Benign windows Download

Fidpa.Hablara

Opaque NSIS overlay combines reboot and clipboard APIsString extraction truncated due to limits (count: 100000, total bytes: 50 MB)

SHA-25692df7fe3c5b57474c9fe0d239f8bd58e97499426f06b538eced7f331464d3889

URLhttps://github.com/fidpa/hablara-releases/releases/download/v1.7.6/Hablara_1.7.6_x64-setup.exe

MaleculeO₃(IAsC)H₅(CmF₈Os₅Po₃U)Md₄(Bi₅PaSi)

Evidence

English function-word token "this" 0x0–0x110

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯12 more rows

NSIS self-extracting installer 0x25c4–0x2694

⋯3 more rows
0x25f42f00008b45d8a9f0ffffff757c817ddc/...E......u|.}.
0x2604efbeadde7573817de8496e7374756a81....us.}.Instuj.
0x26147de4736f66747561817de04e756c6c75}.softua.}.Nullu
0x2624580945088b45088b0df08e410083e002X.E..E.....A....
⋯7 more rows

Clears the clipboard to take ownership 0x78f4–0x7a04

⋯5 more rows
0x794465004200436c6f7365436c6970626f61e.B.CloseClipboa
0x7954726400004a02536574436c6970626f61rd..J.SetClipboa
0x79647264446174610000c100456d70747943rdData....EmptyC
0x79746c6970626f6172640000f6014f70656elipboard....Open
0x7984436c6970626f61726400a40254726163Clipboard...Trac
0x79946b506f7075704d656e75000009004170kPopupMenu....Ap
⋯7 more rows

AdjustTokenPrivileges API symbol 0x7fc8–0x82b8

⋯3 more rows
0x7ff80000000000000000e09a420089134000..........B...@.
0x80088a6940006c3d40000a0000005c000000[email protected]=@.....\...
0x8018ffffffffffffffff7600650072006900........v.e.r.i.
0x80286600790069006e006700200069006e00f.y.i.n.g. .i.n.
0x80387300740061006c006c00650072003a00s.t.a.l.l.e.r.:.
0x804820002500640025002500000075006e00 .%.d.%.%...u.n.
0x80587000610063006b0069006e0067002000p.a.c.k.i.n.g. .
0x806864006100740061003a00200025006400d.a.t.a.:. .%.d.
0x807825002500000000002e002e002e002000%.%........... .
0x808825006400250025000000000000000000%.d.%.%.........
0x809849006e007300740061006c006c006500I.n.s.t.a.l.l.e.
0x80a87200200069006e007400650067007200r. .i.n.t.e.g.r.
0x80b869007400790020006300680065006300i.t.y. .c.h.e.c.
0x80c86b002000680061007300200066006100k. .h.a.s. .f.a.
0x80d869006c00650064002e00200043006f00i.l.e.d... .C.o.
0x80e86d006d006f006e002000630061007500m.m.o.n. .c.a.u.
0x80f8730065007300200069006e0063006c00s.e.s. .i.n.c.l.
0x81087500640065000a0069006e0063006f00u.d.e...i.n.c.o.
0x81186d0070006c0065007400650020006400m.p.l.e.t.e. .d.
0x81286f0077006e006c006f00610064002000o.w.n.l.o.a.d. .
0x813861006e0064002000640061006d006100a.n.d. .d.a.m.a.
0x814867006500640020006d00650064006900g.e.d. .m.e.d.i.
0x815861002e00200043006f006e0074006100a... .C.o.n.t.a.
0x81686300740020007400680065000a006900c.t. .t.h.e...i.
0x81786e007300740061006c006c0065007200n.s.t.a.l.l.e.r.
0x818827007300200061007500740068006f00'.s. .a.u.t.h.o.
0x81987200200074006f0020006f0062007400r. .t.o. .o.b.t.
0x81a8610069006e002000610020006e006500a.i.n. .a. .n.e.
0x81b87700200063006f00700079002e000a00w. .c.o.p.y.....
0x81c80a004d006f0072006500200069006e00..M.o.r.e. .i.n.
0x81d866006f0072006d006100740069006f00f.o.r.m.a.t.i.o.
0x81e86e002000610074003a000a0068007400n. .a.t.:...h.t.
0x81f8740070003a002f002f006e0073006900t.p.:././.n.s.i.
0x820873002e00730066002e006e0065007400s...s.f...n.e.t.
0x82182f004e005300490053005f0045007200/.N.S.I.S._.E.r.
0x822872006f00720000004500720072006f00r.o.r...E.r.r.o.
⋯9 more rows

PE overlay has high entropy 0xcd80–0xd070

⋯7 more rows
0xcdf000000000000000000000000000000000................
0xce0000000000efbeadde4e756c6c736f6674........Nullsoft
0xce10496e7374ac090200e4f92e0a5d000080Inst........]...
0xce20000056023c3e04a906910d9b238cba01..V.<>......#...
0xce30b90c3a9f6a21034678da391f62024bbb..:.j!.Fx.9.b.K.
0xce40841fbda54611c4340d621c2ff9e11116....F..4.b./....
0xce50e25f5c05dc29a0ef468766015c2ea122._\..)..F.f.\.."
0xce60466e3d730d37f423b52ffb64058d3e28Fn=s.7.#./.d..>(
0xce7004fe552b5fdabc52a41b4a629978f9a9..U+_..R..Jb.x..
0xce80e574fd6f21306a0b52bc7a4c9d73e244.t.o!0j.R.zL.s.D
0xce9034d38c022085364e3474d83ab811536c4... .6N4t.:..Sl
0xcea0054564e0b637bb82f820d1cb47b84f5a.Ed..7... ..G.OZ
0xceb0e4e5050f28293335a083d6883affea14....()35....:...
0xcec0afd06b62d7623af35252cc69124b6d07..kb.b:.RR.i.Km.
0xced0c27ec8df454f9a5e29794b0c9b510d2d.~..EO.^)yK..Q.-
0xcee04b4afcdf22a240b59e08b53640a774f6KJ.."[email protected]@.t.
0xcef02cd474275af90d43a449e2b0e8fe80dc,.t'Z..C.I......
0xcf00b5f3b69df1eda2cc9b3b7f6b25bac9c7.........;.k%...
0xcf1069f859d9ac5adc0732607c934c70c125i.Y..Z..2`|.Lp.%
0xcf20bea1b6edbc8980f4ca04bf07104ab3c0.............J..
0xcf30c14c6555ee0a6467289ddaedd28b6fe4.LeU..dg(.....o.
0xcf409b6cbf170e644618093b7d1961809cac.l...dF..;}.a...
0xcf5075384a8510e107b9558c522f8a832750u8J.....U.R/..'P
0xcf607dab364f8dbee872843e7ad2d2574cfe}.6O...r.>z..WL.
0xcf70d2f78919d5c8235d186a5e52b4069fc6......#].j^R....
0xcf809368fba84e294b0698332f9bdcef8b48.h..N)K..3/....H
0xcf9026bd6dfbd25c121a3390433b304ef017&.m..\..3.C;0N..
0xcfa009776ad06ee0a12cc4009ef0183e13f8.wj.n..,.....>..
0xcfb097463986a9541dfc7492085e83a33b3e.F9..T..t..^..;>
0xcfc03f26af421cb95976636fca8f27a7f5ee?&.B..Yvco..'...
0xcfd01a7c11a27eb853fca1bfdbff9d6527fd.|..~.S......e'.
0xcfe09cc3feb4945964391045167afec4dfa2.....Yd9.E.z....
0xcff0cf74d067ce490b76e89d71d88b420db3.t.g.I.v..q..B..
0xd00059a81342d5f5607209d5ac5545e9603bY..B..`r...UE.`;
0xd0107814720f3c288cd9c3b33b4d9b445927x.r.<(....;M.DY'
0xd020b86bff95824963f38816291bf143ed82.k...Ic...)..C..
0xd03049016f4c096fcf934a13f5710483ebb6I.oL.o..J..q....
0xd0403ea3cd9c6af5ea705c182f4ad27b0948>...j..p\./J.{.H
0xd0502702b6b15a13856b2a01c789b17860bd'...Z..k*....x`.
0xd0605498075eeae896555efea4b3aa8bf0edT..^...U^.......
0xd0708d674dafe2c1a9f2602d1f78375e19a4.gM.....`-.x7^..