94e14a1db62ed623443039e2e45c336

URLhttps://downloads.nordcdn.com/apps/windows/NordLockerEvolution/6.4.0.0/NordLockerSetup_x64.exe

MaleculeK(Te)O₅(As₇C₂Dy₂ErPr)H₉(CmCrDb₄F₃Mg₂Os₉Po₅TiU)Md₃(Bi₁₂PaSi₃)

Evidence

Large PE with elevated code entropy 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400041040000307426f6f6c65616e010000[email protected]...
0x410000001000000001040000546616c7365[email protected]
0x42004547275650653797374656d02000000.True.System....
0x430341040000208416e7369436861720100[email protected]..
0x440000000ff000000020000000050104000............P.@.
0x4500904436861720300000000ffff000002..Char..........
0x4600000000068104000010853686f727449[email protected]
0x4706e740080ffffff7f0000000200000000nt..............
0x480841040000108536d616c6c496e740200[email protected]..
0x49080ffffff7f00000200000000a0104000..............@.
0x4a00107496e74656765720400000080ffff..Integer.......
0x4b0ff7f0200b81040000104427974650100[email protected]..
0x4c0000000ff0000000200000000d0104000..............@.
0x4d00104576f72640300000000ffff000002..Word..........
0x4e000000000e8104000010843617264696e[email protected]
0x4f0616c0500000000ffffffff0200000000al..............
0x500041140001407506f696e746572000000[email protected]...
0x51000020000181140001005496e74363400[email protected].
0x52000000000000080ffffffffffffff7f02................
0x5300000000038114000100655496e743634[email protected]
0x5400000000000000000ffffffffffffffff................
0x550020000005811400001094e6174697665[email protected]
0x560496e740400000080ffffff7f02000000Int.............
0x57074114000010a4e617469766555496e74[email protected]
0x5800500000000ffffffff02000090114000..............@.
0x590040653696e676c6500020000a0114000..Single......@.
0x5a00408457874656e646564020200000000..Extended......
0x5b0b41140000406446f75626c6501020000[email protected]....
0x5c0c41140000404436f6d70030200000000[email protected]......
0x5d0d4114000040843757272656e63790402[email protected]..
0x5e000000000e8114000050b53686f727453[email protected]
0x5f07472696e67ff0200fc11400014095041[email protected]
0x6006e736943686172301040000200000000nsiChar0.@......
0x6101412400014095057696465436861724c[email protected]
0x62010400002000000002c12400003084279.@......,[email protected]
0x6307465426f6f6c0000000080ffffff7f28teBool.........(
0x6401240000546616c736504547275650653[email protected]
0x650797374656d0200005c1240000308576fystem...\[email protected]
0x6607264426f6f6c0200000080ffffff7f58rdBool.........X
0x6701240000546616c736504547275650653[email protected]

Exports __dbk_fcall_wrapper 0xfbd2–0xfca2

0xfbd24100dc764000dc764000dc764000dc76[email protected]@[email protected]
0xfbe24000dc764000dc764000dc764000dc76@[email protected]@[email protected]
0xfbf24000dc764000dc764000dc764000dc76@[email protected]@[email protected]
0xfc024000dc76400000000900660841004100@[email protected].
0xfc12f4ff7e0841004d00ffffa5084100ca00..~.A.M.....A...
0xfc220c00dd0841004200f4ff050941004200....A.B.....A.B.
0xfc32f4ff2f0941004100f4ff6c0941004100../.A.A...l.A.A.
0xfc42f4ffa90941004100f4fff50941004100....A.A.....A.A.
0xfc52f4ff0d000f544d756c74695761697445.....TMultiWaitE
0xfc6276656e741800289c4a00064372656174vent..(.J..Creat
0xfc72650300440a410008000002002700b40ae..D.A......'...
0xfc8241000744657374726f79030000000000A..Destroy......
0xfc9208000108440a410000000453656c6602....D.A....Self.
0xfca200                              .               

x86 indirect call through a global pointer 0x1cc08–0x1ccc8

0x1cc08c6e81afeffff598bd88bc35f5e5b8be5......Y...._^[..
0x1cc185dc38bc0558bec83c4f05356578bf08d]...U.....SVW...
0x1cc287df0a5a5a5a58bda8bc3e805c2feff66}..............f
0x1cc38837df0017422a128c54a008338007411.}..t".(.J..8.t.
0x1cc488b3528c54a008b368d55f08bc3ffd6eb.5(.J..6.U......
0x1cc5807b010e84498feff5f5e5b8be55dc390....D..._^[..]..
0x1cc68558bec81c410ffffff53565733db899dU........SVW3...
0x1cc7810ffffff899d14ffffff899d18ffffff................
0x1cc88899d1cffffff899d20ffffff899d24ff........ .....$.
0x1cc98ffff895de4894dd88955dc8945e033c0...]..M..U..E.3.
0x1cca85568b7e2410064ff306489208b45e085Uh..A.d.0d. .E..
0x1ccb8c074078b45d885c0750733dbe9c60900.t..E...u.3.....
0x1ccc80083cfff8b450c408945d0          [email protected].     

FNV1a prime multiply loop 0x339c8–0x33a88

0x339c80003d08b028945f8895dfc8b41103d00......E..]..A.=.
0x339d8000080750a8bd68b45fcff55f8eb0a8b...u....E..U....
0x339e8d08bce8b45fcff55f85f5e5b59595dc2....E..U._^[YY].
0x339f804008bc05303d03bd076100fb61833cb....S..;.v....3.
0x33a0869c993010001403bd077f08bc15bc390i.....@;.w...[..
0x33a18558becdb6d0850c70200000000d9e49bU...m.P.........
0x33a28dfe09b9e7412d9f4d9c9db1ad9e8d9e0....t...........
0x33a38d9c9d9fdff02ddd958db389b5dc20c00........X.8.]...
0x33a4853b8010000000fa231c0f7c200000002S.......1.......
0x33a58740383c801f7c200000004740383c802t..........t....
0x33a68f7c101000000740383c804f7c1000200......t.........
0x33a7800740383c808f7c100000800740383c8.t..........t...
0x33a8810f7                            ..              

Native stack immediate byte-string fragment 0x5b395–0x5b475

0x5b395c045003000000034a94300f87e400000.E.0...4.C..~@..
0x5b3a57f400014b44500e8804000088140000c[email protected]...@...@..
0x5b3b581400010814000048140008c7d4000a4.@...@...@..}@..
0x5b3c57d4000d4b1450004c5450020fa440078}@...E...E. .D.x
0x5b3d5c645009cc64500b4b94500b8c64500c8.E...E...E...E..
0x5b3e5c64500d0c64500ecc64500e0c64500e4.E...E...E...E..
0x5b3f5c6450004b2450010b245007cb24500f0.E...E...E.|.E..
0x5b405c64500d0c845000e0000000000010000.E...E..........
0x5b41500340144002000000000000000000000.4.D. ..........
0x5b425040000f00843001c0000000546546169.....C......FTai
0x5b4356c02000034014400200000000b465061l...4.D. ....FPa
0x5b44572616d65746572730200005809430024rameters...X.C.$
0x5b4550000000b4652657475726e5479706502....FReturnType.
0x5b46500009c104000280000000d4656697274....@.(....FVirt
0x5b47575616c496e646578020000000200a5  ualIndex....... 