Benign arch Download

chain-lang-git 0.7.0.beta.r0-1

“Chain programming language interpreter (latest git version)”

Authenticode chain CN: Microsoft CorporationC executes a command held in a variable

SHA-25687e5b04b663d30fe10b7b7e1d5e5cb813af03d7c9d415d19787ae227a6d22189

URLhttps://aur.archlinux.org/cgit/aur.git/snapshot/chain-lang-git.tar.gz

Evidence

Indirect call followed by a compare branch 0x3d0–0x6c0

⋯23 more rows
0x54048c74208280000004889f1e8503b0000H.B.(...H...P;..
0x5504889f1e85c3c00004889c1ff15870002H...\<..H.......
0x5600083f8ff74704889f1e8463c00004889....tpH...F<..H.
0x570c648c744243000000000c74424288000.H.D$0.....D$(..
⋯12 more rows
0x640c34189c64889f1e8103b00004c39f075.A..H....;..L9.u
0x6503cff15a1ff010083f87a7531ba001000<........zu1....
0x660004889f1e8993800004889f1e8eb3a00.H....8..H....:.
⋯6 more rows

LoadLibraryExW w/ SYSTEM32 search 0xad5–0xba5

⋯3 more rows
0xb051e300200ff75c8488d0dedd8010031d2.0...u.H......1.
0xb1541b800080000ff159ffb01004885c075A...........H..u
0xb2515488d0d1bd9010031d241b800080000.H......1.A.....
0xb35ff1585fb0100488905de2f0200488d0d......H.../..H..
⋯7 more rows

Vectorized zero-fill instruction sequence 0x2a85–0x2b45

⋯3 more rows
0x2ab5762675418a4624884424484c89642440v&uA.F$.D$HL.d$@
0x2ac50f57c00f114424304c897c2420c64424.W...D$0L.|$ .D$
0x2ad52800488d0d02bf0100488d15bbbe0100(.H......H......
⋯7 more rows

All-ones x64 handle constant 0x3ef5–0x3fc5

⋯3 more rows
0x3f2500004889cb4889f848ffc0488d443f02..H..H..H..H.D?.
0x3f3548c7c1ffffffff480f49c8e837060000H......H.I..7...
0x3f454885c074634989c64c8b034d85c07450H..tcI..L..M..tP
0x3f554b8d04464883c0024c39f0725b488b53K..FH...L9.r[H.S
⋯7 more rows

References the .NET mscoree loader name 0x16890–0x16950

⋯3 more rows
0x168c0307a008001000000607a0080010000000z......`z......
0x168d06d00730063006f007200650065002e00m.s.c.o.r.e.e...
0x168e064006c006c000000436f724578697450d.l.l...CorExitP
⋯7 more rows

No evidence locations were recorded for this file. Raw result