Benign windows Download

Mozilla.Thunderbird.ESR.en-GB

Legitimate signed Mozilla installer

Binary contains a UPX packing markerEntry point in a writable RWX section

SHA-256535f539b97901a50e78e4a2bd2a00ede1f853c4e32bd9836d8dc13c5988dd6c1

URLhttps://download-installer.cdn.mozilla.net/pub/thunderbird/releases/153.3.1esr/win64/en-GB/Thunderbird%20Setup%20153.3.1esr.exe

MaleculeK(Am)O₆(As₁₁C₃DyErPS)H₂(DbMg)Md₄(Bi₁₁HePaSi₃)

Evidence

UPX packer marker string 0x1a8–0x288

⋯3 more rows
0x1d800000000000000000000000000000000................
0x1e855505830000000000020030000100000UPX0..... ......
0x1f800000000000400000000000000000000................
0x20800000000800000e05550583100000000........UPX1....
0x21800100100003003000002010000040000.....0..........
⋯7 more rows

Writable and exe section (W^X violation) 0x3a0–0x670

⋯5 more rows
0x3f03c1804000000010000d6030026090030<...........&..0
0x400ffffffff8b442404ff74240c8b40086a[email protected]
0x41000508b08ff510cc20c00568bf1802600.P...Q....V...&.
0x4208d4e04e8f7fe7ffb090000318a230888.N.........1.#..
0x430465083665c008bc65ec2041e18ff6ed9FP.f\...^.....n.
0x440fe4833c089464002444818c38bc133c9[email protected].
0x4508908899665ebda480402050c02101418....e..H........
0x460599665591c20282c307dfb976534383cY.eY. (,0}..e48<
0x470c3b840a1410049018c3c51fff6ffbf52[email protected]..<Q....R
0x4807508578b7e0883c71857897df0ff1504u.W.~....W.}....
0x490c01a8b46088b4e1083baf6dbdb65fc09...F..N......e..
0x4a056143b4e75053b5014acab539bfdffd6V.;Nu.;P...S....
0x4b0ac018b18525150ff531085c05b754e2b....RQP.S...[uN+
0x4c0736e9beb9a0573140e3708c25508dc77sn....s..7..U..w
0x4d077ef2d52ff7510da750c50de8b4d0801w.-R.u..u.P..M..
0x4e04e259abbb9d61f53573251105d05e9daN%.....SW2Q.]...
0x4f0e5df324d1485c974058b89118a8200d9..2M...t........
0x500effef64df4da5f5e64890d0000c9c210...M.._^d.......
0x51000ff31197ff720b7bd08a281ecb81c8b..1... .........
0x520452c538b5d14ffbf6d77c91880200d43E,S.]...mw... .C
0x530cf894dec8bfe8b4b30c1e7028b0cf66f..M....K0......o
0x540c3ff0f8d04c88d4db48945d43b0dc7d5.......M..E.;...
0x5508d45b4502e2ffcb7ddcb0f35322f3483.E.P./.....52/4.
0x5607db8200fb6042045cc7611dadffe0abe}. ... E.v......
0x57001400080e9190b5a8d8d3cff007093ef[email protected]..<..p..
0x580de6c0a7cc645fc010e2cba8d853cfe93.l.|.E...,...<..
0x590edde02504a130e732d56f884c00f846a...PJ..s-V.....j
0x5a006b7dbb6ed985334842c602829170160......S4.,`()..`
0x5b01432ed0bb7ed03140f6b1c170cd0fed0.2.......k......
0x5c004742ef260bffddb1c8b8052043bd072.t..`......R.;.r
0x5d0107705f1760cbe057ddb7fb7db3f0d75.w..v...}....?.u
0x5e00a1775063beb04806517367573bfd9ff..u.;...e.6us...
0x5f0ec803e0074188d46045081790f646e0d..>.t..F.P.y.dn.
0x6002e2cfc610107ec8d705c765c977409b8.,.a....p\v\.t..
0x61051301476736a4c6884eeda7667222795Q0.vsjLh...vg"'.
0x6202359df181ab503740b171aef1ac4c814#Y.....t........
0x6300c43eb024c6bec5087bbdd7fcc894154.C..Lk.P......AT
0x6408bce15e3a24a8b485495fb7fbbee83c1.....J.HT.......
0x6500422c97b8d957252894e588b01ff1012.".{..rR.NX.....
0x660171e2b7c3bc17407adab394db872e80f..+|;.t...9M.r..
0x6706e6ddbdc86926a08183db452a63401d1nm....j..=.R.4..

Binary code section entropy at least 7.0 0x105c0–0x106a0

0x105c000000000000000000000000000000000................
0x105d000000000000000000000000000000000................
0x105e000000000000000000000000000000000................
0x105f000000000000000000000000000000000................
0x1060000000000000000000000000000000600................
0x1061003000000400000800500000040010080....@.......@...
0x1062006000000800100800e00000050020080............P...
0x10630100000009002008018000000d0020080................
⋯7 more rows

7-Zip SFX resource filename 0x2dfba–0x2e27a

0x2dfba01002000284200000300808000000100.. .(B..........
0x2dfca20002808010004000000000001002000 .(........... .
0x2dfda097700000500f40b0400840234000000.w..........4...
0x2dfea560053005f0056004500520053004900V.S._.V.E.R.S.I.
0x2dffa4f004e005f0049004e0046004f000000O.N._.I.N.F.O...
⋯6 more rows
0x2e06a300034003000390030003400420030000.4.0.9.0.4.B.0.
0x2e07a000030001000010043006f006d007000..0.....C.o.m.p.
0x2e08a61006e0079004e0061006d0065000000a.n.y.N.a.m.e...
0x2e09a00004d006f007a0069006c006c006100..M.o.z.i.l.l.a.
0x2e0aa0000400018000100460069006c006500[email protected].
0x2e0ba44006500730063007200690070007400D.e.s.c.r.i.p.t.
0x2e0ca69006f006e0000000000540068007500i.o.n.....T.h.u.
0x2e0da6e006400650072006200690072006400n.d.e.r.b.i.r.d.
0x2e0ea00002c000c000100460069006c006500..,.....F.i.l.e.
0x2e0fa560065007200730069006f006e000000V.e.r.s.i.o.n...
0x2e10a0000310038002e003000350000003000..1.8...0.5...0.
0x2e11a1000010049006e007400650072006e00....I.n.t.e.r.n.
0x2e12a61006c004e0061006d00650000003700a.l.N.a.m.e...7.
⋯5 more rows
0x2e18a69006e0061006c00460069006c006500i.n.a.l.F.i.l.e.
0x2e19a6e0061006d006500000037007a005300n.a.m.e...7.z.S.
0x2e1aa2e007300660078002e00650078006500..s.f.x...e.x.e.
0x2e1ba0000380018000100500072006f006400..8.....P.r.o.d.
0x2e1ca7500630074004e0061006d0065000000u.c.t.N.a.m.e...
0x2e1da00005400680075006e00640065007200..T.h.u.n.d.e.r.
0x2e1ea6200690072006400000030000c000100b.i.r.d...0.....
0x2e1fa500072006f0064007500630074005600P.r.o.d.u.c.t.V.
0x2e20a65007200730069006f006e0000003100e.r.s.i.o.n...1.
⋯7 more rows

Versioned 7-Zip SFX manifest description 0x2e313–0x2e423

⋯3 more rows
0x2e343747970653d2277696e3332222f3e0d0atype="win32"/>..
0x2e3533c6465736372697074696f6e3e372d5a<description>7-Z
0x2e36369702053656c662d6578747261637469ip Self-extracti
0x2e3736e672041726368697665207631382e30ng Archive v18.0
0x2e383353c2f6465736372697074696f6e3e0d5</description>.
0x2e3930a3c646570656e64656e63793e0d0a3c.<dependency>..<
⋯9 more rows