Suspicious ^86% windows Download

Proma.Proma

Unsigned, encrypted NSIS installer

Opaque NSIS overlay combines reboot and clipboard APIsPE padded far past scanning size limits

SHA-256ca6c26b38218be4948767c1ef0e8442ded35b1e32bf1c2d3fa3ec41b7021c2c6

URLhttps://cdn.proma.cool/releases/win-x64/Proma-0.19.16-setup.exe

MaleculeO₄(IErAsC)H₅(CmF₈Os₆Po₃U)Md₃(Bi₅Pa)

Evidence

English function-word token "this" 0x0–0x110

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯12 more rows

Clears the clipboard to take ownership 0x7c7c–0x7d8c

⋯5 more rows
0x7ccc65004200436c6f7365436c6970626f61e.B.CloseClipboa
0x7cdc726400004a02536574436c6970626f61rd..J.SetClipboa
0x7cec7264446174610000c100456d70747943rdData....EmptyC
0x7cfc6c6970626f6172640000f6014f70656elipboard....Open
0x7d0c436c6970626f61726400a40254726163Clipboard...Trac
0x7d1c6b506f7075704d656e75000009004170kPopupMenu....Ap
⋯7 more rows

AdjustTokenPrivileges API symbol 0x7dae–0x809e

⋯17 more rows
0x7ebe61746846726f6d49444c697374570000athFromIDListW..
0x7ece0a015368656c6c457865637574654578..ShellExecuteEx
0x7ede5700c30053484765745370656369616cW...SHGetSpecial
0x7eee466f6c6465724c6f636174696f6e0000FolderLocation..
⋯3 more rows
0x7f2e7565727956616c756545785700000502ueryValueExW....
0x7f3e52656753657456616c75654578570000RegSetValueExW..
0x7f4ecb01526567436c6f73654b657900d901..RegCloseKey...
⋯9 more rows
0x7fee6174654b657945785700414456415049ateKeyExW.ADVAPI
0x7ffe33322e646c6c00003800496d6167654c32.dll..8.ImageL
0x800e6973745f44657374726f79003400496dist_Destroy.4.Im
0x801e6167654c6973745f4164644d61736b65ageList_AddMaske
0x802e64003700496d6167654c6973745f4372d.7.ImageList_Cr
0x803e656174650000434f4d43544c33322e64eate..COMCTL32.d
0x804e6c6c00001000436f437265617465496ell....CoCreateIn
0x805e7374616e6365000005014f6c65556e69stance....OleUni
0x806e6e697469616c697a6500ee004f6c6549nitialize...OleI
0x807e6e697469616c697a65006500436f5461nitialize.e.CoTa
0x808e736b4d656d46726565006f6c6533322eskMemFree.ole32.
0x809e646c6c00000000000000000000000000dll.............

NSIS runtime error title in data 0x83f0–0x8510

⋯3 more rows
0x84202e002000250064002500250000000000.. .%.d.%.%.....
0x843053006500530068007500740064006f00S.e.S.h.u.t.d.o.
0x844077006e00500072006900760069006c00w.n.P.r.i.v.i.l.
0x845065006700650000004100000000000000e.g.e...A.......
⋯5 more rows
0x84b020002f0044003d00000000004e004300 ./.D.=.....N.C.
0x84c052004300000000004e00530049005300R.C.....N.S.I.S.
0x84d020004500720072006f00720000000000 .E.r.r.o.r.....
⋯4 more rows

PE overlay has high entropy 0x2e980–0x2ec70

⋯7 more rows
0x2e9f000000000000000000000000000000000................
0x2ea0000000000efbeadde4e756c6c736f6674........Nullsoft
0x2ea10496e73742a1d030066e31b0a7bb70080Inst*...f...{...
0x2ea20ed7d077c5cc5b5f75d4b9631d8025302.}.|\...]K.1..S.
0x2ea3036062f06576c79e58e0137b917b9c8d86./.Wly...7.....
0x2ea401483b39256d25aab5db145b64433bd87....V.Z.].E.D3..
0x2ea5012203d01521e244008905013c0144348. [email protected]
0x2ea602124e6a540828381187092174a0881f0[email protected]...
0x2ea709d39e74cb9f7cebd5ac9d80fdea7d56f.9.L....Z......o
0x2ea8057bbb7cc9df9cfcc99d3e73cc771c644W..........<.q.D
0x2ea901ca737fc4ff5721cf8ea5c30db719eeb..7.O.r...\0.q..
0x2eaa0e338671e267e39ce45eff57206c1ff3f.8g.&~9.E..r...?
0x2eab00f2e713a7b7d6479354031ff03ffef2d..q:{}[email protected]
0x2eac0d1e77f04df6f2cb15feffc2fbfee33ea.....o,._../..3.
0x2ead020ebd4b6937e97c17b231fbf2542bfff ....~..{#..%B..
0x2eae0dd9bcefd108edd23da19d086467803c4.......#....Fx..
0x2eaf04e023e92f03e1ddee511baff4770cff7N.>..>......Gp..
0x2eb00e17d07df7f37bcef82f70fe07d27bc0f.}...7......}'..
0x2eb1082fbd6c35bf4403bdc7716bccf87f75e....[.@;.w.....^
0x2eb208ebedffbfcdbe1ff6d9eb6f4f6f4d1de........m.......
0x2eb30f0fb7ba23f2cf7db5ea2bdf7f6a232ae..{.?,..^.....2.
0x2eb4087caec6d3cffbb7c5fd0fd07f6a7ff62...m<..|_......b
0x2eb50548d8782ae822fa32feae5f4bc7a5e3dT....././....z^=
0x2eb60af9e57cfabe7d5f3ea79f5bc7a5e3daf..W......y..z^=.
0x2eb709e57cfabe7d5f3ea79f5bc7a5e3daf9e.W......y..z^=..
0x2eb8057cfabe7d5f3ea79f5bc7a5e3daf9e57W......y..z^=..W
0x2eb90cfabe7d5f3ea79f5bc7a5e3daf9e57cf......y..z^=..W.
0x2eba0abe7d5f3ea79f5bc7a5e3daf9e57cfab.....y..z^=..W..
0x2ebb0e7d5f3ea79f5bc7a5e3daf9e57cfabe7....y..z^=..W...
0x2ebc0d5f3ea79f5bc7a5e3daf9e57cfabe7d5...y..z^=..W....
0x2ebd0f3fadf7f0d81f7fc9073f215b19ceb6f.........s.....o
0x2ebe0392ecf2d0a297369c8b9e521e76a42ce9..-.)si...!.jB.
0x2ebf0ad0e397752c8b9b521e7d6859cab0d39..9wR...!......9
0x2ec009708383730a41f06066029cff50a3957..870....`)...9W
0x2ec101272ae34e45cef807383794c34196d92.r.4.\..s.yL4.m.
0x2ec206341dcf3441ffb7d07c2fb1ab8643dffcA..D..}.....d=.
0x2ec3096792efe00effe3c5e82c6d2c680ba8c.y.....<^.......
0x2ec407128f7c6572c63b1b3badc0ab075a72eq(..W,c......u..
0x2ec50371abfcdfb82eaf207ceedb13beab2b97...........;...
0x2ec601b7519cce3fa6d789fea297377d5f39f.u....mx..)sw...
0x2ec709dd4f3034b3dc57d07048cfbdd55cf5e....K=.}.....U.^