Benign windows Download

antonreshetov.massCode

Opaque NSIS overlay combines reboot and clipboard APIsString extraction truncated due to limits (count: 100000, total bytes: 50 MB)

SHA-2563a7f4ef53c5f82d604756c9f72f3536934459391da49e0a4d7f99b7058c96fd9

URLhttps://github.com/massCodeIO/massCode/releases/download/v5.11.0/massCode-5.11.0-x64.exe

MaleculeO₄(IAsC₂Dy)H₅(CmF₉Os₆Po₃U)Md₄(Bi₅PaSi)

Evidence

English function-word token "this" 0x0–0x110

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯12 more rows

Clears the clipboard to take ownership 0x7c7c–0x7d8c

⋯5 more rows
0x7ccc65004200436c6f7365436c6970626f61e.B.CloseClipboa
0x7cdc726400004a02536574436c6970626f61rd..J.SetClipboa
0x7cec7264446174610000c100456d70747943rdData....EmptyC
0x7cfc6c6970626f6172640000f6014f70656elipboard....Open
0x7d0c436c6970626f61726400a40254726163Clipboard...Trac
0x7d1c6b506f7075704d656e75000009004170kPopupMenu....Ap
⋯7 more rows

AdjustTokenPrivileges API symbol 0x7dae–0x809e

⋯17 more rows
0x7ebe61746846726f6d49444c697374570000athFromIDListW..
0x7ece0a015368656c6c457865637574654578..ShellExecuteEx
0x7ede5700c30053484765745370656369616cW...SHGetSpecial
0x7eee466f6c6465724c6f636174696f6e0000FolderLocation..
⋯3 more rows
0x7f2e7565727956616c756545785700000502ueryValueExW....
0x7f3e52656753657456616c75654578570000RegSetValueExW..
0x7f4ecb01526567436c6f73654b657900d901..RegCloseKey...
⋯9 more rows
0x7fee6174654b657945785700414456415049ateKeyExW.ADVAPI
0x7ffe33322e646c6c00003800496d6167654c32.dll..8.ImageL
0x800e6973745f44657374726f79003400496dist_Destroy.4.Im
0x801e6167654c6973745f4164644d61736b65ageList_AddMaske
0x802e64003700496d6167654c6973745f4372d.7.ImageList_Cr
0x803e656174650000434f4d43544c33322e64eate..COMCTL32.d
0x804e6c6c00001000436f437265617465496ell....CoCreateIn
0x805e7374616e6365000005014f6c65556e69stance....OleUni
0x806e6e697469616c697a6500ee004f6c6549nitialize...OleI
0x807e6e697469616c697a65006500436f5461nitialize.e.CoTa
0x808e736b4d656d46726565006f6c6533322eskMemFree.ole32.
0x809e646c6c00000000000000000000000000dll.............

NSIS runtime error title in data 0x83f0–0x8550

⋯3 more rows
0x84202e002000250064002500250000000000.. .%.d.%.%.....
0x843053006500530068007500740064006f00S.e.S.h.u.t.d.o.
0x844077006e00500072006900760069006c00w.n.P.r.i.v.i.l.
0x845065006700650000004100000000000000e.g.e...A.......
0x84602e0074006d0070000000000041000000..t.m.p.....A...
0x84707e006e00730075000000000020005f00~.n.s.u..... ._.
⋯3 more rows
0x84b020002f0044003d00000000004e004300 ./.D.=.....N.C.
0x84c052004300000000004e00530049005300R.C.....N.S.I.S.
0x84d020004500720072006f00720000000000 .E.r.r.o.r.....
0x84e04500720072006f007200200077007200E.r.r.o.r. .w.r.
⋯7 more rows

PE overlay has high entropy 0xe780–0xea70

⋯7 more rows
0xe7f000000000000000000000000000000000................
0xe80000000000efbeadde4e756c6c736f6674........Nullsoft
0xe810496e7374ce1e0300614f340b87b70080Inst....aO4.....
0xe820ed7d097c54d5f5ff1b12822844b15a05.}.|T......(D.Z.
0xe8305146945508131641543024ec1096204bQF.U...AT0$... K
0xe84045e92499244326337196405245b4d6baE.$.$C&3q.@RE...
0xe85056b4da7dd1d6ee68adb575a956a52a5aV..}...h..u.V.*Z
0xe860bb5bec665b69b18a2d6d7f75add5f23f.[.f[i..-m.u...?
0xe870f79c7397f7de7d2f9328fcf4f7cfe433..s...}/.(.....3
0xe8809399b7dc77eff7de7beed9ef258ee34c....w...{...%..L
0xe89088384e7ff89feae738f0d5b9748ee3fc.8N.....8...t...
0xe8a06280e35c70bcf8e538e35fefe70c83ffb..\p...8._.....
0xe8b0979d50e274f7da6f79354131ff03ffef..P.t..oy5A1....
0xe8c02ad1e7bf0bdf6f2ab15feffc2fbfee36*.....o*._../..6
0xe8d0ea20ebb4e0eff4bb0cde9bf9f85723f4. ...........W#.
0xe8e0fbbffde9dc77e0d89da29d016d688637.....w......mh.7
0xe8f040ec24e02309eff3e15d1ea1fbbf0bf7@.$.#....]......
0xe9007c13deb7f1fddf86f71df0fe16bc6f87|.............o.
0xe910f7d170df46788b1ee884fb2e84f707e1..p.Fx..........
0xe9207d88a3eff73eff56f8bfddd396fe9e3e}....>.V.......>
0xe9303a147e7f43f487e57edb4bb4f7ae7e54:.~.C...~.K...~T
0xe940c68d5099438de77f9def0bba7fd860fa..P.C.........`.
0xe9502f46d56428e85af8f2d813fd9cbe57df/F.d(.Z.......W.
0xe960abefd5f7ea7bf5bdfa5e7dafbe57dfab.....{...^}..W..
0xe970efd5f7ea7bf5bdfa5e7dafbe57dfabef....{...^}..W...
0xe980d5f7ea7bf5bdfa5e7dafbe57dfabefd5...{...^}..W....
0xe990f7ea7bf5bdfa5e7dafbe57dfabefd5f7..{...^}..W.....
0xe9a0ea7bf5bdfa5e7dafbe57dfabefd5f7ea.{...^}..W......
0xe9b07bf5bdfa5e7dafbe57dfabefd5f7ea7b{...^}..W......{
0xe9c0f5bdfa5e7dafbe57dfabefd5f7ea7bf5...^}..W......{.
0xe9d0bdfa5efffbaf11f09e1f724ebe229673..^.......rN.".s
0xe9e0832dc7e5b94521652e0d39b73ce45c5d.-...E!e..9.<.\]
0xe9f0c8b9d521e7d6859c5b1f726e43c8b9fa...!....[.rnC...
0xea0090738980734343fa61680096f25cbf90.s..sCC.ah...\..
0xea10732521e74a43cef50f38379cc7448bd1s%!.JC...87..D..
0xea20263916c43d8f0cb0df7714bcaf834b36&9..=....w....K6
0xea30f26f99e7e277f01ecce325682c6d0ea8.o...w....%h,m..
0xea40cb0487726f7cda3216bbabcbd700b6de...ro|.2........
0xea50d4e526e3b7795f505d7ec7b93d0e445d..&..y_P]~..=.D]
0xea6076f4a22ec3795cbf04ef733d651ea87av....y\...s=e..z
0xea70beda4d3ddfb0d453dcf79e80717fa0ea..M=...S....q...