Edit tour

Windows Analysis Report
gnupg-w32-2.4.7_20241125.exe

Overview

General Information

Sample name:	gnupg-w32-2.4.7_20241125.exe
Analysis ID:	1671114
MD5:	89b24563d66bf8a2dd854af031298e71
SHA1:	dc6c234c76747a5ac078fe5d5300c926e2de57e2
SHA256:	caf2904c02c02c94cbe137f01b63e5a43dbea92d27ea66e56f0af4af2c70c170
Infos:

Detection

Score:	2
Range:	0 - 100
Confidence:	60%

Compliance

Score:	48
Range:	0 - 100

Signatures

Creates a process in suspended mode (likely to inject code)

Drops PE files

Found dropped PE file which has not been started or loaded

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Classification

Process Tree

System is w10x64

gnupg-w32-2.4.7_20241125.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe" MD5: 89B24563D66BF8A2DD854AF031298E71)

notepad.exe (PID: 1348 cmdline: "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\gnupg\README.txt MD5: E92D3A824A0578A50D2DD81B5060145F)

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Data Obfuscation
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Compliance

Uses 32bit PE files

Source: gnupg-w32-2.4.7_20241125.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

Window detected: < &Back&Next >CancelNullsoft Install System v3.06.1-1 Nullsoft Install System v3.06.1-1License AgreementThis software is licensed under the terms of the GNU General Public License (GNU GPL).Press Page Down to see the rest of the agreement. GNU GENERAL PUBLIC LICENSE Version 3 29 June 2007 Copyright (C) 2007 Free Software Foundation Inc. <https://fsf.org/> Everyone is permitted to copy and distribute verbatim copies of this license document but changing it is not allowed. Preamble The GNU General Public License is a free copyleft license forsoftware and other kinds of works. The licenses for most software and other practical works are designedto take away your freedom to share and change the works. By contrastthe GNU General Public License is intended to guarantee your freedom toshare and change all versions of a program--to make sure it remains freesoftware for all its users. We the Free Software Foundation use theGNU General Public License for most of our software; it applies also toany other work released this way by its authors. You can apply it toyour programs too. When we speak of free software we are referring to freedom notprice. Our General Public Licenses are designed to make sure that youhave the freedom to distribute copies of free software (and charge forthem if you wish) that you receive source code or can get it if youwant it that you can change the software or use pieces of it in newfree programs and that you know you can do these things. To protect your rights we need to prevent others from denying youthese rights or asking you to surrender the rights. Therefore you havecertain responsibilities if you distribute copies of the software or ifyou modify it: responsibilities to respect the freedom of others. For example if you distribute copies of such a program whethergratis or for a fee you must pass on to the recipients the samefreedoms that you received. You must make sure that they too receiveor can get the source code. And you must show them these terms so theyknow their rights. Developers that use the GNU GPL protect your rights with two steps:(1) assert copyright on the software and (2) offer you this Licensegiving you legal permission to copy distribute and/or modify it. For the developers' and authors' protection the GPL clearly explainsthat there is no warranty for this free software. For both users' andauthors' sake the GPL requires that modified versions be marked aschanged so that their problems will not be attributed erroneously toauthors of previous versions. Some devices are designed to deny users access to install or runmodified versions of the software inside them although the manufacturercan do so. This is fundamentally incompatible with the aim ofprotecting users' freedom to change the software. The systematicpattern of such abuse occurs in the area of products for individuals touse which is precisely where it is most unacceptable. Therefore wehave designed this version of the

Creates license or readme file

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

File created: C:\Program Files (x86)\gnupg\README.txt

Jump to behavior

PE / OLE file has a valid certificate

Source: gnupg-w32-2.4.7_20241125.exe

Static PE information: certificate valid

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: gnupg-w32-2.4.7_20241125.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Networking

Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/ca/gstsacasha384g4.crl0
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/codesigningrootr45.crl0V
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/gsgccr45codesignca2020.crl0
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://crl.globalsign.com/root-r6.crl0G
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	String found in binary or memory: http://http-keys.gnupg.net
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	String found in binary or memory: http://keys.gnupg.net
Source: gnupg-w32-2.4.7_20241125.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/ca/gstsacasha384g40C
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/codesigningrootr450F
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://ocsp.globalsign.com/gsgccr45codesignca20200V
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://ocsp2.globalsign.com/rootr606
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/codesigningrootr45.crt0A
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gsgccr45codesignca2020.crt0=
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: http://secure.globalsign.com/cacert/gstsacasha384g4.crt0
Source: notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp, ksba.h.0.dr, assuan.h.0.dr	String found in binary or memory: http://www.gnu.org/licenses/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1478557863.000000000305D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.zlib.net/D
Source: dirmngr.exe.0.dr	String found in binary or memory: https://bugs.gnupg.org
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1413450306.0000000003054000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1423313869.0000000003053000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1415823291.0000000003057000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1412714413.0000000003057000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1417211685.0000000003050000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1416699830.0000000003054000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1419083461.000000000305A000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1420036109.000000000305E000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1422210475.0000000003052000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1415113641.000000000305B000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1411632295.0000000003052000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1418330425.000000000305B000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1414234142.0000000003053000.00000004.00000020.00020000.00000000.sdmp, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: https://bugs.gnupg.orgGnuPGgpggpgsmgpg-agentgpgtarEMAILGNUPGGPGGPGSMGPG_AGENTSCDAEMONTPM2DAEMONDIRMN
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1493958312.0000000003050000.00000004.00000020.00020000.00000000.sdmp, gpgme.h.0.dr	String found in binary or memory: https://dev.gnupg.org/T4834
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.gnupg.org/T7030
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.gnupg.org/T7353
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596590318.000000000091D000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1260066526.0000000003059000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fsf.org/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1456517996.0000000003053000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1493958312.0000000003050000.00000004.00000020.00020000.00000000.sdmp, gpgme.h.0.dr	String found in binary or memory: https://gnu.org/licenses/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1456517996.0000000003053000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnu.org/licenses/gpl.html
Source: notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/documentation/mailing-lists.html
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/documentation/manuals/gnupg-devel/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/documentation/manuals/gnupg/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1552156586.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1553098184.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1593868151.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1553000799.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1553057620.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1551238047.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1553148981.0000000004260000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/donate
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/donate/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596590318.000000000091D000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1260066526.0000000003059000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/donateEin
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/download/mirrors.html
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1411632295.0000000003052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/faq/subkey-cross-certify.html
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1411632295.0000000003052000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/faq/subkey-cross-certify.htmlWARNING:
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/faq/whats-new-in-2.1.html
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/ftp/gcrypt/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/ftp/gcrypt/libassuan/)
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/ftp/gcrypt/libgcrypt/)
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/ftp/gcrypt/libgpg-error/)
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/ftp/gcrypt/libksba/)
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/ftp/gcrypt/npth/)
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/ftp/gcrypt/pinentry/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.org/service.html
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: https://gnupg.org0/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596590318.000000000091D000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1260066526.0000000003059000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gnupg.orgNoModifyNoRepair
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	String found in binary or memory: https://http-keys.gnupg.net
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	String found in binary or memory: https://keys.gnupg.net
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	String found in binary or memory: https://keys.gnupg.nethkp://keys.gnupg.nethttp://keys.gnupg.nethkps://http-keys.gnupg.nethttp-keys.g
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1416699830.0000000003054000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://openpgpkey.%s/.well-known/openpgpkey/%s/hu/%s?l=%s
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	String found in binary or memory: https://versions.gnupg.org/swdb.lst
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	String found in binary or memory: https://versions.gnupg.org/swdb.lst.sig
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	String found in binary or memory: https://versions.gnupg.org/swdb.lsthttps://versions.gnupg.org/swdb.lst.sig--enable-special-filenames
Source: gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	String found in binary or memory: https://www.globalsign.com/repository/0
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1489361858.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497964610.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1496719530.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1487857855.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1491307069.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1488391273.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1492949919.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1490318764.0000000000966000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gnu.org/licen
Source: pinentry-basic.exe.0.dr, gcrypt.h.0.dr	String found in binary or memory: https://www.gnu.org/licenses/
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596590318.000000000091D000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1374882759.0000000000977000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596360967.000000000065A000.00000004.00000010.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1480449228.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1405277389.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1260066526.0000000003059000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1484699035.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1489361858.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497964610.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1457898429.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1449088209.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1496719530.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1487857855.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1404442919.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408757347.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1487042360.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1455367633.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1491307069.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1488391273.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1485963618.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1492949919.0000000000966000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gnu.org/philosophy/why-not-lgpl.html
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1415113641.000000000305B000.00000004.00000020.00020000.00000000.sdmp, gpg-card.exe.0.dr	String found in binary or memory: https://yubi.co/ysa201701

System Summary

PE file contains executable resources (Code or Archives)

Source: gpg-card.exe.0.dr

Static PE information: Resource name: RT_VERSION type: Hitachi SH little-endian COFF executable, no relocation info, not stripped, 52 sections, symbol offset=0x5f0053, 4522070 symbols, optional header size 82, created Sat Mar 7 05:34:56 1970

PE file contains more sections than normal

Source: zlib1.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libgpgme-11.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libnpth-0.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libgpg-error-0.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libksba-8.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libgcrypt-20.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libntbtls-0.dll.0.dr	Static PE information: Number of sections : 11 > 10
Source: libassuan-9.dll.0.dr	Static PE information: Number of sections : 11 > 10

Sample file is different than original file name gathered from version info

Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedirmngr.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1413450306.0000000003054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpgconf.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1423313869.0000000003053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekeyboxd.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1478557863.000000000305D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezlib1.dll* vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1482245240.0000000003057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibgcrypt.dll" vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1484737370.00000000057CF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibassuan.dll" vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1415823291.0000000003057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpgtar.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpg.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1412714413.0000000003057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpgsm.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1417211685.0000000003050000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamedirmngr_ldap.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1479206019.0000000003056000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibnpth.dll" vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1416699830.0000000003054000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpg-wks-client.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1489627342.0000000003057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpgme.dll" vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1498209973.0000000003057000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibntbtls.dll" vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1419083461.000000000305A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpg-check-pattern.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1456517996.0000000003053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibgpg-error.dll" vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1420036109.000000000305E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpg-agent.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1422210475.0000000003052000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamescdaemon.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1415113641.000000000305B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpg-card.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1411632295.0000000003052000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpgv.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596878047.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNOTEPAD.EXEj% vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1595899427.00000000009A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameNOTEPAD.EXEj% vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1414234142.0000000003053000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegpg-connect-agent.exeT vs gnupg-w32-2.4.7_20241125.exe
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1487151843.0000000003051000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamelibksba.dll" vs gnupg-w32-2.4.7_20241125.exe

Uses 32bit PE files

Source: gnupg-w32-2.4.7_20241125.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: clean2.winEXE@3/101@0/0

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

File created: C:\Program Files (x86)\gnupg

Jump to behavior

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

Mutant created: \Sessions\1\BaseNamedObjects\gnupg

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

File created: C:\Users\user\AppData\Local\Temp\nsh4785.tmp

Jump to behavior

Source: gnupg-w32-2.4.7_20241125.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: create table if not exists encryptions (binding INTEGER NOT NULL, time INTEGER);create index if not exists encryptions_binding on encryptions (binding);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: create table version (version INTEGER);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: insert into version values (1);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: select count(*) from sqlite_master where type='table';
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497233101.0000000003059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: select ((select count() from ultimately_trusted_keys where (keyid in (%s))) == %d) and ((select count() from ultimately_trusted_keys where keyid not in (%s)) == 0);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: select user_id, policy from bindings where fingerprint = ?;
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497233101.0000000003059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: select fingerprint \|\| case sum(conflict NOTNULL) when 0 then '' else '!' end from bindings where email = ? group by fingerprint order by fingerprint = ? asc, fingerprint desc;
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497233101.0000000003059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: insert into ultimately_trusted_keys values ('%s');
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497233101.0000000003059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: create table if not exists ultimately_trusted_keys (keyid);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497233101.0000000003059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: create table version (version INTEGER);error initializing TOFU database: %s
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497233101.0000000003059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: select version from version;
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497233101.0000000003059000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: create table signatures (binding INTEGER NOT NULL, sig_digest TEXT, origin TEXT, sig_time INTEGER, time INTEGER, primary key (binding, sig_digest, origin));
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: update bindings set effective_policy = %d, conflict = %Q where email = %Q and fingerprint = %Q and effective_policy != %d;
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: select count(*) from sqlite_master where type='table';error reading TOFU database: %s
Source: gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: update bindings set effective_policy = ? where fingerprint = ?;

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

File read: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe "C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe"
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\gnupg\README.txt
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\gnupg\README.txt	Jump to behavior

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: efswrt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\SysWOW64\notepad.exe	Section loaded: msvcp110_win.dll	Jump to behavior

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

File written: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\homegpgbuilderbgnupg-2.4distPLAY-releasegnupg-w32-2.4.7build-auxspeedow32inst-options.ini

Jump to behavior

Found GUI installer (many successful clicks)

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Automated click: OK
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Automated click: Next >
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Automated click: Next >
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Automated click: Install
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Automated click: Next >

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Found installer window with terms and condition text

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

PE / OLE file has a valid certificate

Source: gnupg-w32-2.4.7_20241125.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: gnupg-w32-2.4.7_20241125.exe

Static file information: File size 5625560 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: gnupg-w32-2.4.7_20241125.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

PE file contains an invalid checksum

Source: gnupg-uninstall.exe.0.dr	Static PE information: real checksum: 0x56a732 should be: 0x2eaa1
Source: System.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xeb24
Source: UserInfo.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x510e
Source: LangDLL.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xe9bd
Source: InstallOptions.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x11b09

PE file contains sections with non-standard names

Source: libassuan-9.dll.0.dr	Static PE information: section name: /4
Source: libksba-8.dll.0.dr	Static PE information: section name: /4
Source: libgpgme-11.dll.0.dr	Static PE information: section name: /4
Source: gpgme-w32spawn.exe.0.dr	Static PE information: section name: /4
Source: gpg.exe.0.dr	Static PE information: section name: /4
Source: libsqlite3-0.dll.0.dr	Static PE information: section name: /4
Source: gpgv.exe.0.dr	Static PE information: section name: /4
Source: gpgsm.exe.0.dr	Static PE information: section name: /4
Source: gpgconf.exe.0.dr	Static PE information: section name: /4
Source: gpg-connect-agent.exe.0.dr	Static PE information: section name: /4
Source: gpg-card.exe.0.dr	Static PE information: section name: /4
Source: gpgtar.exe.0.dr	Static PE information: section name: /4
Source: gpg-wks-client.exe.0.dr	Static PE information: section name: /4
Source: dirmngr_ldap.exe.0.dr	Static PE information: section name: /4
Source: g4wihelp.dll.0.dr	Static PE information: section name: /4
Source: gpg-preset-passphrase.exe.0.dr	Static PE information: section name: /4
Source: gpg-check-pattern.exe.0.dr	Static PE information: section name: /4
Source: gpg-agent.exe.0.dr	Static PE information: section name: /4
Source: dirmngr.exe.0.dr	Static PE information: section name: /4
Source: scdaemon.exe.0.dr	Static PE information: section name: /4
Source: keyboxd.exe.0.dr	Static PE information: section name: /4
Source: libgpg-error-0.dll.0.dr	Static PE information: section name: /4
Source: libntbtls-0.dll.0.dr	Static PE information: section name: /4
Source: pinentry-basic.exe.0.dr	Static PE information: section name: /4
Source: zlib1.dll.0.dr	Static PE information: section name: /4
Source: libnpth-0.dll.0.dr	Static PE information: section name: /4
Source: libgcrypt-20.dll.0.dr	Static PE information: section name: /4

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpg-check-pattern.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\dirmngr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\libassuan-9.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpgconf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\libgpgme-11.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpgtar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpg-agent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\pinentry-basic.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\g4wihelp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpgsm.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\libksba-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\libgcrypt-20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\libsqlite3-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\gnupg-uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\scdaemon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpg-wks-client.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\libntbtls-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\libgpg-error-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpgme-w32spawn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\libnpth-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpg-preset-passphrase.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpg-card.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\keyboxd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpgv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\gpg-connect-agent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	File created: C:\Program Files (x86)\gnupg\bin\dirmngr_ldap.exe	Jump to dropped file

Creates license or readme file

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

File created: C:\Program Files (x86)\gnupg\README.txt

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\zlib1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\dirmngr.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpg-check-pattern.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\libassuan-9.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpgconf.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\libgpgme-11.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpgtar.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpg-agent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\LangDLL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\pinentry-basic.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\g4wihelp.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpg.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpgsm.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\libksba-8.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\libgcrypt-20.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\libsqlite3-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\gnupg-uninstall.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\scdaemon.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpg-wks-client.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\libntbtls-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\libgpg-error-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\libnpth-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpgme-w32spawn.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpg-preset-passphrase.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpg-card.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\keyboxd.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpgv.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nss47C5.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\gpg-connect-agent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe	Dropped PE file which has not been started: C:\Program Files (x86)\gnupg\bin\dirmngr_ldap.exe	Jump to dropped file

HIPS / PFW / Operating System Protection Evasion

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe

Process created: C:\Windows\SysWOW64\notepad.exe "C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\gnupg\README.txt

Jump to behavior

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Windows\SysWOW64\notepad.exe

Queries volume information: C:\Program Files (x86)\gnupg\README.txt VolumeInformation

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 File and Directory Discovery	Remote Services	Data from Local System	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	11 Process Injection	LSASS Memory	11 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
gnupg-w32-2.4.7_20241125.exe	0%	ReversingLabs
gnupg-w32-2.4.7_20241125.exe	1%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner
C:\Program Files (x86)\gnupg\bin\dirmngr.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\dirmngr_ldap.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpg-agent.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpg-card.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpg-check-pattern.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpg-connect-agent.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpg-preset-passphrase.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpg-wks-client.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpg.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpgconf.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpgme-w32spawn.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpgsm.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpgtar.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\gpgv.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\keyboxd.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\libassuan-9.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\libgcrypt-20.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\libgpg-error-0.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\libgpgme-11.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\libksba-8.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\libnpth-0.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\libntbtls-0.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\libsqlite3-0.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\pinentry-basic.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\scdaemon.exe	0%	ReversingLabs
C:\Program Files (x86)\gnupg\bin\zlib1.dll	0%	ReversingLabs
C:\Program Files (x86)\gnupg\gnupg-uninstall.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss47C5.tmp\InstallOptions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss47C5.tmp\LangDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss47C5.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss47C5.tmp\UserInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nss47C5.tmp\g4wihelp.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
https://dev.gnupg.org/T7353	0%	Avira URL Cloud	safe
http://keys.gnupg.net	0%	Avira URL Cloud	safe
https://versions.gnupg.org/swdb.lst.sig	0%	Avira URL Cloud	safe
https://gnupg.orgNoModifyNoRepair	0%	Avira URL Cloud	safe
https://bugs.gnupg.org	0%	Avira URL Cloud	safe
https://versions.gnupg.org/swdb.lst	0%	Avira URL Cloud	safe
https://gnupg.org0/	0%	Avira URL Cloud	safe
https://yubi.co/ysa201701	0%	Avira URL Cloud	safe
https://versions.gnupg.org/swdb.lsthttps://versions.gnupg.org/swdb.lst.sig--enable-special-filenames	0%	Avira URL Cloud	safe
https://dev.gnupg.org/T7030	0%	Avira URL Cloud	safe
https://dev.gnupg.org/T4834	0%	Avira URL Cloud	safe
http://http-keys.gnupg.net	0%	Avira URL Cloud	safe
https://keys.gnupg.net	0%	Avira URL Cloud	safe
https://http-keys.gnupg.net	0%	Avira URL Cloud	safe
https://keys.gnupg.nethkp://keys.gnupg.nethttp://keys.gnupg.nethkps://http-keys.gnupg.nethttp-keys.g	0%	Avira URL Cloud	safe
https://bugs.gnupg.orgGnuPGgpggpgsmgpg-agentgpgtarEMAILGNUPGGPGGPGSMGPG_AGENTSCDAEMONTPM2DAEMONDIRMN	0%	Avira URL Cloud	safe
https://openpgpkey.%s/.well-known/openpgpkey/%s/hu/%s?l=%s	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
https://gnupg.org/faq/subkey-cross-certify.htmlWARNING:	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1411632295.0000000003052000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/documentation/mailing-lists.html	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/donateEin	gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596590318.000000000091D000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1260066526.0000000003059000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/ftp/gcrypt/libgcrypt/)	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/ftp/gcrypt/pinentry/	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://versions.gnupg.org/swdb.lst.sig	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://gnupg.org/ftp/gcrypt/libassuan/)	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gnu.org/philosophy/why-not-lgpl.html	gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596590318.000000000091D000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1374882759.0000000000977000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596360967.000000000065A000.00000004.00000010.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1480449228.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1405277389.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1260066526.0000000003059000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1484699035.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1489361858.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497964610.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1457898429.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1449088209.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1496719530.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1487857855.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1404442919.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408757347.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1487042360.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1455367633.0000000000987000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1491307069.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1488391273.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1485963618.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1492949919.0000000000966000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.gnupg.org/T7353	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gnupg.org0/	gnupg-w32-2.4.7_20241125.exe, pinentry-basic.exe.0.dr, libassuan-9.dll.0.dr, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://www.gnu.org/licenses/	pinentry-basic.exe.0.dr, gcrypt.h.0.dr	false		high
https://dev.gnupg.org/T7030	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://gnupg.org/ftp/gcrypt/libgpg-error/)	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_ErrorError	gnupg-w32-2.4.7_20241125.exe	false		high
https://bugs.gnupg.org	dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://gnupg.org/documentation/manuals/gnupg-devel/	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://keys.gnupg.net	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://gnupg.org/ftp/gcrypt/	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.orgNoModifyNoRepair	gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596590318.000000000091D000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1260066526.0000000003059000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://versions.gnupg.org/swdb.lst	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://gnupg.org/faq/subkey-cross-certify.html	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1411632295.0000000003052000.00000004.00000020.00020000.00000000.sdmp	false		high
https://versions.gnupg.org/swdb.lsthttps://versions.gnupg.org/swdb.lst.sig--enable-special-filenames	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://yubi.co/ysa201701	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1415113641.000000000305B000.00000004.00000020.00020000.00000000.sdmp, gpg-card.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://dev.gnupg.org/T4834	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1493958312.0000000003050000.00000004.00000020.00020000.00000000.sdmp, gpgme.h.0.dr	false	Avira URL Cloud: safe	unknown
https://gnupg.org/faq/whats-new-in-2.1.html	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/ftp/gcrypt/npth/)	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
http://http-keys.gnupg.net	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://http-keys.gnupg.net	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.zlib.net/D	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1478557863.000000000305D000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org	notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/documentation/manuals/gnupg/	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://keys.gnupg.net	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://keys.gnupg.nethkp://keys.gnupg.nethttp://keys.gnupg.nethkps://http-keys.gnupg.nethttp-keys.g	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
https://gnu.org/licenses/	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1456517996.0000000003053000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1493958312.0000000003050000.00000004.00000020.00020000.00000000.sdmp, gpgme.h.0.dr	false		high
https://gnupg.org/donate	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1552156586.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1553098184.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1593868151.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1553000799.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1553057620.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1551238047.0000000004260000.00000004.00000800.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1553148981.0000000004260000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gnupg.org/download/mirrors.html	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/ftp/gcrypt/libksba/)	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnu.org/licenses/gpl.html	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1456517996.0000000003053000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gnu.org/licen	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1489361858.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1497964610.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1496719530.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1487857855.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1491307069.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1488391273.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1492949919.0000000000966000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1490318764.0000000000966000.00000004.00000020.00020000.00000000.sdmp	false		high
https://fsf.org/	gnupg-w32-2.4.7_20241125.exe, 00000000.00000002.1596590318.000000000091D000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1260066526.0000000003059000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/donate/	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://gnupg.org/service.html	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1408806151.000000000305B000.00000004.00000020.00020000.00000000.sdmp, notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://openpgpkey.%s/.well-known/openpgpkey/%s/hu/%s?l=%s	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1416699830.0000000003054000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://bugs.gnupg.orgGnuPGgpggpgsmgpg-agentgpgtarEMAILGNUPGGPGGPGSMGPG_AGENTSCDAEMONTPM2DAEMONDIRMN	gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1421234681.0000000003053000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1413450306.0000000003054000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1423313869.0000000003053000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1415823291.0000000003057000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1410358086.0000000003058000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1412714413.0000000003057000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1417211685.0000000003050000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1416699830.0000000003054000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1419083461.000000000305A000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1420036109.000000000305E000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1422210475.0000000003052000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1415113641.000000000305B000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1411632295.0000000003052000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1418330425.000000000305B000.00000004.00000020.00020000.00000000.sdmp, gnupg-w32-2.4.7_20241125.exe, 00000000.00000003.1414234142.0000000003053000.00000004.00000020.00020000.00000000.sdmp, scdaemon.exe.0.dr, gpg-connect-agent.exe.0.dr, gpg-card.exe.0.dr, gpg-agent.exe.0.dr, dirmngr.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://www.gnu.org/licenses/	notepad.exe, 00000007.00000002.2515488017.000000000053E000.00000004.00000020.00020000.00000000.sdmp, ksba.h.0.dr, assuan.h.0.dr	false		high

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1671114
Start date and time:	2025-04-22 16:48:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 134, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	gnupg-w32-2.4.7_20241125.exe
Detection:	CLEAN
Classification:	clean2.winEXE@3/101@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 184.29.183.29, 52.149.20.212
Excluded domains from analysis (whitelisted): c2a9c95e369881c67228a6591cac2686.clo.footprintdns.com, ax-ring.msedge.net, fs.microsoft.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, c.pki.goog, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Program Files (x86)\gnupg\bin\gpg-agent.exe	VirtManage.exe	Get hash	malicious	Unknown	Browse
	VirtManage.exe	Get hash	malicious	Unknown	Browse
	VirtManage.exe	Get hash	malicious	Unknown	Browse
	VirtManage.exe	Get hash	malicious	Unknown	Browse

Process:	C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe
File Type:	Generic INItialization configuration [T7351]
Category:	dropped
Size (bytes):	34898
Entropy (8bit):	5.116832675030297
Encrypted:	false
SSDEEP:	768:nOouHHPB/AYwKCMWXWpqAoUl6kTKjFpkP6wrZlrvtre+dA9rr5uM2gZrN/8fSeG8:nMH1FwKCMWXWpoUqBp8DRCPh1eGwOS3V
MD5:	DD67B31D8397579B0F33BF344FFD6A58
SHA1:	C5C7A30E0B47E987A09C442D8A91D623C91F937F
SHA-256:	D4EC221377D9359E5E59558967635DA1FBA7D6A26612CD25A25A6EFE72194F5D
SHA-512:	A99772C3114FC237396634B67B00DE85D4B9B184D7E40BDC1642835E30F62037854AD201F9F39C60C5959800746A905E838E4912A7138B55F5DB0670194EA7A5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	.... GNU Privacy Guard for Windows.. ===============================....This is GnuPG for Windows, version 2.4.7.....Content:.... 1. Important notes.. 2. Changes.. 3. GnuPG README file.. 4. Package versions.. 5. Legal notices......1. Important Notes..==================....This is the core part of the GnuPG system as used by several other..frontend programs. This installer does not provide any graphical..frontend and thus almost everything needs to be done on the command..line. However, a small native Windows GUI tool is included which is..used by GnuPG to ask for passphrases. It provides only the basic..functionality and is installed under the name "pinentry-basic.exe"...Other software using this core component may install a different..version of such a tool under the name "pinentry.exe" or configure the..gpg-agent to use that version.....See https://gnupg.org for latest news. HowTo documents and manuals..can be found there b

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.997697163989119
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	gnupg-w32-2.4.7_20241125.exe
File size:	5'625'560 bytes
MD5:	89b24563d66bf8a2dd854af031298e71
SHA1:	dc6c234c76747a5ac078fe5d5300c926e2de57e2
SHA256:	caf2904c02c02c94cbe137f01b63e5a43dbea92d27ea66e56f0af4af2c70c170
SHA512:	601bc04fa88cfe8b5dec2914a08acd87433d20049699fa0daf029933045ee42c22e1e7fe09de58c641593c2d59573a8129f328f48b936d126f2b49de9682e9e0
SSDEEP:	98304:qysWTzusSGwnuF4drPbuNg5uI8Jr1zdbwBMIv0sr0qad1aro1KlbWS:H5TzLSG0uF41D8gBMbPE06eQdWS
TLSH:	34463319BB718CEAD7197E3069A2665309CA6F60CC1E4D47EB40D36BEC332179B25783
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...<.J_..............."............FD............@..........................@......2.V...@... ............................

Entrypoint:	0x404446
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x5F4AAD3C [Sat Aug 29 19:32:12 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	730491907e677638ab304e28646ba09c

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	08/04/2022 10:26:24 02/07/2025 14:12:13
Subject Chain	E=code@g10code.com, CN=g10 Code GmbH, O=g10 Code GmbH, L=Erkrath, S=Nordrhein-Westfalen, C=DE
Version:	3
Thumbprint MD5:	AA2F9924D684F241971BBE3BFA7D1D1B
Thumbprint SHA-1:	B2852D4490F655EBEADF9FFD8D092E8154450077
Thumbprint SHA-256:	DFB59B705C479E4EFF34ADBFF9B8DCAF5F74D3F65891F38CD1B10DC8D3F14220
Serial:	4F7382A39E57A34E167CF912

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x34000	0x13f8	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4e000	0x50f0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x55adf8	0x28e0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9254	0x9400	93dfc062f83deb96dcb08695fdef1eb8	False	0.5264727618243243	data	5.930795714996362	IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0xb000	0xe0	0x200	b2a5c94a9680012a72436066e2f7740e	False	0.193359375	data	1.4481589340642336	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xc000	0x758c	0x7600	1d40af081afca5c0f936d13a7b55e8a5	False	0.6911745233050848	data	7.192481840346671	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ
.bss	0x14000	0x1fe20	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x34000	0x13f8	0x1400	350475874cf34da3f737c1b4b196ed1c	False	0.393359375	data	5.348274196082192	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x36000	0x18000	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4e000	0x50f0	0x5200	b25cfb8cdea9e83512d966ee7b6ba628	False	0.5646913109756098	data	5.721856490213528	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_2BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_512BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_BITMAP	0x4e3d0	0x666	Device independent bitmap graphic, 96 x 16 x 8, image size 1538, resolution 2868 x 2868 px/m, 15 important colors	English	United States	0.18192918192918192
RT_ICON	0x4ea38	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.7213883677298312
RT_ICON	0x4fae0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688, 256 important colors	English	United States	0.6751066098081023
RT_ICON	0x50988	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152, 256 important colors	English	United States	0.7851985559566786
RT_ICON	0x51230	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320, 256 important colors	English	United States	0.6560693641618497
RT_ICON	0x51798	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.8031914893617021
RT_ICON	0x51c00	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.3118279569892473
RT_ICON	0x51ee8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.36824324324324326
RT_DIALOG	0x52010	0xb4	data	English	United States	0.6166666666666667
RT_DIALOG	0x520c8	0x164	data	English	United States	0.5308988764044944
RT_DIALOG	0x52230	0x246	data	English	United States	0.38316151202749144
RT_DIALOG	0x52478	0x104	data	English	United States	0.6076923076923076
RT_DIALOG	0x52580	0xa0	data	English	United States	0.60625
RT_DIALOG	0x52620	0xee	data	English	United States	0.6176470588235294
RT_GROUP_ICON	0x52710	0x68	data	English	United States	0.6634615384615384
RT_VERSION	0x52778	0x548	data	English	United States	0.4541420118343195
RT_MANIFEST	0x52cc0	0x42e	XML 1.0 document, ASCII text, with very long lines (1070), with no line terminators	English	United States	0.5149532710280373

DLL	Import
ADVAPI32.dll	AdjustTokenPrivileges, LookupPrivilegeValueW, OpenProcessToken, RegCloseKey, RegCreateKeyExW, RegDeleteKeyW, RegDeleteValueW, RegEnumKeyW, RegEnumValueW, RegOpenKeyExW, RegQueryValueExW, RegSetValueExW, SetFileSecurityW
COMCTL32.DLL	ImageList_AddMasked, ImageList_Create, ImageList_Destroy, InitCommonControls
GDI32.dll	CreateBrushIndirect, CreateFontIndirectW, DeleteObject, GetDeviceCaps, SelectObject, SetBkColor, SetBkMode, SetTextColor
KERNEL32.dll	CloseHandle, CompareFileTime, CopyFileW, CreateDirectoryW, CreateFileW, CreateProcessW, CreateThread, DeleteFileW, ExitProcess, ExpandEnvironmentStringsW, FindClose, FindFirstFileW, FindNextFileW, FreeLibrary, GetCommandLineW, GetCurrentProcess, GetDiskFreeSpaceW, GetExitCodeProcess, GetFileAttributesW, GetFileSize, GetFullPathNameW, GetLastError, GetModuleFileNameW, GetModuleHandleA, GetModuleHandleW, GetPrivateProfileStringW, GetProcAddress, GetShortPathNameW, GetSystemDirectoryW, GetTempFileNameW, GetTempPathW, GetTickCount, GetVersion, GetWindowsDirectoryW, GlobalAlloc, GlobalFree, GlobalLock, GlobalUnlock, LoadLibraryExW, MoveFileExW, MoveFileW, MulDiv, MultiByteToWideChar, ReadFile, RemoveDirectoryW, SearchPathW, SetCurrentDirectoryW, SetEnvironmentVariableW, SetErrorMode, SetFileAttributesW, SetFilePointer, SetFileTime, Sleep, WaitForSingleObject, WideCharToMultiByte, WriteFile, WritePrivateProfileStringW, lstrcatW, lstrcmpW, lstrcmpiA, lstrcmpiW, lstrcpyA, lstrcpynW, lstrlenA, lstrlenW
ole32.dll	CoCreateInstance, CoTaskMemFree, IIDFromString, OleInitialize, OleUninitialize
SHELL32.dll	SHBrowseForFolderW, SHFileOperationW, SHGetFileInfoW, SHGetPathFromIDListW, SHGetSpecialFolderLocation, ShellExecuteExW
USER32.dll	AppendMenuW, BeginPaint, CallWindowProcW, CharNextA, CharNextW, CharPrevW, CheckDlgButton, CloseClipboard, CreateDialogParamW, CreatePopupMenu, CreateWindowExW, DefWindowProcW, DestroyWindow, DialogBoxParamW, DispatchMessageW, DrawTextW, EmptyClipboard, EnableMenuItem, EnableWindow, EndDialog, EndPaint, ExitWindowsEx, FillRect, FindWindowExW, GetClassInfoW, GetClientRect, GetDC, GetDlgItem, GetDlgItemTextW, GetMessagePos, GetSysColor, GetSystemMenu, GetSystemMetrics, GetWindowLongW, GetWindowRect, InvalidateRect, IsWindow, IsWindowEnabled, IsWindowVisible, LoadCursorW, LoadImageW, MessageBoxIndirectW, OpenClipboard, PeekMessageW, PostQuitMessage, RegisterClassW, ReleaseDC, ScreenToClient, SendMessageTimeoutW, SendMessageW, SetClassLongW, SetClipboardData, SetCursor, SetDlgItemTextW, SetForegroundWindow, SetTimer, SetWindowLongW, SetWindowPos, SetWindowTextW, ShowWindow, SystemParametersInfoW, TrackPopupMenu, wsprintfA, wsprintfW

Description	Data
Comments	GnuPG is Free Software; you can redistribute it and/or modify it under the terms of the GNU General Public License. You should have received a copy of the GNU General Public License along with this software; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA
CompanyName	The GnuPG Project
FileDescription	GnuPG: The GNU Privacy Guard for Windows
FileVersion	2.4.7.31706
LegalCopyright	Copyright (C) 2024 g10 Code GmbH
LegalTrademarks
ProductName	GnuPG (2.4.7)
Translation	0x0409 0x04b0

Target ID:	0
Start time:	10:48:55
Start date:	22/04/2025
Path:	C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\gnupg-w32-2.4.7_20241125.exe"
Imagebase:	0x400000
File size:	5'625'560 bytes
MD5 hash:	89B24563D66BF8A2DD854AF031298E71
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	10:49:28
Start date:	22/04/2025
Path:	C:\Windows\SysWOW64\notepad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\NOTEPAD.EXE" C:\Program Files (x86)\gnupg\README.txt
Imagebase:	0x690000
File size:	165'888 bytes
MD5 hash:	E92D3A824A0578A50D2DD81B5060145F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report gnupg-w32-2.4.7_20241125.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\gnupg\README.txt

C:\Program Files (x86)\gnupg\VERSION

C:\Program Files (x86)\gnupg\bin\dirmngr.exe

C:\Program Files (x86)\gnupg\bin\dirmngr_ldap.exe

C:\Program Files (x86)\gnupg\bin\gpg-agent.exe

C:\Program Files (x86)\gnupg\bin\gpg-card.exe

C:\Program Files (x86)\gnupg\bin\gpg-check-pattern.exe

C:\Program Files (x86)\gnupg\bin\gpg-connect-agent.exe

C:\Program Files (x86)\gnupg\bin\gpg-preset-passphrase.exe

C:\Program Files (x86)\gnupg\bin\gpg-wks-client.exe

C:\Program Files (x86)\gnupg\bin\gpg.exe

C:\Program Files (x86)\gnupg\bin\gpgconf.exe

C:\Program Files (x86)\gnupg\bin\gpgme-w32spawn.exe

C:\Program Files (x86)\gnupg\bin\gpgsm.exe

C:\Program Files (x86)\gnupg\bin\gpgtar.exe

C:\Program Files (x86)\gnupg\bin\gpgv.exe

C:\Program Files (x86)\gnupg\bin\keyboxd.exe

C:\Program Files (x86)\gnupg\bin\libassuan-9.dll

C:\Program Files (x86)\gnupg\bin\libgcrypt-20.dll

C:\Program Files (x86)\gnupg\bin\libgpg-error-0.dll

C:\Program Files (x86)\gnupg\bin\libgpgme-11.dll

C:\Program Files (x86)\gnupg\bin\libksba-8.dll

C:\Program Files (x86)\gnupg\bin\libnpth-0.dll

C:\Program Files (x86)\gnupg\bin\libntbtls-0.dll

C:\Program Files (x86)\gnupg\bin\libsqlite3-0.dll

C:\Program Files (x86)\gnupg\bin\pinentry-basic.exe

Windows Analysis Report
gnupg-w32-2.4.7_20241125.exe