Benign windows Download

Monotype.MonotypeFonts

Legitimate Monotype font installer

Packed Rider-branded zero-import loaderUnsigned PE claims Microsoft authorship

SHA-2564203e3d4fca62c71b83871ab21347d6d708adeecfd4735b44245e810cd4beb04

URLhttps://monotypeapp.monotype.com/release/770/win/MTFInstallerWindows.zip

MaleculeK₅(Am₄Li₄₂LuMc₁₀Te₅)O₁₄(Er₂₈Al₆C₃₇Co₆As₄₅Ca₆Dy₉Eu₃I₁₀La₂P₈Pr₃S₁₄Xe₇)H₁₂(BrCm₁₀₁Cr₃₃Db₇₄Ds₂F₅₁Hf₁₃Mg₈Os₈₇Po₈₃Ti₂U₂₂)Md₁₁(Bi₃₆Bk₅In₁₄Pa₃₆Pd₃Pm₂Pt₇Si₄)

Evidence

Dense x64 TLS-array pointer access mscordbi.dll · 0x3c0–0x650

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400488d05b1211200c3ccccccccccccccccH...!...........
0x4104883ec2883fa03755f8b0d8520120065H..(...u_... ..e
0x420488b042558000000ba2000000048895cH..%X.... ...H.\
0x4302420488b04c8488b1c104885db742a48$ H...H...H..t*H
0x440c70410000000004c8d0deaed0f00ba00.......L........
0x4500000014533c0488bcbe8729b0600c643...E3.H...r....C
0x4601001f0ff055b181200488b5c2420b801.....[...H.\$ ..
0x4700000004883c428c3b8010000004883c4...H..(......H..
0x48028c3cccccccccccccccccccccccccccc(...............
0x4904883ec384885d2742b8d41fd83f80177H..8H..t+.A....w
0x4a0234889542428488d050b8a0f0033d248#H.T$(H......3.H
0x4b0894424204533c94533c0e82129000048.D$ E3.E3..!)..H
0x4c083c438c3b8570007804883c438c3cccc..8..W...H..8...
0x4d048895c2408574883ec30488b7c246848H.\$.WH..0H.|$hH
0x4e085ff0f84b50000008d41fd83f8020f87.........A......
0x4f0a900000048c744246800000000488d44....H.D$h....H.D
0x50024684889442428488d05aa890f004889$hH.D$(H......H.
0x510442420e8c8280000488b5c2468488d83D$ ..(..H.\$hH..
0x520a8000000b9d00000004885db480f44c1.........H..H.D.
0x5308338007538488d8be0010000b8080200.8.u8H..........
0x540004885db480f44c8488b442460488901.H..H.D.H.D$`H..
0x550488b034c8bc7488d1543290f00488bcbH..L..H..C)..H..
0x560488b00ff158f030f008bf8eb05bf0540H..............@
0x57000804885db7419488b03488bcb488b40..H..t.H..H..H.@
0x58010ff1571030f0048c744246800000000...q...H.D$h....
0x5908bc7488b5c24404883c4305fc3b85700..H.\[email protected]_..W.
0x5a00780488b5c24404883c4305fc3cccccc..H.\[email protected]_....
0x5b048894c2408534883ec20488bd9488b09H.L$.SH.. H..H..
0x5c04885c97414488b01488b4010ff152603H..t.H..H.@...&.
0x5d00f0048c703000000004883c4205bc3cc..H......H.. [..
0x5e048895c24084889742410574883ec3049H.\$.H.t$.WH..0I
0x5f08bf1488b7c24604885ff0f84e4000000..H.|$`H........
0x6008d41fd83f8020f87d800000048c74424.A..........H.D$
0x6106000000000488d442460488944242848`....H.D$`H.D$(H
0x6208d0592880f0048894424204533c9e8ad......H.D$ E3...
0x630270000488b5c2460488d83a8000000b9'..H.\$`H.......
0x640d00000004885db480f44c18338007561....H..H.D..8.ua
0x650488d83e0010000b9080200004885db48H...........H..H

Vectorized zero-fill instruction sequence mscordbi.dll · 0x90d–0x9cd

0x90d4533ff4885d2490f44ff48897c242041E3.H..I.D.H.|$ A
0x91d8bef44897c24284885ff7412488bcfff..D.|$(H..t.H...
0x92d1556fb0e00bd01000000896c2428b910.V.........l$(..
0x93d000000e8eb190c00488bd84889442460........H..H.D$`
0x94d0f57c00f110048894424684c89384885.W....H.D$hL.8H.
0x95df67405f048ff4618488b084885c97425.t..H.F.H..H..t%
0x96d48c7c0fffffffff0480fc141184883f8H.......H..A.H..
0x97d017512488b01ba01000000488b4018ff.u.H.......H.@..
0x98d1566ff0e00488933498b064889430849.f...H.3I..H.C.I
0x99d891e85ed740e488bcfff15d4fa0e0044....t.H........D
0x9ad897c2428488b5c24704883c430415f41.|$(H.\$pH..0A_A
0x9bd5e5f5e5dc3cccccccccccccccccccccc^_^]............
0x9cdcccccc48894c2408534883ec2048    ...H.L$.SH.. H  

PE imports ordinal 8 by number mscordbi.dll · 0xf0fd8–0xf12c8

⋯3 more rows
0xf10080000d065000000e065000000f0650000...e....e....e..
0xf101800006600000010660000002066000000..f....f... f...
0xf102830660000004066000000506600000060[email protected]...`
0xf103866000000706600000080660000009066f...pf....f....f
0xf1048000000a066000000b066000000c06600....f....f....f.
0xf10580000d066000000e066000000f0660000...f....f....f..
0xf106800006700000010670000003067000000..g....g...0g...
0xf1078506700000070670000009067000000b0Pg...pg....g....
0xf108867000000d067000000b06a000000e06ag....g....j....j
0xf1098000000606b000000706b000000b06b00...`k...pk....k.
0xf10a80000c06b000000d06b000002a06d0000...k....k....m..
0xf10b802406e000002906e000002306f000000[email protected]...
0xf10c810790000002079000000808200000040.y... y........@
0xf10d88e0000006098000000009a000000a09f....`...........
0xf10e800000010a100000040a2000000e0a400........@.......
0xf10f80000e0a6000000a0a9000000d0ad0000................
0xf11080070b000000000b300000010b5000000.p..............
0xf1118c0b6000000b0b7000000a0b8000000a0................
0xf1128b900000080ba00000050bb000000f0bf.........P......
0xf113800000050c0000000c0c000000040c100...P.........@..
0xf11480000b0c1000000f0c600000050c70000............P...
0xf115800d0c700000050c800000000ca000000......P.........
0xf116890cf000000c0d100000040d200000050[email protected]
0xf1178d200000090d2000000c0d200000030d9..............0.
0xf118800000050e400000070e500000050e600...P....p....P..
0xf1198000060e700000010e800000010e90000..`.............
0xf11a800e02101000000230100008026010000..!....#....&...
0xf11b880270100008028010000b02b010000d0.'....(....+....
0xf11c82b010000c02e010000a0300100003033+.........0...03
0xf11d80100006035010000003d010000404301...`5....=...@C.
⋯3 more rows
0xf12186e010000c0820100004085010000808dn........@......
0xf1228010000508e0100001091010000709401...P.........p..
0xf1238000020a701000030b1010000a0b80100.. ....0........
0xf12480040c601000040cd01000060cd010000.@....@....`....
0xf125870cf010000c0d7010000f0d701000080p...............
0xf1268de01000020df010000e0df01000010e0.... ...........
0xf127801000030e001000050e0010000f0e001...0....P.......
0xf12880000c0e101000060e201000020e30100.......`.... ...
0xf12980020e701000050ea010000d0ea010000. ....P.........
0xf12a830f201000040f201000050f201000060[email protected]....`
0xf12b8f201000070f201000080f201000090f2....p...........
0xf12c8010000a0f2010000b0f2010000c0f201................

PE company name identifies Microsoft mscordbi.dll · 0x12a3c0–0x12a6b0

⋯3 more rows
0x12a3f000000000000000000000000000000000................
0x12a40000000000000000000000000000000100................
0x12a41010000000180000800000000000000000................
0x12a42000000000000001000100000030000080............0...
0x12a43000000000000000000000000000000100................
0x12a440090400004800000060e0120050040000....H...`...P...
0x12a45000000000000000000000000000000000................
0x12a460500434000000560053005f0056004500P.4...V.S._.V.E.
0x12a4705200530049004f004e005f0049004e00R.S.I.O.N._.I.N.
⋯6 more rows
0x12a4e08c030000010030003400300039003000......0.4.0.9.0.
0x12a4f034004200300000004c001600010043004.B.0...L.....C.
0x12a5006f006d00700061006e0079004e006100o.m.p.a.n.y.N.a.
0x12a5106d006500000000004d00690063007200m.e.....M.i.c.r.
0x12a5206f0073006f0066007400200043006f00o.s.o.f.t. .C.o.
0x12a530720070006f0072006100740069006f00r.p.o.r.a.t.i.o.
0x12a5406e000000680020000100460069006c00n...h. ...F.i.l.
0x12a55065004400650073006300720069007000e.D.e.s.c.r.i.p.
0x12a560740069006f006e00000000002e004e00t.i.o.n.......N.
0x12a570450054002000520075006e0074006900E.T. .R.u.n.t.i.
0x12a5806d006500200044006500620075006700m.e. .D.e.b.u.g.
0x12a590670069006e0067002000530065007200g.i.n.g. .S.e.r.
0x12a5a0760069006300650073000000a2004100v.i.c.e.s.....A.
0x12a5b00100460069006c006500560065007200..F.i.l.e.V.e.r.
0x12a5c0730069006f006e000000000039002c00s.i.o.n.....9.,.
0x12a5d030002c0031003100320035002c0035000.,.1.1.2.5.,.5.
0x12a5e031003700310036002000400043006f001.7.1.6. [email protected].
0x12a5f06d006d00690074003a00200066006100m.m.i.t.:. .f.a.
0x12a600370063006400640065006400330037007.c.d.d.e.d.3.7.
0x12a610390038003100610039003700630065009.8.1.a.9.7.c.e.
0x12a62063003900610033006500320033003300c.9.a.3.e.2.3.3.
0x12a63063003400610036006100660035003800c.4.a.6.a.f.5.8.
0x12a64061003900310063003500370000000000a.9.1.c.5.7.....
0x12a6503a000d00010049006e00740065007200:.....I.n.t.e.r.
0x12a6606e0061006c004e0061006d0065000000n.a.l.N.a.m.e...
0x12a6706d00730063006f007200640062006900m.s.c.o.r.d.b.i.
⋯4 more rows

References the .NET mscoree loader name Monotype%2520Fonts.exe · 0xa46a718–0xa46a7d8

⋯3 more rows
0xa46a748626c6f636b0000002b00000000000000block...+.......
0xa46a7586d00730063006f007200650065002e00m.s.c.o.r.e.e...
0xa46a76864006c006c000000436f724578697450d.l.l...CorExitP
⋯7 more rows

Showing the top 5 files — 6 more files (890 regions) not shown.

No evidence locations were recorded for this file. Raw result