Open-source atomic malware analysis

Analyze another

2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360

PE
Verdict: SUSPICIOUS
AI Legitimate KL Setup installer
Mal-ecule
O₂(CI)H₅(DbF₆Os₅Po₅U)Md₄(Bi₄BkPaPt)
Size 81.2 MB download
First seen 7 days ago
Analyzed 6 days ago
Ecosystem windows
Source abuse.ch
Also detected by 1 source
Elevated NSIS loader with reboot and clipboard access: 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360.exe:0x9f2e
Elevated NSIS overlay loader with reboot and clipboard access: 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360.exe:0x9f2e
2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360.exe pe
0x9eae 720020006c00610075006e0063006800 r. .l.a.u.n.c.h.
0x9ebe 69006e006700200069006e0073007400 i.n.g. .i.n.s.t.
0x9ece 61006c006c0065007200000000004e00 a.l.l.e.r.....N.
0x9ede 53004900530020004500720072006f00 S.I.S. .E.r.r.o.
0x9eee 720000005c00540065006d0070000000 r...\.T.e.m.p...
0x9efe 4c006f0077000000540045004d005000 L.o.w...T.E.M.P.
0x9f0e 000054004d00500000007e006e007300 ..T.M.P...~.n.s.
0x9f1e 7500250058002e0074006d0070000000 u.%.X...t.m.p...
0x9f2e 53006500530068007500740064006f00 S.e.S.h.u.t.d.o.Elevated NSIS overlay loader with reboot and clipboard access
0x9f3e 77006e00500072006900760069006c00 w.n.P.r.i.v.i.l.
0x9f4e 65006700650000000000000000000000 e.g.e...........
0x9f5e 000055585448454d450055534552454e ..UXTHEME.USEREN
0x9f6e 56005345545550415049004150504845 V.SETUPAPI.APPHE
0x9f7e 4c500050524f505359530044574d4150 LP.PROPSYS.DWMAP
0x9f8e 4900435259505442415345004f4c4541 I.CRYPTBASE.OLEA
0x9f9e 434300434c4243415451004e544d4152 CC.CLBCATQ.NTMAR
0x9fae 54410000000000000000000000000000 TA..............
0x9fbe 0000250075002e002500750025007300 ..%.u...%.u.%.s.
0x9fce 2500730000006f00700065006e000000 %.s...o.p.e.n...
0x9fde 00002e0065007800650000005f004e00 ....e.x.e..._.N.
0x9fee 620000000000975c4000616a40006860 b......\@.aj@.h`
0x9ffe 4000f474400092594000520069006300 @..t@..Y@.R.i.c.
0xa00e 68004500640069007400000000005200 h.E.d.i.t.....R.
0xa01e 69006300680045006400690074003200 i.c.h.E.d.i.t.2.
0xa02e 30005700000052696368456433320000 0.W...RichEd32..
0xa03e 000052 ..R
0x16ea6 32015368656c6c457865637574654578 2.ShellExecuteEx
0x16eb6 57000d00417070656e644d656e755700 W...AppendMenuW.
0x16ec6 1200426567696e5061696e7400002300 ..BeginPaint..#.
0x16ed6 43616c6c57696e646f7750726f635700 CallWindowProcW.
0x16ee6 3400436861724e657874410036004368 4.CharNextA.6.Ch
0x16ef6 61724e65787457003900436861725072 arNextW.9.CharPr
0x16f06 657657004500436865636b446c674275 evW.E.CheckDlgBu
0x16f16 74746f6e00005200436c6f7365436c69 tton..R.CloseCli
0x16f26 70626f61726400006d00437265617465 pboard..m.Create
0x16f36 4469616c6f67506172616d5700007500 DialogParamW..u.
0x16f46 437265617465506f7075704d656e7500 CreatePopupMenu.
0x16f56 790043726561746557696e646f774578 y.CreateWindowEx
0x16f66 5700aa0044656657696e646f7750726f W...DefWindowPro
0x16f76 63570000b80044657374726f7957696e cW....DestroyWin
0x16f86 646f7700be004469616c6f67426f7850 dow...DialogBoxP
0x16f96 6172616d5700c1004469737061746368 aramW...Dispatch
0x16fa6 4d657373616765570000e20044726177 MessageW....Draw
0x16fb6 546578745700ee00456d707479436c69 TextW...EmptyCliElevated NSIS loader with reboot and clipboard access
0x16fc6 70626f6172640000ef00456e61626c65 pboard....Enable
0x16fd6 4d656e754974656d0000f500456e6162 MenuItem....Enab
0x16fe6 6c6557696e646f770000f800456e6444 leWindow....EndD
0x16ff6 69616c6f6700fa00456e645061696e74 ialog...EndPaint
0x17006 000015014578697457696e646f777345 ....ExitWindowsE
0x17016 7800160146696c6c5265637400001901 x...FillRect....
0x17026 46696e6457696e646f77457857003101 FindWindowExW.1.
0x17036 476574436c617373496e666f57003701 GetClassInfoW.7.
0x17046 476574436c69656e7452656374004601 GetClientRect.F.
0x17056 4765744443005001476574446c674974 GetDC.P.GetDlgIt
0x17066 656d00005301476574446c674974656d em..S.GetDlgItem
0x17076 5465787457008b014765744d65737361 TextW...GetMessa
0x17086 6765506f7300c701476574537973436f gePos...GetSysCo
0x17096 6c6f7200ca0147657453797374656d4d lor...GetSystemM
0x170a6 656e7500cb0147657453797374656d4d enu...GetSystemM
0x170b6 6574726963730000eb0147657457696e etrics....GetWin
0x170c6 646f774c6f6e67570000f20147657457 dowLongW....GetW
0x170d6 696e646f7752656374002502496e7661 indowRect.%.Inva
0x170e6 6c69646174655265637400004b024973 lidateRect..K.Is
0x170f6 57696e646f7700004d02497357696e64 Window..M.IsWind
0x17106 6f77456e61626c656400510249735769 owEnabled.Q.IsWi
0x17116 6e646f7756697369626c65005d024c6f ndowVisible.].Lo
0x17126 6164437572736f72570061024c6f6164 adCursorW.a.Load
0x17136 496d6167655700008e024d6573736167 ImageW....Messag
0x17146 65426f78496e6469726563745700a202 eBoxIndirectW...
0x17156 4f70656e436c6970626f61726400b002 OpenClipboard...Elevated NSIS overlay loader with reboot and clipboard access
0x17166 5065656b4d657373616765570000b502 PeekMessageW....
0x17176 506f7374517569744d65737361676500 PostQuitMessage.
0x17186 e7025265676973746572436c61737357 ..RegisterClassW
0x17196 0000040352656c656173654443001103 ....ReleaseDC...
0x1e7ee 00000000000000000000000000000000 ................
0x1e7fe 00000000000000000000000000000000 ................
0x1e80e 00000000000000000000440234000000 ..........D.4...
0x1e81e 560053005f0056004500520053004900 V.S._.V.E.R.S.I.
0x1e82e 4f004e005f0049004e0046004f000000 O.N._.I.N.F.O...
0x1e83e 0000bd04effe00000000150003000000 ................
0x1e84e 00001500030000000000000000000000 ................
0x1e85e 00000400000001000000000000000000 ................
0x1e86e 000000000000a2010000000053007400 ............S.t.
0x1e87e 720069006e006700460069006c006500 r.i.n.g.F.i.l.e.
0x1e88e 49006e0066006f0000007e0100000000 I.n.f.o...~.....
0x1e89e 30003800300034003000330061003800 0.8.0.4.0.3.a.8.
0x1e8ae 00004a001500010043006f006d007000 ..J.....C.o.m.p.
0x1e8be 61006e0079004e0061006d0065000000 a.n.y.N.a.m.e...
0x1e8ce 00004e006500740077006f0072006b00 ..N.e.t.w.o.r.k.
0x1e8de 200049006e0063006f00720070006f00 .I.n.c.o.r.p.o.
0x1e8ee 72006100740065006400000000003a00 r.a.t.e.d.....:.
0x1e8fe 09000100460069006c00650044006500 ....F.i.l.e.D.e.
0x1e90e 73006300720069007000740069006f00 s.c.r.i.p.t.i.o.
0x1e91e 6e00000000004b004c00200053006500 n.....K.L. .S.e.
0x1e92e 74007500700000000000320009000100 t.u.p.....2.....
0x1e93e 460069006c0065005600650072007300 F.i.l.e.V.e.r.s.
0x1e94e 69006f006e000000000033002e003200 i.o.n.....3...2.
0x1e95e 31002e0030002e003000000000004a00 1...0...0.....J.
0x1e96e 130001004c006500670061006c004300 ....L.e.g.a.l.C.
0x1e97e 6f007000790072006900670068007400 o.p.y.r.i.g.h.t.
0x1e98e 000043006f0070007900720069006700 ..C.o.p.y.r.i.g.
0x1e99e 68007400200028006300290020003200 h.t. .(.c.). .2.
0x1e9ae 30003200360000000000260003000100 0.2.6.....&.....
0x1e9be 500072006f0064007500630074004e00 P.r.o.d.u.c.t.N.
0x1e9ce 61006d006500000000004b004c000000 a.m.e.....K.L...
0x1e9de 0000360009000100500072006f006400 ..6.....P.r.o.d.
0x1e9ee 75006300740056006500720073006900 u.c.t.V.e.r.s.i.
0x1e9fe 6f006e00000033002e00320031002e00 o.n...3...2.1...
0x1ea0e 30002e00300000000000440000000000 0...0.....D.....
0x1ea1e 560061007200460069006c0065004900 V.a.r.F.i.l.e.I.
0x1ea2e 6e0066006f0000000000240004000000 n.f.o.....$.....
0x1ea3e 5400720061006e0073006c0061007400 T.r.a.n.s.l.a.t.
0x1ea4e 69006f006e00000000000408a8030000 i.o.n...........
0x1ea5e 00003c3f786d6c2076657273696f6e3d ..<?xml version=Elevated NSIS loader with reboot and clipboard access
0x1ea6e 22312e302220656e636f64696e673d22 "1.0" encoding="
0x1ea7e 5554462d3822207374616e64616c6f6e UTF-8" standalon
0x1ea8e 653d22796573223f3e3c617373656d62 e="yes"?><assemb
0x1ea9e 6c7920786d6c6e733d2275726e3a7363 ly xmlns="urn:sc
0x1eaae 68656d61732d6d6963726f736f66742d hemas-microsoft-
0x1eabe 636f6d3a61736d2e763122206d616e69 com:asm.v1" mani
0x1eace 6665737456657273696f6e3d22312e30 festVersion="1.0
0x1eade 223e3c617373656d626c794964656e74 "><assemblyIdent
0x1ec3b 67756167653d222a22202f3e3c2f6465 guage="*" /></de
0x1ec4b 70656e64656e74417373656d626c793e pendentAssembly>
0x1ec5b 3c2f646570656e64656e63793e3c7472 </dependency><tr
0x1ec6b 757374496e666f20786d6c6e733d2275 ustInfo xmlns="u
0x1ec7b 726e3a736368656d61732d6d6963726f rn:schemas-micro
0x1ec8b 736f66742d636f6d3a61736d2e763322 soft-com:asm.v3"
0x1ec9b 3e3c73656375726974793e3c72657175 ><security><requ
0x1ecab 657374656450726976696c656765733e estedPrivileges>
0x1ecbb 3c726571756573746564457865637574 <requestedExecutElevated NSIS overlay loader with reboot and clipboard access
0x1eccb 696f6e4c6576656c206c6576656c3d22 ionLevel level="
0x1ecdb 7265717569726541646d696e69737472 requireAdministr
0x1eceb 61746f72222075694163636573733d22 ator" uiAccess="
0x1ecfb 66616c7365222f3e3c2f726571756573 false"/></reques
0x1ed0b 74656450726976696c656765733e3c2f tedPrivileges></
0x1ed1b 73656375726974793e3c2f7472757374 security></trust
0x1ed2b 496e666f3e3c636f6d7061746962696c Info><compatibil
0x1ed3b 69747920786d6c6e733d2275726e3a73 ity xmlns="urn:s
0x1ed4b 6368656d61732d6d6963726f736f6674 chemas-microsoft
0x1ed5b 2d636f6d3a636f6d7061746962696c69 -com:compatibili
0x1ed6b 74792e7631223e3c6170706c69636174 ty.v1"><applicat
0x1ed7b 696f6e3e3c737570706f727465644f53 ion><supportedOS
0x1ed8b 2049643d227b38653066376131322d62 Id="{8e0f7a12-b
0x1ed9b 6662332d346665382d623961352d3438 fb3-4fe8-b9a5-48
0x1edab 666435306131356139617d222f3e3c73 fd50a15a9a}"/><s
0x1edbb 7570706f727465644f532049643d227b upportedOS Id="{
0x1edcb 31663637366337362d383065312d3432 1f676c76-80e1-42
0x1eddb 33392d393562622d3833643066366430 39-95bb-83d0f6d0
0x1edeb 646137387d222f3e3c73 da78}"/><s
0x1ef80 00000000000000000000000000000000 ................
0x1ef90 00000000000000000000000000000000 ................
0x1efa0 00000000000000000000000000000000 ................
0x1efb0 00000000000000000000000000000000 ................
0x1efc0 00000000000000000000000000000000 ................
0x1efd0 00000000000000000000000000000000 ................
0x1efe0 00000000000000000000000000000000 ................
0x1eff0 00000000000000000000000000000000 ................
0x1f000 00000000efbeadde4e756c6c736f6674 ........NullsoftElevated NSIS overlay loader with reboot and clipboard access
0x1f010 496e73747c550000ff0f11055d000080 Inst|U......]...
0x1f020 00003e153c18a100680aa82e85d58478 ..>.<...h......x
0x1f030 9b05e8fb77f7434ad2538061a0ef7f81 ....w.CJ.S.a....
0x1f040 4007dc4ddd788d7369c2fb2998c28dff @..M.x.si..)....
0x1f050 2862f25a62681f7e8ab249bf3213f96f (b.Zbh.~..I.2..o
0x1f060 c45177d01e4d97ce939b80e3b4bb050e .Qw..M..........
0x1f070 0bafc70e14f57cdd63bbba1ff952a951 ......|.c....R.Q
0x1f080 292ca75b577983d94acad9d1fbf2f890 ),.[Wy..J.......
0x1f090 44d14f918ac63fbc6788b526598d095e D.O...?.g..&Y..^
0x1f0a0 f0d6da673a97b050899de1ea556668c9 ...g:..P....Ufh.
0x1f0b0 66a54286136e9fe607d45eade7b76ab4 f.B..n....^...j.
0x1f0c0 3b8324be71c8705d4a3effb41e610a53 ;.$.q.p]J>...a.S
0x1f0d0 79920ac05ca52eedd9180109f3e12538 y...\.........%8
0x1f0e0 c7b332971192a9d71c98e3c10592663f ..2...........f?
0x1f0f0 52698e96bbb4a8bb11fb12c45e2a2f2d Ri..........^*/-
0x1f100 a6d0f17ad19b9ac386871e8b3183bc22 ...z........1.."
0x1f110 88e5726adb30d8f64dcf1972aeceed0d ..rj.0..M..r....
0x1f120 7ca3647966b5087c7eb25ec3b380b615 |.dyf..|~.^.....
0x1f130 f223cf3dbf13e2b86512624af9ef57a9 .#.=....e.bJ..W.
0x1f140 389bfe6e611c571371938c90b373de43 8..na.W.q....s.C
0x1f150 19aea7a44382f0462d7a7543f06dd1de ....C..F-zuC.m..
0x1f160 39b501686021aac24b342134d390bd47 9..h`!..K4!4...G
0x1f170 6b8d1b11318cabc8c14a0242f7531ce5 k...1....J.B.S..
0x1f180 85f330633b494ee82447a8d0060981ac ..0c;IN.$G......
0x1f190 c11d2a7663fc6e1fb26763031d36a536 ..*vc.n..gc..6.6
0x1f1a0 ed0f73c06bd572e023f0ecf32ff4428b ..s.k.r.#.../.B.
0x1f1b0 c5d7259c72a8d90922257d7d0415ef18 ..%.r..."%}}....
0x1f1c0 9b706f3fc1742db3e3530735f92d69f1 .po?.t-..S.5.-i.
0x1f1d0 862167209dc65d0bea797262d564bc67 .!g ..]..yrb.d.g
0x1f1e0 d7ea3797656c47a574ac81a66c1fc4b0 ..7.elG.t...l...
0x1f1f0 b724ec8bbc7f895c4dada99721791994 .$.....\M...!y..
0x1f200 19e44c2802b608d9272583cf43312ec3 ..L(....'%..C1..
0x1f210 33efdd76e0366332906bf0a787d14a1d 3..v.6c2.k....J.
0x1f220 81280fa904441a390ad11146f998a938 .(...D.9...F...8
0x1f230 c8b52311b9d39bca47a76b6dae53e79b ..#.....G.km.S..
0x1f240 f5dfeaca5949a2602cf635372536ab76 ....YI.`,.57%6.v
0x1f250 4b4414fef65af3fb631f7a73ea82318a KD...Z..c.zs..1.
0x1f260 54072efe62e50070a38cf3b492e9cc9c T...b..p........
0x1f270 334b8790c568f921cd602c750224cd54 3K...h.!.`,u.$.T

Objectives

Micro-behaviors

Metadata

notable severity, 100% confident.
build PE manifest requests admin

file

20 of 29 traits shown

Identity

SHA-256 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360
Filename 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360.exe
Package 2e0cc1e150d44c19a28246ad632d71efeae39ce1a71ff32be4707b2fb8303360

Origin

Source harvest
Feed malwarebazaar
Ecosystem windows
Domain abuse.ch

Timeline

First seen 18 Jul 2026 15:53 UTC
First analyzed 19 Jul 2026 17:21 UTC
Last analyzed 19 Jul 2026 17:21 UTC
Last updated 19 Jul 2026 17:21 UTC

Labeling

Label bad
Label source harvest
Traits version 32522