Benign windows Download

bazel-buildtools

“Developer tools for working with Google's bazel buildtool.”

Binary contains high-entropy data regionsGo runtime symbol presence

SHA-256aeffa5a342ce119b52cd7aa17bd9dda22b0406245d90643985749d01f51d2de1

URLhttps://github.com/bazelbuild/buildtools/releases/download/v10.1.0/buildifier-windows-arm64.exe#/buildifier.exe

MaleculeO₃(AsCDy)H₇(Cm₂Db₂F₂HfMgOs₆Po₆)Md₂(Bi₃Pt)

Evidence

Large PE with elevated code entropy 0x5c0–0x870

⋯3 more rows
0x5f000000000000000000000000000000000................
0x600ff20476f206275696c642049443a2022. Go build ID: "
0x6107265646163746564220a20ff00000000redacted". .....
0x620900b40f9f10305d13f0210eb690e0054..@.....?...i..T
0x630f40307d19dfa3fa99f020091fd2300d1......?......#..
0x640e0e700f98f2f0194401500f000c02491...../..@.....$.
0x650a10080d243320194aa2f0194e0a30291....C2.../......
0x660e1e740f9304440ad104400ad304441ad[email protected]@..D..0DA.
0x670104401ad304442ad104402ad304443ad.D..0DB..D..0DC.
0x680104403ade2031faa0d000014e29700f9.D..............
0x690007862f8e01300f97a2f0194f12f0194.xb.....z/.../..
0x6a0e01340f993300194962f0194e09740f9[email protected].../....@.
0x6b002040091e0a30291e1e740f95f4000f1..........@._@..
0x6c06bfeff546f2f0194f62f01948d2f0194k..To/.../.../..
0x6d06c2f01946015009000f40591e10b40b2l/..`.........@.
0x6e020320194872f0194e0e740f901000291 2.../....@.....
0x6f0e2a30091304440ad504400ad304441ad[email protected].
0x700504401ad304442ad504402ad304443adPD..0DB.PD..0DC.
0x710504403ade1031faa0d000014e19700f9PD..............
0x720407861f8e00f00f9562f0194cd2f0194@xa.....V/.../..
0x730e00f40f96f300194722f0194e09740f9[email protected]/....@.
0x74001040091e0e740f9e2a300913f4000f1......@.....?@..
0x7506bfeff544b2f0194d22f0194692f0194k..TK/.../..i/..
0x760482f0194401500f000d42491a10080d2H/..@.....$.....
0x770fc310194632f0194e0e740f900000491.1..c/....@.....
0x780e1e30491104440ad304400ad104441ad[email protected].
0x790304401ad104442ad304402ad104443ad0D...DB.0D...DC.
0x7a0304403ade0031faa0c000014e09700f90D..............
0x7b0207860f8e09b00f9322f0194a92f0194 x`.....2/.../..
0x7c0e09b40f9bf3101944e2f0194e09740f9[email protected]/....@.
0x7d000040091e1e304911f4000f18bfeff54[email protected]
0x7e0282f0194af2f0194462f0194fdfb7fa9(/.../..F/......
0x7f0ff030791c0035fd6e00700f9e3031eaa......_.........
0x800240e0294e00740f986ffff1700000000$.....@.........
0x810900b40f9ff6330eb09030054fe0f1ef8[email protected]....
0x820fd831ff8fd2300d15f2000f1a8010054.....#.._ .....T
0x830820100b4430400d15f0003ea21010054....C..._...!..T
0x8401b0080393f4000f1a2000054000c018b[email protected]....
0x850fd835ff8fe0742f8c0035fd68d160294.._...B..._.....
0x860e02d00b000803291611600b021000d91.-....2.a...!...
0x870ecfb01941f2003d5e08700a9e20f00f9..... ..........

ToUnicodeEx P/Invoke string reference 0x2adcd5–0x2addd5

⋯7 more rows
0x2add456d57696e646f77734d65737361676542mWindowsMessageB
0x2add556f7857546f556e69636f64654578222doxWToUnicodeEx"-
0x2add65496e66696e6974792244455245464552Infinity"DEREFER
⋯7 more rows

Thread32Next API string 0x2ae60b–0x2ae76b

⋯13 more rows
0x2ae6db72726f724d6f64655365745374644861rrorModeSetStdHa
0x2ae6eb6e646c6554687265616433324e657874ndleThread32Next
0x2ae6fb5669727475616c416c6c6f63436f4372VirtualAllocCoCr
⋯7 more rows

ShellExecute API call 0x2aede7–0x2aeef7

⋯3 more rows
0x2aee1763655747657444726976655479706557ceWGetDriveTypeW
0x2aee2754687265616433324669727374576169Thread32FirstWai
0x2aee3774436f6d6d4576656e744e7451756572tCommEventNtQuer
0x2aee4779456146696c6552746c496e69745374yEaFileRtlInitSt
0x2aee5772696e67436f5461736b4d656d467265ringCoTaskMemFre
0x2aee6765456e756d50726f6365737365735368eEnumProcessesSh
0x2aee77656c6c45786563757465574578697457ellExecuteWExitW
0x2aee87696e646f77734578476574436c617373indowsExGetClass
⋯7 more rows

Hidden VirtualProtect string reference 0x2af719–0x2af8c9

⋯6 more rows
0x2af7796e206f7074696f6e436f6e74726f6c53n optionControlS
0x2af78965727669636543726561746553657276erviceCreateServ
0x2af79969636557497357656c6c4b6e6f776e53iceWIsWellKnownS
0x2af7a969644d616b654162736f6c7574655344idMakeAbsoluteSD
⋯7 more rows
0x2af829536574436f6e736f6c654d6f64655369SetConsoleModeSi
0x2af8397a656f665265736f7572636556697274zeofResourceVirt
0x2af84975616c50726f74656374566972747561ualProtectVirtua
0x2af8596c51756572794578436f496e69746961lQueryExCoInitia
⋯7 more rows