For fun I downloaded an installer from a "driver downloads" website. I do NOT intend on installing it, but I was interested to check it out just to see what it looked like. I tossed it into Ollydbg (without advancing the pointer) and just browsed the assembly.
There are multiple different calls/jumps/far jumps to various
ntdll is a pretty low-level library, but I just don't have enough experience in windows x86 disassembly to know what's 'normal'. This is also ostensibly, a driver installer, so it seems reasonable that there would be calls into
ntdll. Are jumps like that considered normal behavior? Usually I'm used to seeing calls that expressly name the function... not a specific address in
The file wasn't packed, but there were a few spots where the full printable ASCII
[A-Za-z] appeared in the hex view, which I recall could be a sign that there's base64 encoding/decoding going on somewhere. Maybe shift-ciphers.
For reference, the precise binary I'm peering into is here. Windows 7 64bits. (The installer itself appears to be 32bits... Ollydbg loaded it fine, and IDA free too.)
PEBrowse64 also showed me something possibly suspicious under
In this section there appears to be strings set aside for Pageup/Down/Backspace/Esc/Enter keys, which I know could be a sign of a keylogger... but again, I'm new, so I'm unsure.