Edit tour

Windows Analysis Report
RadProCalculator3.26_64BSetup.exe

Overview

General Information

Sample name:	RadProCalculator3.26_64BSetup.exe
Analysis ID:	1524334
MD5:	db2df493ed3ef51a0731e67c41c81eb1
SHA1:	483f3fdba4fd84b2739a19f90a17d9c08f0559eb
SHA256:	4b526c198671dbe6351021935b780a9ce582a891b1ca0eddc1b170fa762b8661
Infos:

Detection

Score:	12
Range:	0 - 100
Whitelisted:	false
Confidence:	40%

Signatures

Found potential equation exploit (CVE-2017-11882)

Creates a DirectInput object (often for capturing keystrokes)

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

PE file contains an invalid checksum

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

Sample file is different than original file name gathered from version info

Sigma detected: Use NTFS Short Name in Command Line

Uses 32bit PE files

Classification

Process Tree

System is w10x64

RadProCalculator3.26_64BSetup.exe (PID: 3984 cmdline: "C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe" MD5: DB2DF493ED3EF51A0731E67C41C81EB1)

RadProCalculator3.26_64BSetup.exe (PID: 4872 cmdline: .\RadProCalculator3.26_64BSetup.exe /m="C:\Users\user\Desktop\RADPRO~1.EXE" /k="" MD5: C82B11E5425B91A31672CEEC8E0F37A0)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

Sigma detected: Use NTFS Short Name in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali (Nextron Systems): Data: Command: .\RadProCalculator3.26_64BSetup.exe /m="C:\Users\user\Desktop\RADPRO~1.EXE" /k="", CommandLine: .\RadProCalculator3.26_64BSetup.exe /m="C:\Users\user\Desktop\RADPRO~1.EXE" /k="", CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe, ParentCommandLine: "C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe", ParentImage: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe, ParentProcessId: 3984, ParentProcessName: RadProCalculator3.26_64BSetup.exe, ProcessCommandLine: .\RadProCalculator3.26_64BSetup.exe /m="C:\Users\user\Desktop\RADPRO~1.EXE" /k="", ProcessId: 4872, ProcessName: RadProCalculator3.26_64BSetup.exe

Source:	Static RTF information: Object: 0 Offset: 000016F2h
Source:	Static RTF information: Object: 1 Offset: 00004C0Ah
Source:	Static RTF information: Object: 2 Offset: 0000811Dh

Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\D1E532D5\242A76C8\RadPro License.rtf			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\license.rtf			Jump to behavior

Source:	Binary string: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\1E27FC18\242A76C8\adProCalculator.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000002.3432860988.000000000075C000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198152344.0000000000756000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\USERS\RAY\DOCUMENTS\VISUAL STUDIO 2008\PROJECTS\RADPROCALCULATOR64BIT\BIN\RADPROCALCULATOR.PDB source: RadProCalculator3.26_64BSetup.exe, 00000002.00000002.3433296326.0000000002458000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: gacutil.pdb, AH/@ source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209757364.000000000060C000.00000002.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr
Source:	Binary string: 242A76C8\RadProCalculator.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000002.3433296326.00000000024CC000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, mia.tmp.2.dr, RadProCalculator3.26_64BSetup.exe.0.dr
Source:	Binary string: gacutil.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209757364.000000000060C000.00000002.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr
Source:	Binary string: aC:\Users\Ray\Documents\Visual Studio 2008\Projects\RadProCalculator64Bit\bin\RadProCalculator.pdb source: RadProCalculator3.26_64BSetup.exe, 00000002.00000002.3433296326.0000000002458000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: u/OFFLINE/B00CA824/242A76C8/RadProCalculator.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2208829416.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000000.00000002.3433082676.00000000009AF000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2208941075.00000000009AD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\1E27FC18\42A76C8\adProCalculator.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000002.3432860988.000000000075C000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198152344.0000000000756000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: MicrosoftWindowsGdiPlus-1.0.2600.1355-gdiplus.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003CC1000.00000004.00000020.00020000.00000000.sdmp, gdiplus.dll.0.dr
Source:	Binary string: data/OFFLINE/B00CA824/242A76C8/RadProCalculator.pdbvD source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2208740632.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198233127.00000000009AB000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2207629927.00000000009AB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ray\Documents\Visual Studio 2008\Projects\RadProCalculator64Bit\bin\RadProCalculator.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000002.3433296326.0000000002458000.00000004.00001000.00020000.00000000.sdmp, mia.tmp.2.dr, RadProCalculator3.26_64BSetup.exe.0.dr
Source:	Binary string: aC:\USERS\RAY\DOCUMENTS\VISUAL STUDIO 2008\PROJECTS\RADPROCALCULATOR64BIT\BIN\RADPROCALCULATOR.PDB source: RadProCalculator3.26_64BSetup.exe, 00000002.00000002.3433296326.0000000002458000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\884935FF\42A76C8\RadProCalculator.pdbll source: RadProCalculator3.26_64BSetup.exe, 00000000.00000002.3432860988.000000000075C000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198152344.0000000000756000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Ray\Documents\Visual Studio 2008\Projects\RadProCalculator64Bit\obj\Debug\RadProCalculator.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator.exe.0.dr
Source:	Binary string: data/RadProCalculator3.26_64BSetup.msiRadProCalculator3.26_64BSetup.msisetup.bmpdata/OFFLINE/5779DC17/242A76C8/RadProCalculator.exe.manifestdata/OFFLINE/9DCC724B/242A76C8/RadProCalculator.xmldata/OFFLINE/2635807C/242A76C8/Rad Pro Settings-DONT DELETE.txtdata/OFFLINE/ABF56A8A/C6DB425E/Rad Pro Settings-DONT DELETE.txtdata/OFFLINE/4D693B19/242A76C8/Settings.txtdata/OFFLINE/1E89F593/242A76C8/file.docdata/OFFLINE/B2FB7337/242A76C8/ShieldingandBuildup.docdata/OFFLINE/DA2F022C/242A76C8/Contact Rad Pro Calculator.rtfdata/OFFLINE/6E19DDB9/242A76C8/Notice of Disclaimer Rad Pro Calculator.rtfdata/OFFLINE/884935FF/242A76C8/Rad Pro Calculator References.rtfdata/OFFLINE/D1E532D5/242A76C8/RadPro License.rtfdata/OFFLINE/353EFE74/242A76C8/Uranium.rtfdata/OFFLINE/EF8B86D1/242A76C8/Help for Rad Pro Calculator.pdfdata/OFFLINE/1C1753FF/242A76C8/Rad Pro Calculator References.pdfdata/OFFLINE/1E27FC18/242A76C8/ShieldingandBuildup.pdfdata/OFFLINE/764C6FA8/242A76C8/RadProCalculator.exeRadProCalculator3.26_64BSetup.exedata/OFFLINE/28D15CAF/242A76C8/AxInterop.ComCtl2.dlldata/OFFLINE/F699690B/242A76C8/AxInterop.ComctlLib.dlldata/gdiplus.dlldata/OFFLINE/F10E7C53/242A76C8/Interop.ComCtl2.dlldata/OFFLINE/DEFF21C9/242A76C8/Interop.ComctlLib.dlldata/OFFLINE/F3319620/242A76C8/Interop.Microsoft.Office.Core.dlldata/OFFLINE/9B25A4E7/242A76C8/Interop.Microsoft.Office.Interop.Excel.dlldata/OFFLINE/489D2344/242A76C8/Interop.VBIDE.dlldata/mMSI.dll/mMSIExec.dllmia.libdata/OFFLINE/B00CA824/242A76C8/RadProCalculator.pdbdata/OFFLINE/A6542D7A/242A76C8/RadProCalculator.applicationRadProCalculator3.26_64BSetup.resdata/{0AD26D48-644B-4268-AAB1-C0C6839EEBCB}data/OFFLINE/F699690B/242A76C8data/OFFLINE/F699690Bdata/OFFLINE/F3319620/242A76C8data/OFFLINE/F3319620data/OFFLINE/F10E7C53/242A76C8data/OFFLINE/F10E7C53data/OFFLINE/EF8B86D1/242A76C8data/OFFLINE/EF8B86D1data/OFFLINE/DEFF21C9/242A76C8data/OFFLINE/DEFF21C9data/OFFLINE/DA2F022C/242A76C8data/OFFLINE/DA2F022Cdata/OFFLINE/D1E532D5/242A76C8data/OFFLINE/D1E532D5data/OFFLINE/B2FB7337/242A76C8data/OFFLINE/B2FB7337data/OFFLINE/B00CA824/242A76C8data/OFFLINE/B00CA824data/OFFLINE/ABF56A8A/C6DB425Edata/OFFLINE/ABF56A8Adata/OFFLINE/A6542D7A/242A76C8data/OFFLINE/A6542D7Adata/OFFLINE/9DCC724B/242A76C8data/OFFLINE/9DCC724Bdata/OFFLINE/9B25A4E7/242A76C8data/OFFLINE/9B25A4E7data/OFFLINE/884935FF/242A76C8data/OFFLINE/884935FFdata/OFFLINE/764C6FA8/242A76C8data/OFFLINE/764C6FA8data/OFFLINE/6E19DDB9/242A76C8data/OFFLINE/6E19DDB9data/OFFLINE/5779DC17/242A76C8data/OFFLINE/5779DC17data/OFFLINE/4D693B19/242A76C8data/OFFLINE/4D693B19data/OFFLINE/489D2344/242A76C8data/OFFLINE/489D2344data/OFFLINE/353EFE74/242A76C8data/OFFLINE/353EFE74data/OFFLINE/28D15CAF/242A76C8data/OFFLINE/28D15CAFdata/OFFLINE/2635807C/242A76C8data/OFFLINE/2635807Cdata/OFFLINE/1E89F593/242A76C8data/OFFLINE/1E89F593data/OFFLINE/1E27FC18/242A76C8data/OFFLINE/1E27FC18data/OFFLINE/1C1753FF/242A76C8data/OFFLINE/1C1753FFdata/OFFLINEdata/mMSI.dll source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.218
Source:	Binary string: op.Excel.dlldata/OFFLINE/489D2344/242A76C8/Interop.VBIDE.dlldata/mMSI.dll/mMSIExec.dllmia.libdata/OFFLINE/B00CA824/242A76C8/RadProCalculator.pdbdata/OFFLINE/A6542D7A/242A76C8/RadProCalcul source: RadProCalculator3.26_64BSetup.exe, 00000000.00000002.3433056568.00000000009A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Documents and Settings\K-ballo\Mis documentos\Visual Studio 2008\Projects\ahadmin_wrapper\ReleaseDLL\ahadmin_wrapper.pdb source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209757364.000000000060C000.00000002.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr

Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior

Source: ShieldingandBuildup.doc.0.dr	String found in binary or memory: http://hps.org/publicinformation/ate/faqs/gammaandexposure.html
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.pdf.0.dr, Rad Pro Calculator References.pdf.0.dr, Help for Rad Pro Calculator.pdf.0.dr	String found in binary or memory: http://hps.org/publicinformation/ate/faqs/gammaandexposure.html)/S/URI
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.doc.0.dr	String found in binary or memory: http://hps.org/publicinformation/ate/faqs/gammaandexposure.htmlyX
Source: Rad Pro Calculator References.rtf.0.dr	String found in binary or memory: http://ie.lbl.gov/toi.html
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Rad Pro Calculator References.pdf.0.dr	String found in binary or memory: http://ie.lbl.gov/toi.html)/S/URI
Source: ShieldingandBuildup.doc.0.dr	String found in binary or memory: http://physics.nist.gov/PhysRefData/XrayMassCoef/tab3.html
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.pdf.0.dr	String found in binary or memory: http://physics.nist.gov/PhysRefData/XrayMassCoef/tab3.html)/S/URI
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.doc.0.dr	String found in binary or memory: http://physics.nist.gov/PhysRefData/XrayMassCoef/tab3.htmla
Source: ShieldingandBuildup.doc.0.dr	String found in binary or memory: http://physics.nist.gov/PhysRefData/XrayMassCoef/tab4.html
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.pdf.0.dr	String found in binary or memory: http://physics.nist.gov/PhysRefData/XrayMassCoef/tab4.html)/S/URI
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Rad Pro Calculator References.rtf.0.dr	String found in binary or memory: http://physics.nist.gov/xaamdi
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr	String found in binary or memory: http://www.InstallAware.com/
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr	String found in binary or memory: http://www.InstallAware.com/open
Source: ShieldingandBuildup.doc.0.dr	String found in binary or memory: http://www.ans.org/store/vi-240180
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.pdf.0.dr	String found in binary or memory: http://www.ans.org/store/vi-240180)/S/URI
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	String found in binary or memory: http://www.epa.gov/radiation/marssim/docs/revision1_August_2002corrections/chapter6.pdf)/S/URI
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	String found in binary or memory: http://www.epa.gov/radiation/marssim/obtain.html)/S/URI
Source: RadProCalculator3.26_64BSetup.exe.0.dr	String found in binary or memory: http://www.installaware.com/
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr	String found in binary or memory: http://www.installaware.com/InstallAware
Source: RadProCalculator3.26_64BSetup.exe, RadProCalculator3.26_64BSetup.exe.0.dr	String found in binary or memory: http://www.installaware.comz
Source: Rad Pro Calculator References.rtf.0.dr	String found in binary or memory: http://www.pacificrad.com/pages/publications.html
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Rad Pro Calculator References.pdf.0.dr	String found in binary or memory: http://www.pacificrad.com/pages/publications.html)/S/URI
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	String found in binary or memory: http://www.radiationsoftware.com/mshield.html)/S/URI
Source: RadProCalculator3.26_64BSetup.exe, 00000002.00000002.3433296326.00000000024CC000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, mia.tmp.2.dr, RadProCalculator3.26_64BSetup.exe.0.dr	String found in binary or memory: http://www.radprocalculator.com/
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	String found in binary or memory: http://www.radprocalculator.com/Request.aspx)/S/URI
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator.exe.0.dr	String found in binary or memory: http://www.radprocalculator.com/Request.aspxGmailto:support
Source: Contact Rad Pro Calculator.rtf.0.dr	String found in binary or memory: http://www.radprocalculator.com/request.aspx
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	String found in binary or memory: http://www.wmginc.com/Software/MegaShield/megashield.htm)/S/URI

Source: RadProCalculator3.26_64BSetup.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RadProCalculator3.26_64BSetup.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (console) Intel 80386, for MS Windows

Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003E6C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInterop.Microsoft.Office.Core.dll\|. vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003E38000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInterop.ComctlLib.dll vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInterop.Microsoft.Office.Interop.Excel.dll\|- vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInterop.VBIDE.dll\|- vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.exe, vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003CA7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAxInterop.ComctlLib.dll4 vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameRadProCalculator.exeP vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameAxInterop.ComCtl2.dll4 vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegdiplusj% vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003CC1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameInterop.ComCtl2.dll vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000002.00000002.3434996427.0000000010069000.00000002.00000001.01000000.00000005.sdmp	Binary or memory string: OriginalFilename7z.exe, vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2214055378.000000007FDC0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilename7z.exe, vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209757364.000000000060C000.00000002.00000001.01000000.00000004.sdmp	Binary or memory string: OriginalFilenamegacutil.exeT vs RadProCalculator3.26_64BSetup.exe
Source: RadProCalculator3.26_64BSetup.exe.0.dr	Binary or memory string: OriginalFilenamegacutil.exeT vs RadProCalculator3.26_64BSetup.exe

Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp, Interop.VBIDE.dll.0.dr	Binary or memory string: VBIDE.VBProjectClass)
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp, Interop.VBIDE.dll.0.dr	Binary or memory string: VBIDE.VBProjectsClass)
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp, Interop.VBIDE.dll.0.dr	Binary or memory string: VBIDE.VBProjectClass
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003EA1000.00000004.00000020.00020000.00000000.sdmp, Interop.VBIDE.dll.0.dr	Binary or memory string: VBIDE.VBProjectsClass

Source: ShieldingandBuildup.pdf.0.dr	Initial sample: http://physics.nist.gov/physrefdata/xraymasscoef/tab3.html
Source: ShieldingandBuildup.pdf.0.dr	Initial sample: http://physics.nist.gov/PhysRefData/XrayMassCoef/tab3.html
Source: Help for Rad Pro Calculator.pdf.0.dr	Initial sample: http://www.radprocalculator.com/Request.aspx
Source: Help for Rad Pro Calculator.pdf.0.dr	Initial sample: http://www.epa.gov/radiation/marssim/docs/revision1_August_2002corrections/chapter6.pdf
Source: ShieldingandBuildup.pdf.0.dr	Initial sample: http://hps.org/publicinformation/ate/faqs/gammaandexposure.html
Source: ShieldingandBuildup.pdf.0.dr	Initial sample: http://physics.nist.gov/PhysRefData/XrayMassCoef/tab4.html
Source: ShieldingandBuildup.pdf.0.dr	Initial sample: http://physics.nist.gov/physrefdata/xraymasscoef/tab4.html
Source: Help for Rad Pro Calculator.pdf.0.dr	Initial sample: http://www.radiationsoftware.com/mshield.html
Source: Rad Pro Calculator References.pdf.0.dr	Initial sample: http://www.pacificrad.com/pages/publications.html
Source: Rad Pro Calculator References.pdf.0.dr	Initial sample: http://ie.lbl.gov/toi.html
Source: Help for Rad Pro Calculator.pdf.0.dr	Initial sample: http://www.wmginc.com/Software/MegaShield/megashield.htm
Source: Help for Rad Pro Calculator.pdf.0.dr	Initial sample: http://www.wmginc.com/software/megashield/megashield.htm
Source: ShieldingandBuildup.pdf.0.dr	Initial sample: http://www.ans.org/store/vi-240180
Source: Help for Rad Pro Calculator.pdf.0.dr	Initial sample: http://www.epa.gov/radiation/marssim/obtain.html
Source: Help for Rad Pro Calculator.pdf.0.dr	Initial sample: http://www.epa.gov/radiation/marssim/docs/revision1_august_2002corrections/chapter6.pdf
Source: Help for Rad Pro Calculator.pdf.0.dr	Initial sample: http://www.radprocalculator.com/request.aspx

Source: Yara match	File source: 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Automated click: Next >
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Automated click: I accept the license agreement
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Automated click: Next >

Source: unknown	Process created: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe "C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe"
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe .\RadProCalculator3.26_64BSetup.exe /m="C:\Users\user\Desktop\RADPRO~1.EXE" /k=""
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Process created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe .\RadProCalculator3.26_64BSetup.exe /m="C:\Users\user\Desktop\RADPRO~1.EXE" /k=""	Jump to behavior

Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: olepro32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: riched32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Section loaded: twinapi.appcore.dll	Jump to behavior

Source: RadProCalculator3.26_64BSetup.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x299dfc
Source: AxInterop.ComctlLib.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x23494
Source: RadProCalculator3.26_64BSetup.exe	Static PE information: real checksum: 0x2df62 should be: 0x35d76e
Source: RadProCalculator.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x176d87
Source: Interop.Microsoft.Office.Core.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x42fac
Source: AxInterop.ComCtl2.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xd5a5
Source: Interop.Microsoft.Office.Interop.Excel.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x13827f
Source: Interop.ComctlLib.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0x42505
Source: Interop.ComCtl2.dll.0.dr	Static PE information: real checksum: 0x0 should be: 0xe761

Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\764C6FA8\242A76C8\RadProCalculator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F3319620\242A76C8\Interop.Microsoft.Office.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\28D15CAF\242A76C8\AxInterop.ComCtl2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F10E7C53\242A76C8\Interop.ComCtl2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\DEFF21C9\242A76C8\Interop.ComctlLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\gdiplus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F699690B\242A76C8\AxInterop.ComctlLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\9B25A4E7\242A76C8\Interop.Microsoft.Office.Interop.Excel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\489D2344\242A76C8\Interop.VBIDE.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	File created: C:\Users\user\AppData\Local\Temp\mia400B.tmp\mia.lib	Jump to dropped file

Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\764C6FA8\242A76C8\RadProCalculator.exe	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\mMSI.dll\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F3319620\242A76C8\Interop.Microsoft.Office.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\28D15CAF\242A76C8\AxInterop.ComCtl2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F10E7C53\242A76C8\Interop.ComCtl2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\DEFF21C9\242A76C8\Interop.ComctlLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\gdiplus.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F699690B\242A76C8\AxInterop.ComctlLib.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\9B25A4E7\242A76C8\Interop.Microsoft.Office.Interop.Excel.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	Jump to dropped file
Source: C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\489D2344\242A76C8\Interop.VBIDE.dll	Jump to dropped file

Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp	Binary or memory string: Shell_TrayWnd
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp	Binary or memory string: Progman
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp	Binary or memory string: Progmanadvapi32.dllCreateProcessWithTokenW
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp	Binary or memory string: ProgmanU
Source: RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp	Binary or memory string: Shell_TrayWndU

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Spearphishing Link	1 Exploitation for Client Execution	1 DLL Side-Loading	2 Process Injection	11 Masquerading	1 Input Capture	1 Process Discovery	Remote Services	1 Input Capture	Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 DLL Side-Loading	2 Process Injection	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 DLL Side-Loading	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\28D15CAF\242A76C8\AxInterop.ComCtl2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\489D2344\242A76C8\Interop.VBIDE.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\764C6FA8\242A76C8\RadProCalculator.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\9B25A4E7\242A76C8\Interop.Microsoft.Office.Interop.Excel.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\DEFF21C9\242A76C8\Interop.ComctlLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F10E7C53\242A76C8\Interop.ComCtl2.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F3319620\242A76C8\Interop.Microsoft.Office.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\OFFLINE\F699690B\242A76C8\AxInterop.ComctlLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\gdiplus.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\data\mMSI.dll\mMSIExec.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\mia400B.tmp\mia.lib	0%	ReversingLabs

Name	Source	Malicious	Reputation
http://ie.lbl.gov/toi.html)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Rad Pro Calculator References.pdf.0.dr	false	unknown
http://physics.nist.gov/PhysRefData/XrayMassCoef/tab3.html	ShieldingandBuildup.doc.0.dr	false	unknown
http://www.epa.gov/radiation/marssim/obtain.html)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	false	unknown
http://www.pacificrad.com/pages/publications.html)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Rad Pro Calculator References.pdf.0.dr	false	unknown
http://www.installaware.comz	RadProCalculator3.26_64BSetup.exe, RadProCalculator3.26_64BSetup.exe.0.dr	false	unknown
http://www.radprocalculator.com/Request.aspxGmailto:support	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator.exe.0.dr	false	unknown
http://www.InstallAware.com/open	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr	false	unknown
http://www.radprocalculator.com/	RadProCalculator3.26_64BSetup.exe, 00000002.00000002.3433296326.00000000024CC000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, mia.tmp.2.dr, RadProCalculator3.26_64BSetup.exe.0.dr	false	unknown
http://www.epa.gov/radiation/marssim/docs/revision1_August_2002corrections/chapter6.pdf)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	false	unknown
http://www.ans.org/store/vi-240180	ShieldingandBuildup.doc.0.dr	false	unknown
http://www.installaware.com/	RadProCalculator3.26_64BSetup.exe.0.dr	false	unknown
http://physics.nist.gov/xaamdi	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Rad Pro Calculator References.rtf.0.dr	false	unknown
http://www.radprocalculator.com/request.aspx	Contact Rad Pro Calculator.rtf.0.dr	false	unknown
http://physics.nist.gov/PhysRefData/XrayMassCoef/tab4.html	ShieldingandBuildup.doc.0.dr	false	unknown
http://www.wmginc.com/Software/MegaShield/megashield.htm)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	false	unknown
http://www.ans.org/store/vi-240180)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.pdf.0.dr	false	unknown
http://www.pacificrad.com/pages/publications.html	Rad Pro Calculator References.rtf.0.dr	false	unknown
http://www.installaware.com/InstallAware	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr	false	unknown
http://ie.lbl.gov/toi.html	Rad Pro Calculator References.rtf.0.dr	false	unknown
http://www.InstallAware.com/	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.0000000003A24000.00000004.00000020.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000003.2215926342.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, RadProCalculator3.26_64BSetup.exe, 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp, RadProCalculator3.26_64BSetup.exe.0.dr	false	unknown
http://physics.nist.gov/PhysRefData/XrayMassCoef/tab3.htmla	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.doc.0.dr	false	unknown
http://physics.nist.gov/PhysRefData/XrayMassCoef/tab4.html)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.pdf.0.dr	false	unknown
http://www.radprocalculator.com/Request.aspx)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	false	unknown
http://physics.nist.gov/PhysRefData/XrayMassCoef/tab3.html)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, ShieldingandBuildup.pdf.0.dr	false	unknown
http://www.radiationsoftware.com/mshield.html)/S/URI	RadProCalculator3.26_64BSetup.exe, 00000000.00000003.2198576039.000000000372F000.00000004.00000020.00020000.00000000.sdmp, Help for Rad Pro Calculator.pdf.0.dr	false	unknown

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report RadProCalculator3.26_64BSetup.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

Exploits

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\lang.loc

C:\Users\user\AppData\Local\Temp\mia.tmp

C:\Users\user\AppData\Local\Temp\mia1\RadProCalculator3.26_64BSetup.msi

C:\Users\user\AppData\Local\Temp\mia1\RadProSplash.jpg

C:\Users\user\AppData\Local\Temp\mia1\componentslist.dfm

C:\Users\user\AppData\Local\Temp\mia1\componentstree.dfm

C:\Users\user\AppData\Local\Temp\mia1\destination.dfm

C:\Users\user\AppData\Local\Temp\mia1\destination.dfm.miaf

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm

C:\Users\user\AppData\Local\Temp\mia1\finish.dfm.miaf

C:\Users\user\AppData\Local\Temp\mia1\gray.avi

C:\Users\user\AppData\Local\Temp\mia1\icon.ico

C:\Users\user\AppData\Local\Temp\mia1\index.htm

C:\Users\user\AppData\Local\Temp\mia1\license.rtf

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm

C:\Users\user\AppData\Local\Temp\mia1\licensecheck.dfm.miaf

C:\Users\user\AppData\Local\Temp\mia1\licenseradio.dfm

C:\Users\user\AppData\Local\Temp\mia1\licenseradio.dfm.miaf

C:\Users\user\AppData\Local\Temp\mia1\licensetext.dfm

C:\Users\user\AppData\Local\Temp\mia1\licensetext.dfm.miaf

C:\Users\user\AppData\Local\Temp\mia1\mMSIExec.dll

C:\Users\user\AppData\Local\Temp\mia1\maintenance.dfm

Windows Analysis Report
RadProCalculator3.26_64BSetup.exe

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1524334
Start date and time:	2024-10-02 17:33:35 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	RadProCalculator3.26_64BSetup.exe
Detection:	CLEAN
Classification:	clean12.expl.winEXE@3/73@0/0
Cookbook Comments:	Found application associated with file extension: .exe

Process:	C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	153172
Entropy (8bit):	4.653133657313636
Encrypted:	false
SSDEEP:	3072:V5ULyLagqz5QAJrtw+ZE9QMl6MU827IJi35ky:6
MD5:	B2443D27BC6393A08F7F1ECFCC70A6FE
SHA1:	6CA5FEE66B636C28E9E68DA71F77A67633147650
SHA-256:	B07763A11636BCBECEF5976D8E1D2E6EC811E5C2BFDECB75152F99A81EC13F7E
SHA-512:	09B5C68CDEFA107D28EF1288EE3E35BE2F7BEC5F64798A47BFD1E625F1A937DA0583D09B07A1FF6C92DBDB7868F7B01E408B09AD55B9DA3D5EE027DED1CB75E5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Please install the common controls update from Microsoft before attempting to install this product...Setup resource not found..Setup resource decompression failure..Setup database not found..Runtime error in install: ..bytes..KB..MB..Attempting to get value of undefined variable ..Attempting to set value of undefined variable ..Copying: ..Unable to copy installation data to local folders..Downloading Web Media: ..Unable to download installation data from the web..Extracting Web Media: ..Unable to extract installation data downloaded from the web..Please locate your original setup sources to continue operation..Original setup sources required to complete operation, sources not found..General setup failure..Runtime error in setup script:..% complete..bytes received..InstallAware Wizard..InstallAware is preparing the InstallAware Wizard which will install this application. Please wait...Retry Download?..Downloading of installation data from the web has failed. Would you like to try again?

Process:	C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2706359
Entropy (8bit):	6.451758829239219
Encrypted:	false
SSDEEP:	49152:lhTcNLdFYSfSSAvNQPFt1/wCfbTNmLCuCs+z6wlreEP0+8U7:7MTYQ0FI11bTwLCoE6AeEJ
MD5:	C82B11E5425B91A31672CEEC8E0F37A0
SHA1:	795CD8777D6FA087BC5DBC2D1A725EB09AEDB59B
SHA-256:	90D9A6A4876D315ABE1057C961ADB03E098F6EB772D55D5F36B61F4F3FE8B7BE
SHA-512:	CD821398AAFE50160D4765B4ABEFD72834D92ECC4C28A1D8F9844BD96042362173291E6DB106A1011075FD6937C7229BF8A2AE3999A47490A164440B4DA25379
Malicious:	false
Yara Hits:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe, Author: Joe Security
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....B.I.................J...6......L<.......`....@.......................... +..................@...........................p...G.... .DY..........................................................................\|}...............................text............................... ..`.itext...^.......`.................. ..`.data.......`.......N..............@....bss....Le...............................idata...G...p...H..................@....tls....4............(...................rdata...............(..............@..@.reloc.............................@..B.rsrc...DY.... ..Z.................@..@.............p+.......*.............@..@................................................................................................

Entrypoint:	0x412a70
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x49E64705 [Wed Apr 15 20:43:49 2009 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	29f777a4c1af9bae1c88e78b8844b0f5

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x1e424	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x27000	0x2a74	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1bb68	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1a000	0x24c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x18185	0x18200	71b46d394c5740a746aa1aab161d1467	False	0.592879695595855	data	6.547251516505409	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1a000	0x50c2	0x5200	71800784eababe5a686eb5855811f01f	False	0.32779153963414637	data	4.702651421056667	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x20000	0x69e0	0xc00	3f34c1f7a93ef3d77d489a6b770914a9	False	0.3173828125	data	3.090463631555638	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x27000	0x2a74	0x2c00	988e030c6755d5b124d4de9e4c95f1bf	False	0.3552024147727273	data	4.423180008056004	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x27294	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.4407514450867052
RT_ICON	0x277fc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.6832129963898917
RT_DIALOG	0x280a4	0x1d8	data			0.5720338983050848
RT_DIALOG	0x2827c	0x1be	data			0.5605381165919282
RT_STRING	0x2843c	0x210	Matlab v4 mat-file (little endian) C, numeric, rows 0, columns 0	English	United States	0.4053030303030303
RT_STRING	0x2864c	0x2fe	data	English	United States	0.42297650130548303
RT_STRING	0x2894c	0x106	data	English	United States	0.5152671755725191
RT_GROUP_ICON	0x28a54	0x22	data	English	United States	0.9411764705882353
RT_VERSION	0x28a78	0xb88	data	English	United States	0.1334688346883469
RT_MANIFEST	0x29600	0x474	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.45

DLL	Import
COMCTL32.dll
KERNEL32.dll	WaitForSingleObject, SetEvent, ResetEvent, WaitForMultipleObjects, CompareStringA, GetLastError, WideCharToMultiByte, MultiByteToWideChar, CompareStringW, lstrlenA, LoadLibraryA, AreFileApisANSI, GetModuleFileNameA, GetModuleFileNameW, FormatMessageA, LocalFree, FormatMessageW, SetFileAttributesA, RemoveDirectoryA, SetCurrentDirectoryA, GetWindowsDirectoryA, SetFileAttributesW, RemoveDirectoryW, CreateDirectoryA, CreateDirectoryW, DeleteFileA, DeleteFileW, GetShortPathNameW, GetShortPathNameA, GetFullPathNameA, GetFullPathNameW, GetCurrentDirectoryA, GetTempPathA, GetTempFileNameA, FindClose, FindFirstFileA, SetLastError, FindFirstFileW, FindNextFileA, CreateThread, CreateFileA, CreateFileW, GetFileSize, SetFilePointer, ReadFile, SetFileTime, WriteFile, SetEndOfFile, CreateEventA, EnterCriticalSection, LeaveCriticalSection, Sleep, GetVersionExA, GetCommandLineW, CreateProcessA, GetExitCodeProcess, IsBadReadPtr, SetUnhandledExceptionFilter, RaiseException, GetSystemInfo, VirtualProtect, GetLocaleInfoA, GetStringTypeW, GetStringTypeA, IsBadCodePtr, LCMapStringW, LCMapStringA, GetSystemTimeAsFileTime, GetCurrentProcessId, GetTickCount, QueryPerformanceCounter, GetCPInfo, GetOEMCP, GetACP, VirtualQuery, InterlockedExchange, RtlUnwind, IsBadWritePtr, VirtualAlloc, VirtualFree, CloseHandle, DeleteCriticalSection, InitializeCriticalSection, HeapCreate, HeapDestroy, TlsGetValue, TlsSetValue, TlsFree, GetCurrentThreadId, TlsAlloc, GetFileType, SetHandleCount, GetEnvironmentStringsW, FreeEnvironmentStringsW, GetEnvironmentStrings, FreeEnvironmentStringsA, UnhandledExceptionFilter, GetStdHandle, HeapSize, GetCurrentProcess, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, HeapFree, HeapAlloc, HeapReAlloc, ExitProcess, GetProcAddress, TerminateProcess
USER32.dll	PostMessageA, ShowWindow, DestroyWindow, KillTimer, SetTimer, SetDlgItemTextA, EndDialog, IsDlgButtonChecked, GetDlgItem, MessageBoxW, DialogBoxParamA, GetDesktopWindow, SetForegroundWindow, SetWindowLongA, SetWindowTextW, GetWindowTextA, GetWindowTextLengthA, SetWindowTextA, SendMessageA, LoadStringW, LoadStringA, CharPrevA, GetWindowLongA
ADVAPI32.dll	RegCreateKeyExA, RegCloseKey, RegSetValueExA
ole32.dll	CoCreateInstance, CoInitialize
OLEAUT32.dll	VariantClear, SysAllocString, SysFreeString

Target ID:	0
Start time:	11:34:31
Start date:	02/10/2024
Path:	C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\RadProCalculator3.26_64BSetup.exe"
Imagebase:	0x400000
File size:	3'493'085 bytes
MD5 hash:	DB2DF493ED3EF51A0731E67C41C81EB1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	11:34:34
Start date:	02/10/2024
Path:	C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe
Wow64 process (32bit):	true
Commandline:	.\RadProCalculator3.26_64BSetup.exe /m="C:\Users\user\Desktop\RADPRO~1.EXE" /k=""
Imagebase:	0x400000
File size:	2'706'359 bytes
MD5 hash:	C82B11E5425B91A31672CEEC8E0F37A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000002.00000000.2209437928.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\AppData\Local\Temp\mia400B.tmp\RadProCalculator3.26_64BSetup.exe, Author: Joe Security
Antivirus matches:	Detection: 7%, ReversingLabs
Reputation:	low
Has exited:	false