Benign Download

ar

Shell command execution capabilitysystem() function call

SHA-25672797390c1bfd4d485a4b258047e5eb5e36ebdac42ff5bc8cf5850a0fbf06dba

Evidence

Shell command execution capability 0x1433–0x14a3

0x1433657273696f6e007374726572726f7200ersion.strerror.
0x144373797374656d006673746174005f6564system.fstat._ed
0x145361746100656c665f656e6400656c665fata.elf_end.elf_
⋯5 more rows

Open files 0x150d–0x157d

0x150d6d640078636d64005f6d636f756e7400md.xcmd._mcount.
0x151d666f70656e005f696e6974005f5f696ffopen._init.__io
0x152d620067656c665f676574636c61737300b.gelf_getclass.
⋯5 more rows

Uses sendfile socket call 0x1679–0x16e9

0x16796c6f6e67646f75626c655f7573656400longdouble_used.
0x168973656e6466696c65007374726e637079sendfile.strncpy
0x1699005f73746172745f63727400656c665f._start_crt.elf_
⋯5 more rows

Change file ownership 0x171a–0x179a

0x171a737200656c665f676574617268647200sr.elf_getarhdr.
0x172a63686f776e007365746c6f63616c6500chown.setlocale.
0x173a61636365737300656c665f6e65787400access.elf_next.
⋯6 more rows

usage: label (lowercase) 0x6411–0x64b1

0x641100000000000000000000000000000000................
0x642175736167653a206172202d645b2d5376usage: ar -d[-Sv
0x6431565d20617263686976652066696c6520V] archive file 
0x64412e2e2e0a202020202020206172202d6d....       ar -m
0x64515b2d6162695376565d205b706f736e61[-abiSvV] [posna
0x64616d655d20617263686976652066696c65me] archive file
0x6471202e2e2e0a202020202020206172202d ....       ar -
0x6481705b2d76565d5b2d73535d2061726368p[-vV][-sS] arch
0x6491697665205b66696c65202e2e2e5d0a20ive [file ...]. 
0x64a12020202020206172202d715b2d637375      ar -q[-csu
0x64b17653565d205b66696c65202e2e2e5d0avSV] [file ...].