Suspicious ^80% windows Download

SosomLab.NexaMemKeeper

Tampered Inno loader, unsigned, evasive

Innoextract found setup loader checksum mismatchInnoextract found unexpected setup loader revision

SHA-256b14b69822c78bd24d5af9a97f9903e849bcd4eccc95425b4977ccea55747e6e7

URLhttps://github.com/SosomLab/nexa-memkeeper/releases/download/0.7.0/NexaMemKeeper-0.7.0-setup.exe

MaleculeK(Te)O(Er)H₇(Cr₂Db₃F₂Mg₂Os₆Po₄U)Md₂(Bi₆Pa)

Evidence

English function-word token "this" 0x0–0xb0

0x04d5a50000200000004000f00ffff0000MZP.............
0x10b80000000000000040001a0000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000000010000................
0x40ba10000e1fb409cd21b8014ccd219090........!..L.!..
0x50546869732070726f6772616d206d7573This program mus
0x60742062652072756e20756e6465722057t be run under W
⋯5 more rows

Borland locales registry key 0xb73c–0xb80c

⋯3 more rows
0xb76c4c006f00630061006c00650073000000L.o.c.a.l.e.s...
0xb77c53006f00660074007700610072006500S.o.f.t.w.a.r.e.
0xb78c5c0042006f0072006c0061006e006400\.B.o.r.l.a.n.d.
0xb79c5c004c006f00630061006c0065007300\.L.o.c.a.l.e.s.
⋯7 more rows

ChaCha20 cipher algorithm reference 0x25da8–0x25e68

⋯3 more rows
0x25dd8490073005c0069007300730072006300I.s.\.i.s.s.r.c.
0x25de82d006200750069006c0064005c004300-.b.u.i.l.d.\.C.
0x25df86f006d0070006f006e0065006e007400o.m.p.o.n.e.n.t.
⋯7 more rows

GetMethods member-name token 0x3ca94–0x3cb54

⋯3 more rows
0x3cac4414e616d650200020035009c4f45000aAName....5..OE..
0x3cad44765744d6574686f6473030030234400GetMethods..0#D.
0x3cae408000208dcd9430000000453656c6602......C....Self.
⋯7 more rows

References the GetMethod member name 0x3cb73–0x3cc33

⋯3 more rows
0x3cba3440001000101020002003800744f4500D.........8.tOE.
0x3cbb3094765744d6574686f64030054fc4300.GetMethod..T.C.
0x3cbc308000208dcd9430000000453656c6602......C....Self.
⋯7 more rows