Benign windows Download

EmDiSoftware.SimplPlayer

Standard Inno Setup installer

Innoextract found setup loader checksum mismatchInnoextract found unexpected setup loader revision

SHA-256b71c8f681207b151150b20651700d0f829deb884bed2cb00a172e2aa4e89fc95

URLhttps://github.com/AdamAnomatik/SimplPlayer-Releases/releases/download/v1.1.0/SimplPlayer-1.1.0-win-x64-setup.exe

MaleculeK(Te)O₄(As₇C₂Dy₂Pr)H₈(Cr₅Db₄F₃Mg₂Os₉Po₅TiU)Md₄(Bi₁₅PaPtSi)

Evidence

Large PE with elevated code entropy 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400041040000307426f6f6c65616e010000[email protected]...
0x410000001000000001040000546616c7365[email protected]
0x42004547275650653797374656d02000000.True.System....
0x430341040000208416e7369436861720100[email protected]..
0x440000000ff000000020000000050104000............P.@.
0x4500904436861720300000000ffff000002..Char..........
0x4600000000068104000010853686f727449[email protected]
0x4706e740080ffffff7f0000000200000000nt..............
0x480841040000108536d616c6c496e740200[email protected]..
0x49080ffffff7f00000200000000a0104000..............@.
0x4a00107496e74656765720400000080ffff..Integer.......
0x4b0ff7f0200b81040000104427974650100[email protected]..
0x4c0000000ff0000000200000000d0104000..............@.
0x4d00104576f72640300000000ffff000002..Word..........
0x4e000000000e8104000010843617264696e[email protected]
0x4f0616c0500000000ffffffff0200000000al..............
0x500041140001407506f696e746572000000[email protected]...
0x51000020000181140001005496e74363400[email protected].
0x52000000000000080ffffffffffffff7f02................
0x5300000000038114000100655496e743634[email protected]
0x5400000000000000000ffffffffffffffff................
0x5500200000058114000040653696e676c65[email protected]
0x56000020000681140000408457874656e64[email protected]
0x57065640202000000007c1140000406446fed......|[email protected]
0x58075626c65010200008c1140000404436f[email protected]
0x5906d700302000000009c11400004084375[email protected]
0x5a07272656e6379040200000000b0114000rrency........@.
0x5b0050b53686f7274537472696e67ff0200..ShortString...
0x5c0c4114000140950416e73694368617230[email protected]
0x5d01040000200000000dc11400014095057.@[email protected]
0x5e0696465436861724c1040000200000000ideCharL.@......
0x5f0f4114000030842797465426f6f6c0000[email protected]..
0x600000080ffffff7ff01140000546616c73[email protected]
0x6106504547275650653797374656d020000e.True.System...
0x620241240000308576f7264426f6f6c0200[email protected]..
0x630000080ffffff7f201240000546616c73....... [email protected]
0x6406504547275650653797374656d020000e.True.System...
0x6505412400003084c6f6e67426f6f6c0400[email protected]..
0x660000080ffffff7f501240000546616c73[email protected]
0x6706504547275650653797374656d020000e.True.System...

Borland Delphi locales registry key 0xb73c–0xb84c

0xb73c61006c00650073000000000053006f00a.l.e.s.....S.o.
0xb74c6600740077006100720065005c004300f.t.w.a.r.e.\.C.
0xb75c6f006400650047006500610072005c00o.d.e.G.e.a.r.\.
0xb76c4c006f00630061006c00650073000000L.o.c.a.l.e.s...
0xb77c53006f00660074007700610072006500S.o.f.t.w.a.r.e.
0xb78c5c0042006f0072006c0061006e006400\.B.o.r.l.a.n.d.
0xb79c5c004c006f00630061006c0065007300\.L.o.c.a.l.e.s.
0xb7ac0000000053006f006600740077006100....S.o.f.t.w.a.
0xb7bc720065005c0042006f0072006c006100r.e.\.B.o.r.l.a.
0xb7cc6e0064005c00440065006c0070006800n.d.\.D.e.l.p.h.
0xb7dc69005c004c006f00630061006c006500i.\.L.o.c.a.l.e.
0xb7ec7300000000000000558bec6a0053568bs.......U..j.SV.
0xb7fcda8bf033c055684dc4400064ff306489[email protected].
0xb80c20833d103c4b000075128d55fc8bc6e8 .=.<K..u..U....
0xb81cb4fcffff8b45fce8340000008bc38b15.....E..4.......
0xb82c103c4b00e89fc5ffff33c05a59596489.<K......3.ZYYd.
0xb83c106854c440008d45fce87abaffff58ff[email protected].
0xb84ce0e93e                          ..>             

Exports __dbk_fcall_wrapper 0xe53a–0xe60a

0xe53a4000e05a4000e05a4000e05a4000e05a@[email protected]@[email protected]
0xe54a4000e05a4000e05a4000e05a4000e05a@[email protected]@[email protected]
0xe55a4000e05a4000e05a4000e05a4000e05a@[email protected]@[email protected]
0xe56a4000e05a400000000900cef140004100@..Z@[email protected].
0xe57af4ffe6f140004d00ffff0df24000ca00[email protected].....@...
0xe58a0c0045f240004200f4ff6df240004200[email protected][email protected].
0xe59af4ff97f240004100f4ffd4f240004100[email protected][email protected].
0xe5aaf4ff11f340004100f4ff5df340004100[email protected]...][email protected].
0xe5baf4ff0d000f544d756c74695761697445.....TMultiWaitE
0xe5ca76656e741800183c4b00064372656174vent...<K..Creat
0xe5da650300acf34000080000020027001cf4e....@......'...
0xe5ea40000744657374726f79030000000000@..Destroy......
0xe5fa08000108acf3400000000453656c6602[email protected].
0xe60a00                              .               

x86 indirect call through a global pointer 0x1bea0–0x1bf60

0x1bea0c6e81afeffff598bd88bc35f5e5b8be5......Y...._^[..
0x1beb05dc38bc0558bec83c4f05356578bf08d]...U.....SVW...
0x1bec07df0a5a5a5a58bda8bc3e8f5b3feff66}..............f
0x1bed0837df0017422a1106c4b008338007411.}..t"..lK..8.t.
0x1bee08b35106c4b008b368d55f08bc3ffd6eb.5.lK..6.U......
0x1bef007b010e8008afeff5f5e5b8be55dc390........_^[..]..
0x1bf00558bec81c408ffffff53565733db899dU........SVW3...
0x1bf1008ffffff899d0cffffff899d10ffffff................
0x1bf20899d14ffffff899d18ffffff899d1cff................
0x1bf30ffff895de4894dd88955dc8945e033c0...]..M..U..E.3.
0x1bf40556849d5410064ff306489208b45e085UhI.A.d.0d. .E..
0x1bf50c074078b45d885c0750733dbe9c00900.t..E...u.3.....
0x1bf600083cfff8b450c408945d0          [email protected].     

ChaCha20 cipher algorithm reference 0x25da8–0x25e68

0x25da800e816f2fdff5f5e5b595dc20c000000......_^[Y].....
0x25db8b0040200ffffffff3000000043003a00........0...C.:.
0x25dc85c0043006f00640069006e0067005c00\.C.o.d.i.n.g.\.
0x25dd8490073005c0069007300730072006300I.s.\.i.s.s.r.c.
0x25de82d006200750069006c0064005c004300-.b.u.i.l.d.\.C.
0x25df86f006d0070006f006e0065006e007400o.m.p.o.n.e.n.t.
0x25e0873005c00430068006100430068006100s.\.C.h.a.C.h.a.
0x25e18320030002e00700061007300000000002.0...p.a.s.....
0x25e28b0040200ffffffff1100000041007300............A.s.
0x25e38730065007200740069006f006e002000s.e.r.t.i.o.n. .
0x25e486600610069006c007500720065000000f.a.i.l.u.r.e...
0x25e58558bec515356894dfc8bd88b750c8b45U..QSV.M....u..E
0x25e681050568b4508508b                .PV.E.P.        