Benign windows Download

Polyv.PolyvLive

Signed legitimate installer

Authenticode chain CN: EaseFun Information Technology Co., Ltd.Binary contains high-entropy data regions

SHA-256a9a9bdac079d9b2d27c73b0916b5ae47e02cfb377244623acffd5417aff179a4

URLhttps://soft.polyv.net/rc/PolyvLiveSetup64.exe

MaleculeO₅(As₅C₂DyEr₂P)H₆(CmF₉Os₆Po₆TiU₂)Md₆(Bi₁₃BkPaSi₃)

Evidence

x86 indirect call through a global pointer 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400558bec83ec5c837d0c0f742b837d0c46U....\.}..t+.}.F
0x4108b4514750d834818108b0db4ea470089.E.u..H......G..
0x420480450ff7510ff750cff7508ff158c92H.P.u..u..u.....
0x4304000e94b01000053568b35bcea470057@..K...SV.5..G.W
0x4408d45a450ff7508ff15909240008365f4[email protected].
0x4500089450c8d45e450ff7508ff15949240..E..E.P.u.....@
0x460008b7df08365f0008b1d44904000e989..}..e....D.@...
0x4700000000fb646520fb656560faf55e88b.....FR..VV..U..
0x480cf2b4de80fafc103c299f7ff894d100f.+M..........M..
0x490b6c0c1e0088945140fb646510fafc10f......E...FQ....
0x4a0b64e550faf4de803c199f7ff8b4d140f.NU..M.......M..
0x4b0b656540faf55e80fb6c00bc80fb64650.VT..U........FP
0x4c00faf451003c299f7ffc1e1080fb6c00b..E.............
0x4d0c88d45f450894df8ff15489040008345[email protected]
0x4e0f004508945148d45e450ff750cff1598..P.E..E.P.u....
0x4f0924000ff7514ffd38345e804397de80f[email protected]}..
0x5008c6effffff837e58ff7465ff7634ff15.n....~X.te.v4..
0x5104c90400089451485c074558b7d0c6a01[email protected].}.j.
0x52057c745e410000000c745e808000000ffW.E......E......
0x5301550904000ff765857ff1554904000ff[email protected].@..
0x54075148b355890400057ffd66820080000[email protected] ...
0x55089450c8d45e4506aff68a06a470057ff.E..E.Pj.h.jG.W.
0x560159c924000ff750c57ffd6ff7514ffd3[email protected]...
0x5708d45a450ff7508ff15a09240005f5e33.E.P.u.....@._^3
0x580c05bc9c210008b4c2404a1c8ea47008b.[.....L$....G..
0x590d169d2204000008b540208f6c2027455.i. @...T.....tU
0x5a056578d710133ff3b35ccea470073448bVW.q.3.;5..G.sD.
0x5b0ce69c9204000008d440108538b08f6c1.i. @...D..S....
0x5c002740347eb1ef6c10474098bcf4f85c9.t.G.....t...O..
0x5d07420eb10f6c110750b8bd933da83e301t .....u...3....
0x5e033d989184605204000003b35ccea47003...F. @..;5..G.
0x5f072ca5b5f5ec20400558bec51518b5508r.[_^...U..QQ.U.
0x600538b1dc8ea4700568bf269f620400000S....G.V..i. @..
0x61003f38b460833c957894dfc894df8a802...F.3.W.M..M...
0x620740c394d0c740783e0be894608423b15t.9M.t.....F.B;.
0x630ccea470073448bc269c0204000008d7c..G.sD..i. @...|
0x64018088b0f8d4201f6c102740a6a0152e8.....B....t.j.R.
0x650a4ffffff8b0ff6c1047528f6c1407403.........u(..@t.
0x660ff45fcf6c1017405ff45fceb03ff45f8.E....t..E....E.
0x6708bd03b05ccea470072bc33c05f5e5bc9..;...G.r.3._^[.

NSIS self-extracting installer 0x2a52–0x2b22

0x2a52000005000200008bfe3bf07c028bf857.........;.|...W
0x2a6253e8cefcffff85c00f8479010000833dS.........y....=
0x2a720ceb470000757a6a1c538d45d850e8b3..G..uzj.S.E.P..
0x2a822700008b45d8a9f0ffffff7572817ddc'...E......ur.}.
0x2a92efbeadde7569817de8496e7374756081....ui.}.Instu`.
0x2aa27de4736f66747557817de04e756c6c75}.softuW.}.Nullu
0x2ab24e0945088b45088b0d74c1420083e002N.E..E...t.B....
0x2ac2090580eb47008b45f0890d0ceb47003b....G..E.....G.;
0x2ad2c60f8f18010000f64508087506f64508........E..u..E.
0x2ae2047541ff45fc8d70fc3bfe76128bfeeb.uA.E..p.;.v....
0x2af20ef645080275086a00e8d2fbffff593b..E..u.j......Y;
0x2b023538dd43007d0d5753ff75f8e89a3b0058.C.}.WS.u...;.
0x2b12008945f8013d74c142002bf785f60f8f..E..=t.B.+.....
0x2b2220                                              

Large PE with elevated code entropy 0x77d0–0x7860

0x77d000000000000000000000000000000000................
0x77e000000000000000000000000000000000................
0x77f000000000000000000000000000000000................
0x7800feb900000cba0000f0b90000e0b90000................
⋯6 more rows

NSIS runtime error URL in rdata 0x87d0–0x8950

⋯3 more rows
0x88002e002000250064002500250000000000.. .%.d.%.%.....
0x881049006e007300740061006c006c006500I.n.s.t.a.l.l.e.
0x88207200200069006e007400650067007200r. .i.n.t.e.g.r.
0x883069007400790020006300680065006300i.t.y. .c.h.e.c.
0x88406b002000680061007300200066006100k. .h.a.s. .f.a.
0x885069006c00650064002e00200043006f00i.l.e.d... .C.o.
0x88606d006d006f006e002000630061007500m.m.o.n. .c.a.u.
0x8870730065007300200069006e0063006c00s.e.s. .i.n.c.l.
0x88807500640065000a0069006e0063006f00u.d.e...i.n.c.o.
0x88906d0070006c0065007400650020006400m.p.l.e.t.e. .d.
0x88a06f0077006e006c006f00610064002000o.w.n.l.o.a.d. .
0x88b061006e0064002000640061006d006100a.n.d. .d.a.m.a.
0x88c067006500640020006d00650064006900g.e.d. .m.e.d.i.
0x88d061002e00200043006f006e0074006100a... .C.o.n.t.a.
0x88e06300740020007400680065000a006900c.t. .t.h.e...i.
⋯7 more rows

NSIS runtime error title in rdata 0x8a0c–0x8acc

⋯3 more rows
0x8a3c000000004e0043005200430000000000....N.C.R.C.....
0x8a4c4e005300490053002000450072007200N.S.I.S. .E.r.r.
0x8a5c6f007200000000000000000045007200o.r.........E.r.
⋯7 more rows