Windows Analysis Report
PoP8Setup.exe

Overview

General Information

Sample name: PoP8Setup.exe
Analysis ID: 1431805
MD5: 31bbc34f3ce51ab1c28a63202db9860d
SHA1: 1ed7495f56baab6a0c7e829be2598f3b10ceadf5
SHA256: 2e76e7677972cd02596456b95cb05964c30890a85a220753b68cbc64643bf7bb
Infos:

Detection

Score: 24
Range: 0 - 100
Whitelisted: false
Confidence: 60%

Compliance

Score: 50
Range: 0 - 100

Signatures

Sigma detected: Files With System Process Name In Unsuspected Locations
Drops PE files
Drops PE files to the application program directory (C:\ProgramData)
Drops files with a non-matching file extension (content does not match file extension)
Found dropped PE file which has not been started or loaded
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Stores files to the Windows start menu directory
Uses 32bit PE files

Classification

Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION pop8win.exe

Compliance
barindex
Uses 32bit PE files
Source: PoP8Setup.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\TSRDDF1.tmp
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\TSRDE12.tmp
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\twux.exe._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\WebView2Loader.dll._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\pop8query.exe._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\WebView2Loader.dll._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Users\user\AppData\Local\Temp\PoP8SetupEC18E846.log
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Users\user\AppData\Local\Temp\36071EAE\Readme.txt
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\ProgramData\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}\Readme.txt
Source: PoP8Setup.exe Static PE information: certificate valid
Source: PoP8Setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Uses 32bit PE files
Source: PoP8Setup.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: PoP8Setup.exe Static PE information: Section: .tsustub ZLIB complexity 0.9983809621710527
Source: classification engine Classification label: sus24.winEXE@2/15@0/0
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\TSRDDF1.tmp
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe File created: C:\Users\user\AppData\Roaming\Publish or Perish
Source: C:\Users\user\Desktop\PoP8Setup.exe Mutant created: \Sessions\1\BaseNamedObjects\{F52FCFA9-4085-40C8-DBE6-8066C1FB84A8}
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Users\user\AppData\Local\Temp\Tsu8BBD8215.dll
Source: PoP8Setup.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PoP8Setup.exe File read: C:\Program Files\desktop.ini
Source: C:\Users\user\Desktop\PoP8Setup.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
Source: C:\Users\user\Desktop\PoP8Setup.exe File read: C:\Users\user\Desktop\PoP8Setup.exe
Source: unknown Process created: C:\Users\user\Desktop\PoP8Setup.exe "C:\Users\user\Desktop\PoP8Setup.exe"
Source: unknown Process created: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe "C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe"
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: wininet.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: netutils.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: version.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: sfc.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: sfc_os.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: sxs.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: rstrtmgr.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: textshaping.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: userenv.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: profapi.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: msftedit.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: wldp.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: profapi.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: windows.globalization.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: bcp47mrm.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: globinputhost.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: dataexchange.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: d3d11.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: dcomp.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: dxgi.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: twinapi.appcore.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: sxs.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: sxs.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: propsys.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: linkinfo.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: ntshrui.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: sxs.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: dxcore.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Section loaded: netutils.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: userenv.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: version.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: wininet.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: kernel.appcore.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: uxtheme.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: windows.storage.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: wldp.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: textshaping.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: windowscodecs.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: textinputframework.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: coreuicomponents.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: coremessaging.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: ntmarta.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: wintypes.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: wintypes.dll
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9FC8E510-A27C-4B3B-B9A3-BF65F00256A8}\InProcServer32
Source: C:\Users\user\Desktop\PoP8Setup.exe File opened: C:\Windows\SysWOW64\msftedit.dll
Source: C:\Users\user\Desktop\PoP8Setup.exe Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\32.0\Common\InstallRoot
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\TSRDDF1.tmp
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\TSRDE12.tmp
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\twux.exe._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\WebView2Loader.dll._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\pop8query.exe._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Directory created: C:\Program Files\Harzing's Publish or Perish 8\WebView2Loader.dll._tm
Source: C:\Users\user\Desktop\PoP8Setup.exe Registry value created: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}
Source: PoP8Setup.exe Static PE information: certificate valid
Source: PoP8Setup.exe Static file information: File size 2775616 > 1048576
Source: PoP8Setup.exe Static PE information: Raw size of .tsuarch is bigger than: 0x100000 < 0x26f000
Source: PoP8Setup.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: PoP8Setup.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
PE file contains sections with non-standard names
Source: PoP8Setup.exe Static PE information: section name: .tsustub
Source: PoP8Setup.exe Static PE information: section name: .tsuarch
Drops PE files
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\Harzing's Publish or Perish 8\WebView2Loader.dll._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Users\user\AppData\Local\Temp\36071EAE\_Setup.dll Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\ProgramData\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}\x86\regsvr32.exe Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Users\user\AppData\Local\Temp\Tsu8BBD8215.dll Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Users\user\AppData\Local\Temp\36071EAE\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\ProgramData\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}\x64\regsvr32.exe Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\Harzing's Publish or Perish 8\twux.exe._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\Harzing's Publish or Perish 8\pop8query.exe._tm Jump to dropped file
Drops PE files to the application program directory (C:\ProgramData)
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\ProgramData\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}\x86\regsvr32.exe Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\ProgramData\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}\x64\regsvr32.exe Jump to dropped file
Drops files with a non-matching file extension (content does not match file extension)
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\Harzing's Publish or Perish 8\twux.exe._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\Harzing's Publish or Perish 8\WebView2Loader.dll._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Program Files\Harzing's Publish or Perish 8\pop8query.exe._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Users\user\AppData\Local\Temp\PoP8SetupEC18E846.log
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\Users\user\AppData\Local\Temp\36071EAE\Readme.txt
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\ProgramData\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}\Readme.txt
Stores files to the Windows start menu directory
Source: C:\Users\user\Desktop\PoP8Setup.exe File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Publish or Perish 8.lnk
Source: C:\Users\user\Desktop\PoP8Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PoP8Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PoP8Setup.exe Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\PoP8Setup.exe Process information set: NOOPENFILEERRORBOX
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\PoP8Setup.exe Dropped PE file which has not been started: C:\Program Files\Harzing's Publish or Perish 8\WebView2Loader.dll._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\36071EAE\_Setup.dll Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe Dropped PE file which has not been started: C:\ProgramData\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}\x86\regsvr32.exe Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Tsu8BBD8215.dll Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\36071EAE\Setup.exe Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe Dropped PE file which has not been started: C:\ProgramData\Uninstall\{D7808C1C-93A9-4369-8385-A789888ED9D7}\x64\regsvr32.exe Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe Dropped PE file which has not been started: C:\Program Files\Harzing's Publish or Perish 8\twux.exe._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe Dropped PE file which has not been started: C:\Program Files\Harzing's Publish or Perish 8\pop8query.exe._tm Jump to dropped file
Source: C:\Users\user\Desktop\PoP8Setup.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\PoP8Setup.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\PoP8Setup.exe File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\Desktop\PoP8Setup.exe File Volume queried: C:\ FullSizeInformation
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\PoP8Setup.exe Queries volume information: C:\ VolumeInformation
Source: C:\Program Files\Harzing's Publish or Perish 8\pop8win.exe Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
windows-stand
⊘No contacted IP infos