Suspicious ^86% windows Download

officecli

Unsigned, embedded PE, C2-like strings

Specific flood attack types.NET Assembly.Load

SHA-256b1da1729b600f231358250f8f998be5f9ea881cb44b3d55d037c6a3e0250ccb9

URLhttps://github.com/iOfficeAI/OfficeCLI/releases/download/v1.0.150/officecli-win-arm64.exe#/officecli.exe

MaleculeK₂(Li₃Mc₃)O₁₁(I₂AlAs₁₅C₁₅CaCoDy₃Er₁₂P₃PrXe₂)H₁₀(Cm₂₉Cr₁₁Db₁₈F₁₅HfMg₂Os₂₄Po₂₅TiU₆)Md₉(Bi₁₇BkPa₂PdPt₄Si₄)Th

Evidence

.NET metadata root signature (BSJB) 0x55d0e0–0x55d1a0

⋯3 more rows
0x55d110f35341a9fd7bc6a8c0035fd61f2003d5.SA..{...._.. ..
0x55d12042534a4201000100570007800e000780BSJB....W.......
0x55d1300e111380000000000000000000000000................
⋯7 more rows

PE imports ordinal 16 by number 0x658fc0–0x6592b0

⋯3 more rows
0x658ff079120000b07b120000f081120000e084y....{..........
0x659000120000a0851200002086120000f08712........ .......
0x6590100000c0881200007089120000308a1200.......p....0...
0x65902000108b120000d08b120000c08c120000................
0x659030508d120000e08e120000409112000000P.........@.....
0x6590409212000060921200006093120000a094....`....`......
0x6590501200005096120000c096120000109812...P............
0x65906000003099120000c099120000109a1200..0.............
0x65907000a09c120000109e12000090a0120000................
0x65908010a112000080a1120000e0a312000020............... 
0x659090a5120000e0a912000030ac12000030ad.........0....0.
0x6590a012000070ae12000030b112000040b312...p....0....@..
0x6590b0000030b5120000e0b612000050b71200..0.........P...
0x6590c00000b9120000f0ba12000060bb120000...........`....
0x6590d0a0bc12000020c112000020c612000010..... .... .....
0x6590e0c8120000f0c812000060cb120000d0cb.........`......
0x6590f012000070cc120000e0cf12000020d012...p......... ..
0x6591000000a0d112000020d312000090e11200....... ........
0x6591100070e212000080e2120000e0e2120000.p..............
0x65912010e312000020e312000080e4120000b0..... ..........
0x659130e412000090e512000070e6120000d0e7.........p......
0x659140120000b0e812000090e912000040eb12.............@..
0x659150000020ec120000b0ee12000090ef1200.. .............
0x65916000b0f012000020f112000090f1120000...... .........
0x65917000f212000070f212000060fc12000010.....p....`.....
0x659180201300000022130000c029130000c02a ...."....)....*
0x65919013000060341300000048130000605513...`4....H...`U.
0x6591a00000505d130000306b130000006c1300..P]...0k....l..
0x6591b000b06c130000b06e130000e06f130000..l....n....o...
0x6591c0c07f130000f080130000b083130000b0................
0x6591d0871300009090130000506b1400009092.........Pk.....
0x6591e0140000a0931400005094140000b09414........P.......
0x6591f000007099140000d09c140000a09e1400..p.............
0x6592000080a914000060b314000090b3140000......`.........
0x659210c0b314000090b4140000a0b414000000................
0x659220b5140000d0b6140000d0bb14000010bc................
0x65923014000020bc14000030bc140000200115... ....0.... ..
0x6592400000a02b150000203415000060341500...+... 4...`4..
0x65925000a034150000703c150000103d150000..4...p<....=...
0x659260403f1500001043150000a04315000090@?....C....C....
0x6592704a150000a04a150000204c150000b04cJ....J... L....L
0x659280150000504d150000a055150000b05515...PM....U....U.
0x6592900000d0561500003059150000905a1500...V...0Y....Z..
0x6592a000b05a150000205b150000805b150000..Z... [....[...
0x6592b0705c1500007061150000506215000090p\...pa...Pb....

References C fopen file-open API 0x659ab8–0x659da8

⋯7 more rows
0x659b280000906a1e0000907e1e0000a07e1e00...j....~....~..
0x659b3800c07e1e0000d07f1e000040871e0000..~........@....
0x659b48808a1e0000a08a1e0000c08a1e000040...............@
0x659b588b1e0000608b1e0000808b1e0000908b....`...........
0x659b681e0000a08b1e0000208c1e0000808c1e........ .......
0x659b780000a08c1e0000d08c1e000050901e00............P...
0x659b8800b0921e0000a0931e0000d0931e0000................
0x659b98f0931e000000941e000010941e000030...............0
0x659ba8941e000050941e000060941e00007095....P....`....p.
0x659bb81e000080951e000030971e000090981e........0.......
0x659bc80000b0991e0000509a1e0000e09b1e00.......P........
⋯30 more rows

Cleartext http:// URL 0x6beaa9–0x6beb99

⋯3 more rows
0x6bead9657465727370726f686962697465643detersprohibited=
0x6beae92022687474703a2f2f64696374696f6e "http://diction
0x6beaf961727970657263657074696f6e726576aryperceptionrev
0x6beb096f6c7574696f6e666f756e646174696folutionfoundatio
0x6beb196e70783b6865696768743a7375636365npx;height:succe
0x6beb29737366756c737570706f72746572736dssfulsupportersm
⋯7 more rows

GET flood terminology 0xf47dc2–0xf47ee2

⋯5 more rows
0xf47e12436861726163746572506572696f6400CharacterPeriod.
0xf47e226765745f466c6f6f64006765745f466cget_Flood.get_Fl
0xf47e326f77436861727450756e636865644361owChartPunchedCa
⋯11 more rows