Benign windows Download

Google.AndroidCLI

Authenticode chain CN: Google LLCBinary contains high-entropy data regions

SHA-25610a6d8c536601524541e9bec98ee6d2b6cab92a3edfe30a82f2e36da4aefbb77

URLhttps://dl.google.com/android/cli/1.0.16406183/windows_x86_64/android.exe

MaleculeK(Li)O₄(AlAs₂CEr)H₇(Cm₇Cr₆Db₄DsFOs₅Po₆)Md₂(Bi₃Si₃)

Evidence

One .text section dominates file 0x3c0–0x670

⋯3 more rows
0x3f000000000000000000000000000000000................
0x40055415741565657534881ecb800000048UAWAVVWSH......H
0x4108dac248000000048c74530feffffff4c..$....H.E0....L
0x42089ce4c89c74989d04889ca488d4dc0e8..L..I..H..H.M..
0x4300c7c0d00488b45c0488b55c84889c148.|..H.E.H.U.H..H
0x440f7d97030488b4dd0488945e0488955e8..p0H.M.H.E.H.U.
0x45048894df0488d4da8488d55e041b001e8H.M.H.M.H.U.A...
0x460fca30d00488b4da8488b55b04889c848....H.M.H.U.H..H
0x470f7d871164889d64889f04881c4b80000..q.H..H..H.....
0x480005b5f5e415e415f5dc348894d284889.[_^A^A_].H.M(H.
0x4905520488d4dc04889fa4989f0e89f7b0dU H.M.H..I....{.
0x4a000488b45c04c8b7dc84889c148f7d970.H.E.L.}.H..H..p
0x4b030488b4dd0488945e04c897de848894d0H.M.H.E.L.}.H.M
0x4c0f0488d4da8488d55e041b001e88fa30d.H.M.H.U.A......
0x4d000488b7da84c8b7db04889f848f7d871.H.}.L.}.H..H..q
0x4e0294c8b75204c89fe488b5d284885db74)L.u L..H.](H..t
0x4f086ff15b99b2c004889c131d24d89f0ff.....,.H..1.M...
0x50015e39b2c00e96dffffff488b5db84c8b...,..m...H.].L.
0x51075204c89f14c89fa41b801000000ff15u L..L..A.......
0x5200c9c2c0085c0740431f6eb7eff15569b..,...t.1..~..V.
0x5302c0083f805756948897d104c897d1866,....uiH.}.L.}.f
0x540c745fc0000c745f80000000048c745f0.E....E.....H.E.
0x55007000000c645fe000f2805b19e23000f.....E...(...#..
0x5602945e0488d55e04c89f1e8e1ac0d0048)E.H.U.L.......H
0x57089d7a801745a89f883e00348be020000....tZ.....H....
0x580000500000083f8010f84f50000004c8b..............L.
0x5907520488b5d284c8b7d18488b7d10eb0eu H.](L.}.H.}...
0x5a089c648c1e6204883ce02488b5d284885..H.. H...H.](H.
0x5b0ff0f8435ffffffff15f39a2c004889c1...5.......,.H..
0x5c031d24d89f8ff151d9b2c00e91cffffff1.M......,......
0x5d04c8d3c5dfeffffff4c89f848c1e82074L.<]....L..H.. t
0x5e00f48be0200000005000000e905010000.H..............
0x5f0458d771631c94c89f2e812800d004885E.w.1.L.......H.
0x600c00f84e40000004889c64801dbc70003.......H..H.....
0x61000000048c74008000000004489781048[email protected]
0x62089c14883c1144c8b7d184c89fa4989d8..H...L.}.L..I..
0x630e83b9823004889f9ba160000004989f0.;.#.H.......I..
0x6404589f1ff153f9b2c0089c3ff155f9a2cE....?.,....._.,
0x650004889c131d24989f0ff15899a2c0085.H..1.I......,..
0x660db0f84ac0000004889f9ff1528992c00.......H....(.,.
0x67031f64c8b7520488b5d28488b7d10e92b1.L.u H.](H.}..+

Packed loader largest section ratio above 0.65 0x921–0x9b1

0x92185c07406488b4df0ffd04c8b65f0488b..t.H.M...L.e.H.
0x93145f84883780800741a48837810117205E.H.x..t.H.x..r.
0x9414d8b6424f841ffd74889c131d24d89e0M.d$.A..H..1.M..
0x95141ffd541ffd74889c131d24c8b45e841A..A..H..1.L.E.A
0x961ffd5e938ffffff31d24889d04883c448...8...1.H..H..H
0x9715b5f5e415c415d415e415f5dc3488d15[_^A\A]A^A_].H..
0x981a36a2500ebe34c8d0dfa2a25004889d1.j%...L...*%.H..
0x9914889f24989f0e844662300cc0f1f0048H..I...Df#.....H
0x9a189542410554157415641554154565753.T$.UAWAVAUATVWS
0x9b14883ec28488d6a40                H..(H.j@        

Native stack immediate byte-string fragment 0x5d3b–0x5e3b

0x5d3b660f7f9500010000660f7f8df0000000f.......f.......
0x5d4b0f2985e00000004c8ba3e60000004c89.).....L......L.
0x5d5ba520090000f30f6f83d6000000660f7f. .....o.....f..
0x5d6b851009000048c785f001000000000000.....H..........
0x5d7bc685300200002dc6857002000000c685..0...-..p......
0x5d8b28020000024d85e40f8494010000488d(....M........H.
0x5d9bb5b0090000c685ac0e000001c685ab0e................
0x5dab000001c685aa0e000001488d8d200400..........H.. ..
0x5dbb004889f2e8cc1910004c8bad880d0000.H.......L......
0x5dcb80bd200400002c0f8564010000488b85.. ...,..d...H..
0x5ddb10090000488b8d180900004b8d146448....H......K..dH
0x5deb8d14d148898de8030000488985f80300...H......H.....
0x5dfb0048898df00300004889950004000048.H......H......H
0x5e0b8d8d20040000488d955009000041b8e0.. ...H..P...A..
0x5e1b000000e84d402300488b465048898500....M@#.H.FPH...
0x5e2b0900000f1046400f2985f0080000f30f.....F@.).......
0x5e3b6f06f30f6f4e10f30f              o...oN...       

Dense x64 TLS-array pointer access 0xfb99–0xfc59

0xfb99488d1530dd0c0031c9ff15e0a32b00c7H..0...1.....+..
0xfba945d800500000488d4dd8ff15efa52b00E..P..H.M.....+.
0xfbb9ff1579a42b004c8b05ca782e00488d15..y.+.L...x..H..
0xfbc937e523004889c141ffd08b0567a02e007.#.H..A....g...
0xfbd965488b0c2558000000488b04c1488b90eH..%X...H...H..
0xfbe9580000004885d2752a488d8858000000X...H..u*H..X...
0xfbf9488b05f0792e004883f8ff0f84630100H...y..H.....c..
0xfc0900488d5001f0480fb115d9792e0075e7.H.P..H....y..u.
0xfc19488911488915c5792e00488d0da636ffH..H...y..H...6.
0xfc29ffe8514b00004885c0747e4889452048..QK..H..t~H.E H
0xfc398d452048894508488d05d96e00004889.E H.E.H...n..H.
0xfc494510488d052eb62200488945d848c745E.H....".H.E.H.E
0xfc59e002                            ..              

Vectorized zero-fill instruction sequence 0xfda0–0xfe60

0xfda0ffffb8650000008b0ddb762e0085c90f...e......v.....
0xfdb084f3feffffe904ffffffc74530000000...........E0...
0xfdc000c6453400488d05acdc2300488945a8..E4.H....#.H.E.
0xfdd048c745b00100000048c745b808000000H.E.....H.E.....
0xfde00f57c00f1145c0488d4d30488d55a8e8.W...E.H.M0H.U..
0xfdf0dc170c0048894528488d4d28e85f190c....H.E(H.M(._..
0xfe0000b907000000cd290f0be8b1db0c00cc.......)........
0xfe10488954241055564883ec28488daa8000H.T$.UVH..(H....
0xfe200000488b4d40488b4538488378080074[email protected]
0xfe300d488b4538488b5010e87227ffffff15.H.E8H.P..r'....
0xfe406ca22b004889c131d24c8b4518ff1595l.+.H..1.L.E....
0xfe50a22b00904883c4285e5dc30f1f440000.+..H..(^]...D..
0xfe60488954241055564883ec28488daa    H.T$.UVH..(H..  