Hostile ^92% Download

abdc8f915c149e5ca265a40dbafa59b92159a1d40478ced199e4e384060cbe3f.elf

packed, stripped, self-mapping

Sectionless ELF direct-syscall memory unpackerSectionless ELF with multiple packing indicators

SHA-256abdc8f915c149e5ca265a40dbafa59b92159a1d40478ced199e4e384060cbe3f

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Sectionless ELF direct-syscall memory unpacker 0x0–0x160

0x07f454c46020101000000000000000000.ELF............
0x1003003e00010000005835130200000000..>.....X5......
0x2040000000000000000000000000000000@...............
0x3000000000400038000300400000000000[email protected]...@.....
0x4001000000050000000000000000000000................
0x5000000000000000000000000000000000................
0x60a647130200000000a647130200000000.G.......G......
0x7000100000000000000100000006000000................
⋯15 more rows

English function-word token "the" 0x1f203d–0x1f20cd

0x1f203db52f69dd5b19bb915276d8ec51c3d159./i.[...Rv..Q..Y
0x1f204d04f2d39e039a71613aff0912eaceb032......qa:......2
0x1f205d1121b5c569f2ffd8ecba4f504a31060a.!..i.....OPJ1..
0x1f206d5468653a956b6da0e2ad6acb55bc82e9The:.km...j.U...
0x1f207d105ad67b180497cb33632ab63e3fc9fd.Z.{....3c*.>?..
⋯5 more rows

AI PyTorch or SafeTensors extension 0x188d4f8–0x188d5b8

⋯3 more rows
0x188d5281085fbacb8902fdf6b85d0d2d9cc93f4....../.k.......
0x188d538422e7074b7b0f133d600aa057ebe5d89B.pt...3....~.].
0x188d548937d65dd862898fec6201b3feb08d9e1.}e..(... .?....
⋯7 more rows

PROT_WRITE memory protection constant 0x2133fbc–0x213407c

⋯3 more rows
0x2133fec5ae8be00000050524f545f455845437cZ.....PROT_EXEC|
0x2133ffc50524f545f5752495445206661696c65PROT_WRITE faile
0x213400c642e0a000a0000000000000000000000d...............
⋯7 more rows

x86-64 mmap syscall in sectionless code 0x2134093–0x2134273

⋯7 more rows
0x2134103c94183c8ff6a22415a525e6a035a29ff.A...j"AZR^j.Z).
0x21341136a09580f054901c64889442410489744j.X..I..H.D$.H.D
0x21341238b4424086a12415a4c89ee6a09580f05.D$.j.AZL..j.X..
⋯3 more rows
0x2134163ad41904889f75effd5595e5f5d6a055a.A.H..^..Y^_]j.Z
0x21341736a0a580f0541ffe55de840ffffff2f70j.X..A..].@.../p
0x2134183726f632f73656c662f65786500000100roc/self/exe....
0x213419300b3070000060600000e0000001a0300................
⋯14 more rows