Suspicious ^86% windows Download

Nexmoe.VidBee

Unsigned, encrypted NSIS installer

Opaque NSIS overlay combines reboot and clipboard APIsString extraction truncated due to limits (count: 100000, total bytes: 50 MB)

SHA-256db7f03d0a37bd0538b7cd802ad0b010828a2e222c7bfc75df0aefeaf1548818c

URLhttps://github.com/nexmoe/VidBee/releases/download/v2.1.0/vidbee-2.1.0-setup.exe

MaleculeO₄(IAsC₂Dy)H₅(CmF₁₀Os₇Po₃U)Md₄(Bi₅PaSi)

Evidence

English function-word token "this" 0x0–0x110

0x04d5a90000300000004000000ffff0000MZ..............
0x10b8000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x30000000000000000000000000d8000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯12 more rows

Clears the clipboard to take ownership 0x7c7c–0x7d8c

⋯5 more rows
0x7ccc65004200436c6f7365436c6970626f61e.B.CloseClipboa
0x7cdc726400004a02536574436c6970626f61rd..J.SetClipboa
0x7cec7264446174610000c100456d70747943rdData....EmptyC
0x7cfc6c6970626f6172640000f6014f70656elipboard....Open
0x7d0c436c6970626f61726400a40254726163Clipboard...Trac
0x7d1c6b506f7075704d656e75000009004170kPopupMenu....Ap
⋯7 more rows

AdjustTokenPrivileges API symbol 0x7dae–0x809e

⋯17 more rows
0x7ebe61746846726f6d49444c697374570000athFromIDListW..
0x7ece0a015368656c6c457865637574654578..ShellExecuteEx
0x7ede5700c30053484765745370656369616cW...SHGetSpecial
0x7eee466f6c6465724c6f636174696f6e0000FolderLocation..
⋯3 more rows
0x7f2e7565727956616c756545785700000502ueryValueExW....
0x7f3e52656753657456616c75654578570000RegSetValueExW..
0x7f4ecb01526567436c6f73654b657900d901..RegCloseKey...
⋯9 more rows
0x7fee6174654b657945785700414456415049ateKeyExW.ADVAPI
0x7ffe33322e646c6c00003800496d6167654c32.dll..8.ImageL
0x800e6973745f44657374726f79003400496dist_Destroy.4.Im
0x801e6167654c6973745f4164644d61736b65ageList_AddMaske
0x802e64003700496d6167654c6973745f4372d.7.ImageList_Cr
0x803e656174650000434f4d43544c33322e64eate..COMCTL32.d
0x804e6c6c00001000436f437265617465496ell....CoCreateIn
0x805e7374616e6365000005014f6c65556e69stance....OleUni
0x806e6e697469616c697a6500ee004f6c6549nitialize...OleI
0x807e6e697469616c697a65006500436f5461nitialize.e.CoTa
0x808e736b4d656d46726565006f6c6533322eskMemFree.ole32.
0x809e646c6c00000000000000000000000000dll.............

NSIS runtime error title in data 0x83f0–0x8550

⋯3 more rows
0x84202e002000250064002500250000000000.. .%.d.%.%.....
0x843053006500530068007500740064006f00S.e.S.h.u.t.d.o.
0x844077006e00500072006900760069006c00w.n.P.r.i.v.i.l.
0x845065006700650000004100000000000000e.g.e...A.......
0x84602e0074006d0070000000000041000000..t.m.p.....A...
0x84707e006e00730075000000000020005f00~.n.s.u..... ._.
⋯3 more rows
0x84b020002f0044003d00000000004e004300 ./.D.=.....N.C.
0x84c052004300000000004e00530049005300R.C.....N.S.I.S.
0x84d020004500720072006f00720000000000 .E.r.r.o.r.....
0x84e04500720072006f007200200077007200E.r.r.o.r. .w.r.
⋯7 more rows

PE overlay has high entropy 0xd580–0xd870

⋯7 more rows
0xd5f000000000000000000000000000000000................
0xd60000000000efbeadde4e756c6c736f6674........Nullsoft
0xd610496e73741adc0100d33a1916e96e0080Inst.....:...n..
0xd620ed7d097c54d5f5ff9d24061408ee0a28.}.|T....$.....(
0xd6300c20ab10262c82a84012f6252c41908a. ..&,..@..%,A..
0xd640c549324926cb4ccccc04835b6ad58a4b.I2I&.L....[j..K
0xd6505d5abb2f3ffd75f3efbeb46ad59f60ab]Z./?.u....j..`.
0xd660685babad457f6df55751d4624b37b5b5h[..E.m.WQ.bK7..
0xd670d6d6ffd9ee7bf7bd77df6471e9f2c9c0.....{..w.dq....
0xd6806466de7df7be7bbff7dc73cf3df79c73df.}..{...s.=..s
0xd6902f544a4d892855009f37c327fc57df2f/TJM.(U..7.'.W./
0xd6a057eae542a59eba55d1eb2b3b236a387cW..B...U..+;#j8|
0xd6b0fef49711d5ddeb5dcbab00b2fd113ebf.......]......>.
0xd6c06aa47f05be6f0fb95ffd935f3f34eaa0j....o.._.._?4..
0xd6d0eb741a54b6097e032cea6c789f03ef8f.t.T..~.,.lx....
0xd6e0c93d330af8f37b70df23f0fe81e47f1c.=3...{p.#......
0xd6f03e1ff3957580afcd0721def0b90bdedf>...u....!......
0xd700937b7f1082c1fc81fc89bd301a9e7917.{.........0..y.
0xd7107c1975f101aaffd5ffea7ff5bffa5ffd|.u..........._.
0xd720affe57ffabffd5ffea7ff5bffa5ffdaf..W.........._..
0xd730fe57ffabffd5ffea7ff5bffa5ffdaffe.W.........._...
0xd74057ffabffd5ffea7ff5bffa5ffdaffe57W.........._...W
0xd750ffabffd5ffea7ff5bffa5ffdaffe57ff.........._...W.
0xd760abffd5ffea7ff5bffa5ffdaffe57ffab........._...W..
0xd770ffd5ffea7ff5bffa5ffdaffe57ffabff........_...W...
0xd780d5ffea7ff5bffa5ffdaffed73fff350a......._....?.5.
0xd790de4bf2a4e957c49236c4725da72dcf53.K...W..6.r].-.S
0xd7a0e6aa3c696bf2a455e749db90276d539e..<ik..U.I..'mS.
0xd7b0b4cd79d2b6e449abc9939608491b96a7..y...I.....I...
0xd7c01f868560a9d30af2a415e6492bca9316...`.......I+...
0xd7d016fde118a18946a34d9a1630cfff863c......F.M..0...<
0xd7e0f070785f03b734c96f1da7e297f01e22.px_..4.o......"
0xd7f0f412464b6787d4658ae2d8195fb4d062..FKg..e...._..b
0xd8007775b91160eb4b5dfecbf86de60babcbwu..`.K]...m....
0xd8102f2536c707519787fb50976384aedf80/%6..Q...P.c....
0xd820f719be323fa87afea59b7abe63a927e6...2?.z...z.c.'.
0xd8303b2c84ee3fa87a1644fe75fa76481fea;,..?.z.D.u.vH..
0xd840325cf852e387d8b773227da3c12dc2472\.R....s"}..-.G
0xd8502a3ea47a2e7e0ff5d4bcee04797f90f5*>.z.~......y...
0xd8606cfb17a2c19a6ec6ed97221f5e5daeffl.....n...".^]..
0xd87017c2e5f13e8ecdcd2163f358781f2a69....>...!c.Xx.*i