Benign windows Download

openshift-okd-client 5.0.0-okd-scos.0

Locker worker-thread count flagAmplification chr() payload suffix

Evidence

Large PE with elevated code entropy 0x5c0–0x870
⋯3 more rows
0x5f000000000000000000000000000000000................
0x600ff20476f206275696c642049443a2022. Go build ID: "
0x6106876624f574d4e432d4d516e5a477176hvbOWMNC-MQnZGqv
0x620585052412f4374377a31706469396846XPRA/Ct7z1pdi9hF
0x63042576f326c366b48472f6253745a5f6aBWo2l6kHG/bStZ_j
0x6404571456241596c79617a3766517a2f36EqEbAYlyaz7fQz/6
0x650586137326b7a30434343374969753264Xa72kz0CCC7Iiu2d
0x660495348220a20ffccccccccccccccccccISH". ..........
0x670cccccccccccccccccccccccccccccccc................
0x680493b6610763d554889e54883ec104889I;f.v=UH..H...H.
0x69044242048895c2428e843050000488b44D$ H.\$(.C...H.D
0x6a02420488b5c2428e834000000488b15e5$ H.\$(.4...H...
0x6b0be72064885d27405488b02ffd04883c4.r.H..t.H....H..
0x6c0105dc3488944240848895c2410e8ae07.].H.D$.H.\$....
0x6d00900488b442408488b5c2410eba2cccc..H.D$.H.\$.....
0x6e04c8d6424f84d3b66100f86cb04000055L.d$.M;f.......U
0x6f04889e54883c480488984249000000090H..H...H..$.....
0x700eb064889fb4889d04885db0f84590200..H..H..H....Y..
0x7100031c9eb0348ffc14839d97d0b0fb614.1...H..H9.}....
0x7200880fa2c75efeb0748c7c1ffffffff48...,u...H......H
0x73085c97d0c4889d931ff31d2eb300f1f00..}.H..1.1..0...
0x7404839d90f876b040000488d51014839d3H9...k...H.Q.H9.
0x7500f82590400004829cb488d73ff4889f7..Y...H).H.s.H..
0x76048f7de48c1fe3f4821f24801c24883f9H..H..?H!.H..H..
0x770047c8f81386370752e758731dbeb0348.|..8cpu.u.1...H
0x780ffc34839cb7d0c0fb634184080fe3d75..H9.}...4.@..=u
0x790eeeb0748c7c3ffffffff48897c245048...H......H.|$PH
0x7a0895424704885db0f8c670100004839cb.T$pH....g...H9.
0x7b00f87f4030000660f1f84000000000090......f.........
0x7c04883fb040f82db030000488d73fc4989H.........H.s.I.
0x7d0f048f7de48c1fe3f83e6044c8d4b014c.H..H..?...L.K.L
0x7e08d14304c39c90f82b30300004c894424..0L9.......L.D$
0x7f0484c895424604829d94c8d59ff4c895cHL.T$`H).L.Y.L.\
0x80024204d89dc49f7db49c1fb3f4d21d94e$ M..I..I..?M!.N
0x8108d1c084c895c24584883f9037513460f...L.\$XH...u.F.
0x820b70c08664181f96f6e757a4883f903eb...fA..onuzH....
0x830274883f904756e460fb72c080f1f4000'H...unF..,...@.
0x840664181fd6f66755d460fb64c08024180fA..ofu]F..L..A.
0x850f96675514883f903410f94c10f1f4000.fuQH...A.....@.
0x8604883fb077526440fb71c30664181fb61H...u&D...0fA..a
0x8706c75190fb67430024080fe6c750e488b[email protected].
ChaCha quarter-round rotation schedule 0x2cbf86–0x2cc046
0x2cbf862c44895c2450807879000f857c010000,D.\$P.xy...|...
0x2cbf964c898c24300100004c89842428010000L..$0...L..$(...
0x2cbfa64889b424200100004889bc2418010000H..$ ...H..$....
0x2cbfb648899c24080100008d9a6e64203331cbH..$......nd 31.
0x2cbfc6c1c310418d4c1d00894c247c31d1c1c1...A.L...L$|1...
0x2cbfd60c448d2c0a458dad6e6420334431ebc1.D.,.E..nd 3D1..
0x2cbfe6c3088b54247c01da31d1c1c107418db2...T$|..1....A..
0x2cbff6322d62794431e6c1c610458d243744892-byD1....E.$7D.
0x2cc0066424784531d441c1c40c478d3c22458dd$xE1.A...G.<"E.
0x2cc016bf322d62794431fec1c608448b542478.2-byD1....D.T$x
0x2cc0264101f24531d441c1c4078b7c2440448dA..E1.A....|$@D.
0x2cc036877465206b4531d841c1c010448b5c24.te kE1.A...D.\$
0x2cc0465c4501c344895c24744131 \E..D.\$tA1
Binary contains locker encryption vocabulary 0x2edad91–0x2edadf1
0x2edad915d6e65742e6e7373437269746572696f]net.nssCriterio
0x2edada16e00132a66756e6328292073796e632en..*func() sync.
0x2edadb14c6f636b657201134669727374556e69Locker..FirstUni
0x2edadc163617374416464726573730113466972castAddress..Fir
⋯3 more rows
Locker worker-thread count flag 0x3b5fa3c–0x3b5fb5c
⋯5 more rows
0x3b5fa8c6c6c65642047435320526567696f6e2elled GCS Region.
0x3b5fa9c656e6372797074207370656369666965encrypt specifie
0x3b5faac73207768657468657220746865207265s whether the re
⋯11 more rows
Thread-count option marker 0x3b5ffef–0x3b6010f
⋯5 more rows
0x3b6003f2072756e20606e73656e746572202d61 run `nsenter -a
0x3b6004f202d742031602e0a7468652074616720 -t 1`..the tag
0x3b6005f257120706f696e747320746f20746865%q points to the
⋯11 more rows

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.