Suspicious ^54% windows Download

halo

Legitimate Halo CMS application

Reflectively loads classes from a URLNitrogenLoader Config Extraction

SHA-2567a1d6ea0800e8940672aab99a7328b7bd9520e297677169594328004a41991bc

URLhttps://github.com/halo-dev/halo/releases/download/v2.26.1/halo-2.26.1.jar#/halo.jar

MaleculeK₂(AmLi₃₅)O₆(CAs₇CoErLaXe₃)H₁₁(Cm₆₃Cr₁₇Db₄₉Ds₂F₂₀Hf₄MgOs₁₉Po₂₆Ti₃U₁₇)Md₈(Bi₄Bk₄He₂Pa₁₁Pt₂Si₃)Th

Evidence

English function-word token "for" 0x9a87–0x9b67

0x9a874c8b66e8488b6ef0488b5ef8488d2648L.f.H.n.H.^.H.&H
0x9a978b7c2408488b742410c34d6f6e74676f.|$.H.t$..Montgo
0x9aa76d657279204d756c7469706c69636174mery Multiplicat
0x9ab7696f6e20666f72207838365f36342c20ion for x86_64, 
0x9ac743525950544f47414d53206279203c61CRYPTOGAMS by <a
0x9ad77070726f406f70656e73736c2e6f7267[email protected]
0x9ae73e009090909090909056575355415441>........VWSUATA
0x9af755415641579c4883ec40498b4078498bUAVAW.H..@I.@xI.
⋯7 more rows

Repeated x64 stack-table indirect calls 0x10f629–0x10f6e9

⋯3 more rows
0x10f6594889842480000000488b8c2480000000H..$....H..$....
0x10f669ff9424880000000fb6c085c0752348c7..$.........u#H.
0x10f67984249000000000000000488d4c2430e8.$........H.L$0.
⋯7 more rows

CPUID feature-query instruction sequence 0x188fed–0x1890ad

⋯3 more rows
0x18901d0000488d942488000000488b4c2470e8..H..$....H.L$p.
0x18902d0fa2fbff0fb6c085c074234c8b4c2468.........t#L.L$h
0x18903d4c8b842420010000488d542478488b4cL..$ ...H.T$xH.L
⋯7 more rows

NitrogenLoader Config Extraction 0x1adf24–0x1ae0a4

⋯7 more rows
0x1adf94b00000000fb60401894424308b442430.........D$0.D$0
0x1adfa48b4c243433c88bc148634c2420488b94.L$43...HcL$ H..
0x1adfb4249800000088040aeb8833d28b8424a0$.........3...$.
⋯15 more rows

Resolve endpoint with getaddrinfo 0x2b6fc0–0x2b72b0

⋯3 more rows
0x2b6ff000000000000000000000000000000000................
0x2b7000443a5c615c6e657474795c6e65747479D:\a\netty\netty
0x2b70105c707265706172652d72656c65617365\prepare-release
0x2b70202d776f726b73706163655c636f646563-workspace\codec
0x2b70302d6e61746976652d717569635c746172-native-quic\tar
0x2b70406765745c626f72696e6773736c2d736fget\boringssl-so
0x2b7050757263655c73736c5c73736c5f6c6962urce\ssl\ssl_lib
0x2b70602e636300180000000000000000000000.cc.............
0x2b707044003a005c0061005c006e0065007400D.:.\.a.\.n.e.t.
0x2b7080740079005c006e006500740074007900t.y.\.n.e.t.t.y.
0x2b70905c007000720065007000610072006500\.p.r.e.p.a.r.e.
⋯3 more rows
0x2b70d02d006e00610074006900760065002d00-.n.a.t.i.v.e.-.
0x2b70e071007500690063005c00740061007200q.u.i.c.\.t.a.r.
0x2b70f06700650074005c0062006f0072006900g.e.t.\.b.o.r.i.
0x2b71006e006700730073006c002d0073006f00n.g.s.s.l.-.s.o.
0x2b711075007200630065005c00730073006c00u.r.c.e.\.s.s.l.
0x2b71205c00730073006c005f006c0069006200\.s.s.l._.l.i.b.
0x2b71302e006300630000000000000000000000..c.c...........
0x2b71406d00610078005f007300650071005f00m.a.x._.s.e.q._.
0x2b71506e0075006d0020003c003d0020004400n.u.m. .<.=. .D.
0x2b716054004c0053005200650063006f007200T.L.S.R.e.c.o.r.
0x2b717064004e0075006d006200650072003a00d.N.u.m.b.e.r.:.
0x2b71803a006b004d0061007800530065007100:.k.M.a.x.S.e.q.
0x2b7190750065006e0063006500000000000000u.e.n.c.e.......
0x2b71a044003a005c0061005c006e0065007400D.:.\.a.\.n.e.t.
0x2b71b0740079005c006e006500740074007900t.y.\.n.e.t.t.y.
0x2b71c05c007000720065007000610072006500\.p.r.e.p.a.r.e.
0x2b71d02d00720065006c006500610073006500-.r.e.l.e.a.s.e.
0x2b71e02d0077006f0072006b00730070006100-.w.o.r.k.s.p.a.
0x2b71f0630065005c0063006f00640065006300c.e.\.c.o.d.e.c.
0x2b72002d006e00610074006900760065002d00-.n.a.t.i.v.e.-.
⋯8 more rows
0x2b729010000000000000000000000000000000................
0x2b72a0443a5c615c6e657474795c6e65747479D:\a\netty\netty
0x2b72b05c707265706172652d72656c65617365\prepare-release

Showing the top 5 files — 3 more files (32 regions) not shown.

No evidence locations were recorded for this file. Raw result