Benign windows Download

Thorlabs.XA

Legitimate signed installer

Locker partial-encryption ratio flagAuthenticode chain CN: Thorlabs, Inc.

SHA-256668af810a7aaf76b2f76af10fb1cd2db0818f1f56fc83a7969e0d0d45f95a1f3

URLhttps://media.thorlabs.com/contentassets/82fdbecc51734f00aeb7b16117e3420a/thorlabs_xa_setup_28670_x64.exe?v=0918071358

MaleculeO₁₀(IAlAs₇C₃CoDy₂Er₄P₂PrS)H₉(Cm₄Db₃F₁₀HfMgOs₁₄Po₁₂TiU₂)Md₇(Bi₁₇PaPtSi₃)

Evidence

Large PE with elevated code entropy 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400558bec568b751085f674178b4d0c8b55U..V.u...t..M..U
0x41008668b02663b01750e83c20283c1024e.f..f;.u.......N
0x42075ef33c05e5dc30fb702663b015e1bc0u.3.^]....f;.^..
0x43083e0fe405dc3cccccccccccccccccccc...@]...........
0x440558bec8b4d1085c9741b8b450c0fb7d0U...M...t..E....
0x4508bc2c1e210578b7d080bc2d1e9f3ab13.....W.}........
0x460c966f3ab5f8b45085dc3cccccccccccc.f.._.E.].......
0x470c3cccccccccccccccccccccccccccccc................
0x480558bec8b451085c075058b45085dc303U...E...u..E.]..
0x490c08945105de996280500cccccccccccc..E.]..(........
0x4a0558bec8b451485c0741250ff7510ff75U...E...t.P.u..u
0x4b00cff7508e88843050083c4108b45085d..u...C......E.]
0x4c0c3cccccccccccccccccccccccccccccc................
0x4d0558bec8b550c85d274148b45108b4d08U...U...t..E..M.
0x4e00fb700663901740a83c1024a75f533c0...f9.t....Ju.3.
0x4f05dc38bc15dc3cccccccccccccccccccc]...]...........
0x500558bec8b451085c075058b45085dc303U...E...u..E.]..
0x510c08945105de9662e0500cccccccccccc..E.].f.........
0x520558becf6450801568bf1c706708f4900U...E..V....p.I.
0x530740956e89a22050083c4048bc65e5dc2t.V..".......^].
0x5400400cccccccccccccccccccccccccccc................
0x550558bec8b45088b550c89108948045dc2U...E..U....H.].
0x5600800cccccccccccccccccccccccccccc................
0x570558bec8b0183ec088d55f8ff750852ffU........U..u.R.
0x580500c8b550c8b48043b4a04750e8b003bP..U..H.;J.u...;
0x590027508b0018be55dc2080032c08be55d.u.....]...2...]
0x5a0c20800cccccccccccccccccccccccccc................
0x5b0558bec8b45083b4804750d8b003b450cU...E.;H.u...;E.
0x5c07506b0015dc2080032c05dc20800ccccu...]...2.].....
0x5d0b8f0fb4900c3cccccccccccccccccccc...I............
0x5e0558bec5156ff750cc745fc00000000e8U..QV.u..E......
0x5f0f62005008b750883c40485c0baf8fb49. ...u.........I
0x600000f45d0c746140f000000c746100000..E..F......F...
0x6100000c60600803a00751433c951528bce......:.u.3.QR..
0x620e8ab3300008bc65e8be55dc208008bca..3....^..].....
0x630578d79018a014184c075f92bcf5f5152W.y...A..u.+._QR
0x6408bcee8893300008bc65e8be55dc20800....3....^..]...
0x650b808fc4900c3cccccccccccccccccccc...I............
0x660558bec518b450c568b7508c745fc0000U..Q.E.V.u..E...
0x670000083f80175286a15c746140f000000.....u(j..F.....

x86 indirect call through a global pointer 0x95f–0xa1f

0x95f00005e5dc20c0033c0668906d1e9890f..^]...3.f......
0x96f33c05f5e5dc20c00cccccccccccccccc3._^]...........
0x97fcc56578bf98b47288d57288b700403f2.VW...G(.W(.p...
0x98fff15a41149008906ff771ce825300500....I....w..%0..
0x99f8b35ec13490083c404ff7724ffd6837f.5..I.....w$....
0x9af18087205ff7704ffd6c7471807000000..r..w....G.....
0x9bfc747140000000033c0668947048b078b.G.....3.f.G....
0x9cf4004ff3438ff15a81149005f5ec3cccc@..48....I._^...
0x9dfcc558bec83ec185356681900020068a0.U.....SVh....h.
0x9effd490068010000808d4de8c745e80000.I.h.....M..E...
0x9ff0000c745ec00000000c745f000000000...E......E.....
0xa0fe8fcfdffff8b75e885c0753b8d45f850......u...u;.E.P
0xa1f8d45fc508d45f4506a0068          .E.P.E.Pj.h     

Native stack immediate byte-string fragment 0xd499–0xd569

0xd4998d4dc0e8b40e0000c645fc038d461083.M.......E...F..
0xd4a978140872028b00508d45c0508d8548ffx..r...P.E.P..H.
0xd4b9ffff50e8f4daffffc645fc048d4da851..P......E...M.Q
0xd4c9508d8560ffffff50e83adaffff83c418P..`...P.:......
0xd4d9c645fc05508d4dd8e8cbebffffc645fc.E..P.M.......E.
0xd4e9046a00538d8d60ffffffe83c0b0000c6.j.S..`....<....
0xd4f945fc036a00538d8d48ffffffe82a0b00E..j.S..H....*..
0xd50900c645fc026a00538d4dc0e81b0b0000..E..j.S.M......
0xd519885dfc6a00538d4da8e80d0b00006a00.].j.S.M......j.
0xd5298d85f4feffff508d45d850ffb5f8feff......P.E.P.....
0xd539ff8bcfe8820300008b46288b3889bde8.........F(.8...
0xd549feffff3bf80f844901000033c08945a0...;...I...3..E.
0xd5598945a46874184900c745a40700000089.E.ht.I..E......
0xd56945a066894590e8                  E.f.E..         

x86 CREATE_NO_WINDOW stack argument 0x6e465–0x6e525

0x6e465105357ff155ce54b0085c00f841f0100.SW..\.K........
0x6e475006a2ce87460feff5985c074098bc8e8.j,.t`..Y..t....
0x6e4857b69faff8bd86a2ce85f60feff5985c0{i....j,._`..Y..
0x6e495740b8bc8e86669faff8bf8eb0233ff53t....fi......3.S
0x6e4a568000000086a01ffb578fdffffffb570h....j...x.....p
0x6e4b5fdffff6a15ffb564fdffffff7630ff15...j...d....v0..
0x6e4c56ce54b0085c075178b13508d430c50ffl.K...u...P.C.P.
0x6e4d576288bcbff520884c00f84a30000008bv(...R..........
0x6e4e58580fdffff898594fdffff85c0740f50.............t.P
0x6e4f5e88873faff40593dffffff3f7e0433c0..s..@Y=...?~.3.
0x6e505eb218d34008bc6e8bf63feff8bc46a03.!.4.....c....j.
0x6e51556ffb594fdffff50e87dfaffff8bb598V......P.}......
0x6e525fdffff576a00ffb590fdffff50ff    ...Wj.......P.  

Locker partial-encryption ratio flag 0x502ccb0–0x502cdd0

0x502ccb0b9d5202d08570fbb0d61fa3d31939e80.. -.W...a.=1...
0x502ccc07e4091ee402261d60668b8f9fc8d47a0~@..@"a..h....G.
0x502ccd0ba081cde286be371f38fe01cf2b83c77....(k.q......<w
0x502cce0918c4fc324a0f4e71d8fdeeabf46872b..O.$........F.+
0x502ccf0ae6582cb8a9ef0150248bd694a6f9c00.e.......H.iJo..
0x502cd00f28e06f5ce45b557cded302288da3332.....E.W..0"..32
0x502cd10202d723925eba7b9ce90265a5bf12792 -r9%.....&Z[.'.
0x502cd2037e865583a3778fcf07d105dab4dde5c7.eX:7x..}.].M.\
0x502cd30dfc8b45ed9a9aa18fe84133febae15cc...^.......?....
0x502cd40df2f472828bf5fb3a6996e6261e26866./G((._...nba.hf
0x502cd5048c571a25723ee05353dce91415fccdaH.q.W#..5=..A_..
0x502cd608034f1733f344dbe4353855e0f50207f.4.s?4M.CS.^.P .
0x502cd70877c07a4e19b77a6e69b61f65065c585.|....w...a.Pe..
0x502cd809508230aca158681af07e520ea0f6a77..#........ ..jw
0x502cd9037aa55a5b3f57b9f0dc09f9d619e63a87.U...{.....a.c.
0x502cda0469359097bba0705cf526d7affe51524F.Y.{....Rmz...$
0x502cdb06070a42c13a242b06380a70662d868be`p.,..B.c...b.h.
0x502cdc03251429e5b8b18a904d2be6290d8e2282QB.[......b...(
0x502cdd07fa6b69f3d                      ....=           