Benign windows Download

r3dfox-portable 153.0.3

Signed PortableApps NSIS installer, normal overlay

Authenticode chain CN: RARE IDEAS, LLCBinary contains high-entropy data regions

SHA-256ea55a800818271010c8c799b629f66ea6a24a9623f22aaa2c1df432b946ba3c0

URLhttps://sourceforge.net/projects/portableapps/files/r3dfox%20Portable/r3dfoxPortable_153.3.0.paf.exe/download

MaleculeO₆(As₆C₃Co₂DyEr₃I)H₇(CmDbF₁₀Os₇Po₄TiU₂)Md₄(Bi₁₃PaSi₃)

Evidence

x86 indirect call through a global pointer 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x400558bec83ec5c837d0c0f742b837d0c46U....\.}..t+.}.F
0x4108b4514750d834818108b0d68c2460089.E.u..H....h.F..
0x420480450ff7510ff750cff7508ff155c82H.P.u..u..u...\.
0x4304000e94201000053568b3570c246008d@..B...SV.5p.F..
0x44045a45750ff7508ff15608240008365f4E.WP.u...`[email protected].
0x4500089450c8d45e450ff7508ff15648240..E..E.P.u...d.@
0x460008b7df08365f0008b1d54804000e980..}..e....T.@...
0x4700000000fb646520fb656560faf55e88b.....FR..VV..U..
0x480cf2b4de80fafc103c2894d1099f7ff33.+M.......M....3
0x490d28af00fb646510fafc10fb64e550faf.....FQ.....NU..
0x4a04de803c18bca99f7ff0fb656540faf55M..........VT..U
0x4b0e88ac80fb646500faf451003c299f7ff.....FP..E......
0x4c0c1e1080fb6c00bc88d45f450894df8ff.........E.P.M..
0x4d015588040008345f004894514508d45e4[email protected].
0x4e050ff750cff1568824000ff7514ffd383[email protected]....
0x4f045e804397de80f8c77ffffff837e58ffE..9}...w....~X.
0x5007465ff7634ff155c80400085c0894514te.v4..\[email protected].
0x51074558b7d0c6a0157c745e410000000c7tU.}.j.W.E......
0x52045e808000000ff1560804000ff765857E.......`[email protected]
0x530ff1564804000ff75148b355080400057[email protected][email protected]
0x540ffd689450c8d45e46820080000506aff...E..E.h ...Pj.
0x550686042460057ff156c824000ff750c57h`[email protected]
0x560ffd6ff7514ffd38d45a450ff7508ff15...u....E.P.u...
0x570708240005f5e33c05bc9c210008b4c24p.@._^3.[.....L$
0x58004a188c246008bd15369d21840000056[email protected]
0x590578b540208f6c202744f8d710133ff3bW.T.....tO.q.3.;
0x5a0358cc2460073428bce69c9184000008d5..F.sB..i..@...
0x5b04401088b08f6c102740347eb1ef6c104D.......t.G.....
0x5c074098bcf4f85c97420eb10f6c110750bt...O..t .....u.
0x5d08bd933da83e30133d989184605184000..3....3...F..@.
0x5e0003b358cc2460072ca5f5e5bc2040055.;5..F.r._^[...U
0x5f08bec51518b550853568bf269f6184000..QQ.U.SV..i..@.
0x600008b1d88c2460033c903f357894dfc89.....F.3...W.M..
0x6104df88b4608a802740b394d0c740624beM..F...t.9M.t.$.
0x620428946083b158cc2460073448bc269c0B.F.;...F.sD..i.
0x630184000008d7c18088d42018b0ff6c102.@...|...B......
0x640740a6a0152e8a5ffffff8b0ff6c10475t.j.R..........u
0x65028f6c1407403ff45fcf6c1017405ff45([email protected]
0x660fceb03ff45f83b058cc246008bd072bc....E.;...F...r.
0x67033c05f5e5bc9c20800837dfc0074f3833._^[.....}..t..

NSIS self-extracting installer 0x25c4–0x2694

0x25c405000200003bf072028bf85753e86b04.....;.r...WS.k.
0x25d4000085c00f845f010000833d74c24600......_....=t.F.
0x25e4000f85840000006a1c8d45d85350e89d.......j..E.SP..
0x25f42f00008b45d8a9f0ffffff757c817ddc/...E......u|.}.
0x2604efbeadde7573817de8496e7374756a81....us.}.Instuj.
0x26147de4736f66747561817de04e756c6c75}.softua.}.Nullu
0x2624580945088b45088b0df0a6420083e002X.E..E.....B....
0x2634090500c346008b45f03bc6890d74c246....F..E.;...t.F
0x2644000f8736010000f64508087506f64508...6....E..u..E.
0x2654047549ff45f48d70fc3bfe761c8bfeeb.uI.E..p.;.v....
0x266418b8b8a24000e95a010000f645080275[email protected]
0x2674086a00e8defdffff593b350427430073.j......Y;5.'C.s
0x26840d5753ff75fce83b3900008945fc013d.WS.u..;9...E..=
0x2694f0                              .               

Large PE with elevated code entropy 0x6bd0–0x6c60

0x6bd000000000000000000000000000000000................
0x6be000000000000000000000000000000000................
0x6bf000000000000000000000000000000000................
0x6c0044880000548800006288000076880000D...T...b...v...
⋯6 more rows

Binary imports ADVAPI32.dll 0x7438–0x7608

⋯3 more rows
0x74687565727956616c756545785700000502ueryValueExW....
0x747852656753657456616c75654578570000RegSetValueExW..
0x7488cb01526567436c6f73654b657900d901..RegCloseKey...
⋯7 more rows
0x750845785700d2015265674372656174654bExW...RegCreateK
0x751865794578570041445641504933322e64eyExW.ADVAPI32.d
0x75286c6c00009b00534846696c654f706572ll....SHFileOper
0x75386174696f6e570000ad00534847657446ationW....SHGetF
0x7548696c65496e666f5700007a0053484272ileInfoW..z.SHBr
0x75586f777365466f72466f6c646572570000owseForFolderW..
0x7568bd0053484765745061746846726f6d49..SHGetPathFromI
0x7578444c6973745700000a015368656c6c45DListW....ShellE
0x7588786563757465457857005348454c4c33xecuteExW.SHELL3
0x7598322e646c6c006500436f5461736b4d652.dll.e.CoTaskMe
⋯7 more rows

Query/set system parameters (string) 0x77dc–0x78ac

⋯3 more rows
0x780c6561746557696e646f77457857009a02eateWindowExW...
0x781c53797374656d506172616d6574657273SystemParameters
0x782c496e666f570019025265676973746572InfoW...Register
0x783c436c617373570000c600456e64446961ClassW....EndDia
⋯7 more rows