Benign windows Download

Postman.Postman

Zero-entropy exe section (carved/packed PE)Authenticode chain CN: Postman, Inc.

SHA-256710d6bbc5dee9d1800c48bfc25c17b7c7372a17a121b65d618c9a49880cac947

URLhttps://dl.pstmn.io/download/version/12.28.1/windows_64

MaleculeO₆(As₇C₂DyErPS₂)H₇(CmDbF₅MgOs₈Po₅U₂)Md₃(Bi₁₁Si₄)

Evidence

Zero-entropy exe section (carved/packed PE) 0x3a0–0x650

⋯5 more rows
0x3f000000000000000000000000000000000................
0x4004883ec284533c0488d0df25a030033d2H..(E3.H...Z..3.
0x410ff158a50020085c07521ff1528500200...P....u!..(P..
0x4200fb7c881c90000078085c00f4ec885c9............N...
0x4307909c605fb72030001eb0ac7059b5a03y....r........Z.
⋯34 more rows

LoadLibraryExW w/ SYSTEM32 search 0x1108b–0x1115b

⋯3 more rows
0x110bb00eb6b4d8bbcf77877020033d2498bcf..kM...xw..3.I..
0x110cb41b800080000ff1591440100488bd848A........D..H..H
0x110db85c0757eff156343010083f857752d44..u~..cC....Wu-D
0x110eb8d4307498bcf488d15305b0100e81374.C.I..H..0[....t
⋯7 more rows

Binary imports ADVAPI32.dll 0x24e30–0x24f50

⋯3 more rows
0x24e605553455233322e646c6c000000000000USER32.dll......
0x24e7041445641504933322e646c6c00000000ADVAPI32.dll....
0x24e80523838f8d3fcd111a6b9006097df5bd4R88........`..[.
0x24e9040be964c5c91cf1199d300aa004ae837@..L\........J.7
0x24ea05348454c4c33322e646c6c0000000000SHELL32.dll.....
0x24eb06f6c6533322e646c6c00000000000000ole32.dll.......
0x24ec04f4c4541555433322e646c6c00000000OLEAUT32.dll....
0x24ed075726c6d6f6e2e646c6c000000000000urlmon.dll......
0x24ee04b00450052004e0045004c0033003200K.E.R.N.E.L.3.2.
⋯7 more rows

Dense api-ms-win-core string cluster 0x26150–0x262a0

⋯3 more rows
0x26180d0770240010000001078024001000000[email protected].@....
0x261906100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x261a069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x261b06600690062006500720073002d006c00f.i.b.e.r.s.-.l.
0x261c031002d0031002d0031000000000000001.-.1.-.1.......
0x261d06100700069002d006d0073002d007700a.p.i.-.m.s.-.w.
0x261e069006e002d0063006f00720065002d00i.n.-.c.o.r.e.-.
0x261f0730079006e00630068002d006c003100s.y.n.c.h.-.l.1.
0x262002d0032002d0030000000000000000000-.2.-.0.........
0x262106b00650072006e0065006c0033003200k.e.r.n.e.l.3.2.
0x2622000000000000000006100700069002d00........a.p.i.-.
0x262306d0073002d0000000000000002000000m.s.-...........
⋯7 more rows

References the .NET mscoree loader name 0x267a8–0x26868

⋯3 more rows
0x267d860400300300000000000000005000000`@..0...........
0x267e86d00730063006f007200650065002e00m.s.c.o.r.e.e...
0x267f864006c006c000000436f724578697450d.l.l...CorExitP
⋯7 more rows