Benign alpine Download

abuild-sudo 3.18.0_rc1-r0

Legitimate Alpine package binary

ELF binary has trailing overlay dataELF overlay exceeds 512 bytes
SHA-256637a9097d0c21d7a37bd049ee59678fb74fefe6010f00f1399d8134c813386c8
URLhttps://dl-cdn.alpinelinux.org/alpine/edge/main/x86_64/abuild-sudo-3.18.0_rc1-r0.apk
MaleculeH₂(OsPo)Md₂(BiHe)

Evidence

Resolve group name to GID (getgrnam) abuild-sudo · 0x631–0x711
0x63114000000000000010000000000000000................
0x64173657475696400657865637600737472setuid.execv.str
0x6517263687200706572726f720067657470rchr.perror.getp
0x66177756964007761726e78006765746772wuid.warnx.getgr
0x6716e616d006d616c6c6f63006572720067nam.malloc.err.g
0x681657467726f7570730067657475696400etgroups.getuid.
0x6915f696e697400737472636872005f6669_init.strchr._fi
0x6a16e69005f5f6378615f66696e616c697ani.__cxa_finaliz
0x6b165006572727800616363657373007365e.errx.access.se
0x6c17467696400737472636d70005f5f6c69tgid.strcmp.__li
⋯5 more rows
Alpine/Wolfi package info metadata .PKGINFO · lines 1–6
1# Generated by abuild 3.17.0-r1
2# using fakeroot version 1.37.2
3pkgname = abuild-sudo
4pkgver = 3.18.0_rc1-r0
5pkgdesc = Simple privilege elevation tools for building packages
6url = https://gitlab.alpinelinux.org/alpine/abuild/

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.