Benign windows Download

vriesdemichael.bb 1.0_windows_amd64_noupdate

Assembly LOOP target mnemonicBinary contains high-entropy data regions

SHA-2567ec28582bb2e39af6bac8aa4e4aea9568502a58a4f33c5f824e83659d4248d1f

URLhttps://github.com/vriesdemichael/bitbucket-data-center-cli/releases/download/v4.1.0/bb_4.1.0_windows_amd64_noupdate.zip

MaleculeK₃(LiMcTe)O₈(AlAs₃C₆DyErIPrXe)H₉(Cm₂₀Cr₁₂Db₇F₇HfMgOs₉Po₈U₂)Md₄(Bi₆BkPa)

Evidence

Large PE with elevated code entropy 0x5c0–0x870

⋯3 more rows
0x5f000000000000000000000000000000000................
0x6004c8d6424884d3b66100f866902000055L.d$.M;f...i...U
0x6104889e54881ecf0000000488984240001H..H......H..$..
0x6200000e8390d0500488d05488eee00bb05...9...H..H.....
0x630000000e888180500e8830d0500488d44.............H.D
0x6402420488b8c2400010000440f1031440f$ H..$....D..1D.
0x6501130440f107110440f117010440f1071.0D..q.D..p.D..q
0x66020440f117020440f107130440f117030 D..p D..q0D..p0
0x670440f107138440f11703831c0eb424889D..q8D..p81..BH.
0x680842498000000488b44c4204889442418.$....H.D. H.D$.
0x690e8cb0c0500e8c60e0500488b44241890..........H.D$..
0x6a0e87b110500e8160d0500488b84249800.{........H..$..
0x6b0000048ffc0488b8c24000100000f1f00..H..H..$.......
0x6c04883f8097cb8e8950c0500e8d00e0500H...|...........
0x6d0e8eb0c0500e8860c0500488d0525b7ee..........H..%..
0x6e000bb07000000e8d5170500e8d00c0500................
0x6f0488b842400010000488d4848488d5424H..$....H.HHH.T$
0x70020440f1031440f1132440f107110440f D..1D..2D..q.D.
0x710117210440f107120440f117220440f10.r.D..q D..r D..
0x7207130440f117230440f107140440f1172[email protected]
0x73040440f107150440f117250440f107160@D..qPD..rPD..q`
0x740440f117260440f107168440f11726831D..r`D..qhD..rh1
0x750c9eb3e48898c2498000000488b44cc20..>H..$....H.D. 
0x7604889442410e8f60b0500e8f10d050048H.D$...........H
0x7708b442410e8a7100500e8420c0500488b.D$.......B...H.
0x7808c249800000048ffc1488b8424000100.$....H..H..$...
0x790004883f90f7cbce8c40b05000f1f4000.H...|........@.
0x7a0e8fb0d0500e8160c0500e8b10b050048...............H
0x7b08d05c58cee00bb050000000f1f440000.............D..
0x7c0e8fb160500e8f60b0500488b84240001..........H..$..
0x7d000004805c0000000488d8c24a8000000..H.....H..$....
0x7e0440f1030440f1131440f107010440f11D..0D..1D..p.D..
0x7f07110440f107020440f117120440f1070q.D..p D..q D..p
0x80030440f117130440f107038440f1171380D..q0D..p8D..q8
0x81031c0eb414889842498000000488b84c41..AH..$....H...
0x820a800000048898424a0000000e82f0b05....H..$...../..
0x83000e82a0d0500488b8424a00000006690..*...H..$....f.
0x840e8fb150500e8760b0500488b84249800......v...H..$..
0x850000048ffc04883f8097cb90f1f440000..H..H...|...D..
0x860e8fb0a0500e8360d0500e8510b050048......6....Q...H
0x87081c4f00000005dc348894424080f1f00......].H.D$....

Go time.Location type name fragment in .text 0xb3077–0xb31a7

0xb3077010000660f1f4400004c390599dffb01...f..D..L9.....
0xb3087753e488d5a0a4839d9731bbf0a000000u>H.Z.H9.s......
0xb3097488d35e218cc016690e8bb5afdff488bH.5....f...Z..H.
0xb30a79424b000000049b874696d652e4c6f63.$....I.time.Loc
0xb30b74c89041066c7441008616ce9b5010000L...f.D..al.....
0xb30c7488d5a0e4839d973294c898424f80000H.Z.H9.s)L..$...
0xb30d700bf0e000000488d359c18cc01e8775a......H.5.....wZ
0xb30e7fdff488b9424b00000004c8b8424f800..H..$....L..$..
0xb30f70000488984240001000048899c24b000..H..$....H..$..
0xb3107000048898c24b800000048b974696d65..H..$....H.time
0xb31172e4c6f6348890c1048b96f636174696f.LocH...H.ocatio
0xb31276e2848894c1006498b00498b5808e886n(H.L..I..I.X...
0xb3137290000488b8c24b0000000488d141948)..H..$....H...H
0xb31478bb424b80000004839d6720a488bbc24..$....H9.r.H..$
0xb315700010000eb4e48899c24e80000004889.....NH..$....H.
0xb3167842408010000488b8424000100004889.$....H..$....H.
0xb3177f14889df488d35fe17cc014889d3e8d6.H..H.5....H....
0xb318759fdff4889ce4889da4889c7488b8424Y..H..H..H..H..$
0xb319708010000488b8c24b0000000488b9c24....H..$....H..$
0xb31a7e800                            ..              

Go time.UTC type name fragment in .text 0xb3238–0xb32f8

0xb3238ff4889c74889cac6443bff294889d148.H..H...D;.)H..H
0xb324889f8eb30488d5a084839d97319bf0800...0H.Z.H9.s....
0xb32580000488d351f17cc01e8fa58fdff488b..H.5......X..H.
0xb32689424b000000049b874696d652e555443.$....I.time.UTC
0xb32784c89041048ffc3904839d97311bf0100L...H...H9.s....
0xb32880000488d35ef16cc01e8ca58fdffc644..H.5......X...D
0xb329803ff294889d94889c331c0e89876fbff..)H..H..1...v..
0xb32a84881c4180100005dc3e82aadfdff9048H......]..*....H
0xb32b88944240848895c241048894c2418e8d5.D$.H.\$.H.L$...
0xb32c88efdff488b442408488b5c2410488b4c...H.D$.H.\$.H.L
0xb32d82418e961f9ffffcc4c8d6424d84d3b66$..a....L.d$.M;f
0xb32e8100f86e1000000554889e54881eca000.......UH..H....
0xb32f8000048898c24c000                ..H..$..        

Immediate process-information class value 31 0x262de5–0x262ea5

0x262de590e8b593e2ffe930ffffffcccccccccc.......0........
0x262df5cccccccccccccccccccccc493b66100f...........I;f..
0x262e0586c8000000554889e54883ec484885c0.....UH..H..HH..
0x262e157c15488d542428440f113a440f117a10|.H.T$(D..:D..z.
0x262e25ba1f000000eb3948f7d8e8ccffffffb9......9H........
0x262e35010000004889c74889de31c0488d1d88....H..H..1.H...
0x262e45fdd200e8d373e0ff4883c4485dc34883.....s..H..H].H.
0x262e55c130884c1c28488d4bff4889d04889ca.0.L.(H.K.H..H..
0x262e654883f80a7c2a4889c148b8cdccccccccH...|*H..H......
0x262e75cccccc4889d348f7e148c1ea03488d34...H..H..H...H.4
0x262e8512488d34b64829f14883fb2072c0eb32.H.4.H).H.. r..2
0x262e954883fa207322488d7030408874142848H.. s"[email protected].(H
0x262ea58d5c1428488d4ae048f7d931c0e8    .\.(H.J.H..1..  

ChaCha quarter-round rotation schedule 0x323de3–0x323ea3

0x323de32c44895c244c807879000f856f010000,D.\$L.xy...o...
0x323df34c898c24280100004c89842420010000L..$(...L..$ ...
0x323e034889b424180100004889bc2410010000H..$....H..$....
0x323e1348899c24000100008d9a6e64203331cbH..$......nd 31.
0x323e23c1c310418d4c1d00894c247431d1c1c1...A.L...L$t1...
0x323e330c448d2c0a458dad6e6420334431ebc1.D.,.E..nd 3D1..
0x323e43c3088b54247401da31d1c1c107418db2...T$t..1....A..
0x323e53322d62794431e6c1c610458d243744892-byD1....E.$7D.
0x323e636424704531d441c1c40c478d3c22458dd$pE1.A...G.<"E.
0x323e73bf322d62794431fec1c608448b542470.2-byD1....D.T$p
0x323e834101f24531d441c1c4078b7c243c448dA..E1.A....|$<D.
0x323e93877465206b4531d841c1c010448b5c24.te kE1.A...D.\$
0x323ea3584501c344895c246c4131          XE..D.\$lA1     

No evidence locations were recorded for this file. Raw result