Benign windows Download

thunderbird-portable 155.0.1_Portuguese

Legitimate signed Thunderbird portable

Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealersMinimal PE imports with dynamic loading

SHA-256a56acfbbd55c3e57e08ee4b2ee8a3f21d15061fce19b1058dc39ab59d989c8f2

URLhttps://sourceforge.net/projects/portableapps/files/Mozilla%20Thunderbird%2C%20P.E./Mozilla%20Thunderbird%2C%20Portable%20Edition%20155.0.1/ThunderbirdPortable_155.0.1_Portuguese.paf.exe/download

MaleculeK₄(Am₄Li₈LuTe)O₆(As₃C₂Ca₃Dy₃Er₃Pr)H₁₁(Cm₃₄Cr₁₅Db₁₀DsF₂₆Hf₆Mg₇Os₃₇Po₂₇Ti₂U₈)Md₈(Bi₁₆BkHePa₂Pt₂Si₅)Th

Evidence

NSIS self-extracting installer 0x25c4–0x2694

⋯3 more rows
0x25f42f00008b45d8a9f0ffffff757c817ddc/...E......u|.}.
0x2604efbeadde7573817de8496e7374756a81....us.}.Instuj.
0x26147de4736f66747561817de04e756c6c75}.softua.}.Nullu
0x2624580945088b45088b0df0a6420083e002X.E..E.....B....
⋯7 more rows

Hardcoded Windows root path (C:\, D:\, etc.) 0xa7cec3–0xa7cfd3

⋯3 more rows
0xa7cef3092b7055135fc1c7fef26e0492055119.+pU._....n...Q.
0xa7cf03274c3a2f4f84fea40c8403e31fa43234'L:/O.........24
0xa7cf13a403dcab9ba070b46a1334ce8871c937......p.j.4..q.7
0xa7cf23f475519b9ae78e0fd48d73e7d9884181.uQ.......s...A.
0xa7cf332793c8524b8850e4d1e69be8828c1b5f'..RK.P........_
0xa7cf43043e57017c97124639f4baf7c99fd207.>W.|..F9.......
0xa7cf53dcc06d0ee85c6645bf5362c453ec4dba..m..\fE.Sb.S.M.
0xa7cf63e55de6a4c9741f13c32d4c887d8c9d9e.]...t...-L.}...
⋯7 more rows

Unquoted card-number or PAN field key 0x4303639–0x43036f9

⋯3 more rows
0x4303669cc9aac7d19ec440fed398bb10227028d...}..D..9...'..
0x430367950616e3adb9776a9ea47c3bb9164a634Pan:..v..G...d.4
0x430368910df9559a6b48eda2f22e304ec135ede...Y..../"....^.
⋯7 more rows