Hostile ^100% arch Download

ffdec 26.2.1-1

Java captures clipboard textMalicious dependency: https://github.com/jindrapetrik/jpexs-decompiler/archive/refs/tags/version26.2.1.tar.gz | bc74ba4610df1da263f012011e1f45e3a8189427ee087f69d95f40c105a07d98

SHA-2563f4fd9a681a0430cfa7a11d2f30267194a15cd417a2bd1bb37b49d508dab2d7d

URLhttps://aur.archlinux.org/cgit/aur.git/snapshot/ffdec.tar.gz

MaleculeH₂(CmPo₂)

Evidence

eval command in shell script ffdec · lines 3–5

3DEFAULT_JVM_OPTS='-Dawt.useSystemAAFontSettings=on -Dswing.aatext=true'
4eval set -- $DEFAULT_JVM_OPTS -cp /usr/share/java/ffdec/lib  -jar '/usr/share/java/ffdec/ffdec.jar' "$@"
5exec java "$@"

x86 e_lfanew to PE signature walk ffdec.exe · 0x40cd–0x418d

⋯3 more rows
0x40fd9090908b44240431d26681384d5a750b....D$.1.f.8MZu.
0x410d03403c813850450000740889d0c32e8d.@<.8PE..t......
0x411d74260031d2668178180b010f94c289d0t&.1.f.x........
⋯7 more rows

PE binary built with MinGW/GCC ffdec.exe · 0x5f74–0x6074

⋯4 more rows
0x5fb474206164647265737320257000000000t address %p....
0x5fc420205669727475616c50726f74656374  VirtualProtect
0x5fd4206661696c6564207769746820636f64 failed with cod
0x5fe465203078257800002020556e6b6e6f77e 0x%x..  Unknow
0x5ff46e2070736575646f2072656c6f636174n pseudo relocat
0x6004696f6e2070726f746f636f6c20766572ion protocol ver
0x601473696f6e2025642e0a0000002020556esion %d.....  Un
0x60246b6e6f776e2070736575646f2072656cknown pseudo rel
⋯5 more rows

ShellExecute API call ffdec.exe · 0x7cda–0x7dfa

⋯3 more rows
0x7d0a644c696e65546f417267765700003201dLineToArgvW..2.
0x7d1a5368656c6c4578656375746557007800ShellExecuteW.x.
0x7d2a43726561746557696e646f7745785700CreateWindowExW.
0x7d3ab70044657374726f7957696e646f7700..DestroyWindow.
0x7d4ac00044697370617463684d6573736167..DispatchMessag
0x7d5a655700000f01456e756d57696e646f77eW....EnumWindow
0x7d6a7300ca0147657453797374656d4d6574s...GetSystemMet
0x7d7a726963730000f10147657457696e646frics....GetWindo
0x7d8a775265637400f90147657457696e646fwRect...GetWindo
0x7d9a7754687265616450726f636573734964wThreadProcessId
0x7daa00005002497357696e646f7756697369..P.IsWindowVisi
⋯5 more rows

Dynamic library loading via LoadLibraryA ffdec.exe · 0xb228–0xb458

0xb228efc4ffefc4ffefc4ffefc4ffefc4ffef................
0xb238c4ffefc4ffefc4ffefc4ffefc4ffefc4................
0xb248ffefc4ffefc4ffefc4ffefc4ffefc4ff................
0xb258efc4ffefc4ffefc4ffefc4ffefc4ffef................
0xb268c4ffefc4ffefc4ffefc4ffefc4ffefc4................
0xb278ffefc4ffefc4ffefc4ffefc4ffefc4ff................
0xb288efc4ffefc4ffefc4ffefc4ffefc4ffef................
0xb298c4ffefc4ffefc4ffefc4ffefc4ffefc4................
0xb2a8ffefc4ffefc4ffefc4ffefc4ffefc4ff................
0xb2b8efc4ffefc4ffefc4ffefc4ffefc4ffef................
0xb2c8c4ffefc4ffefc4ffefc4ffefc4ffefc4................
0xb2d8ffefc4ffefc4ffefc4ffefc4ffefc4ff................
0xb2e8efc4ffefc4ffefc4ffefc4ffefc4ffef................
0xb2f8c4ffefc4ffefc4ffefc4ffefc4ffefc4................
0xb308ffefc4ffefc4ffefc4ffefc4ffefc4ff................
0xb318d5aeffc9a4ffc9a4ffc9a4ffc9a40000................
0xb328f9bd76f9bd76f9bd76f9bd76fbc489ff..v..v..v..v....
0xb338d3b4ffd3b4ffd3b4ffd3b4ffd3b4ffd3................
0xb348b4ffd3b4ffd3b4ffd3b4ffd3b4ffd3b4................
0xb358ffd3b4ffd3b4ffd3b4ffd3b4ffd3b4ff................
0xb368d3b4ffd3b4ffd3b4ffd3b4ffd3b4ffd3................
0xb378b4ffd3b4ffd3b4ffd3b4ffd3b4ffd3b4................
0xb388ffd3b4ffd3b4ffd3b4ffd3b4ffd3b4ff................
0xb398d3b4ffd3b4ffd3b4ffd3b4ffd3b4ffd3................
0xb3a8b4ffd3b4ffd3b4ffd3b4ffd3b4ffd3b4................
0xb3b8ffd3b4ffd3b4ffd3b4ffd3b4ffd3b4ff................
0xb3c8d3b4ffd3b4ffd3b4ffd3b4ffd3b4ffd4................
0xb3d8b4ffd4b4ffd4b4ffd4b5ffd4b5ffd4b5................
0xb3e8ffd4b5ffd4b5ffd4b5ffd5b5ffd5b5ff................
0xb3f8d5b5ffd5b5ffd5b5ffd5b5ffd5b5ffd5................
0xb408b5ffd5b5ffd6b5ffd6b6ffd6b6ffd6b6................
⋯5 more rows

No evidence locations were recorded for this file. Raw result