Benign windows Download

docker-buildx

Signed Docker buildx binary

Obfuscated Go key generationAuthenticode chain CN: Docker Inc

SHA-256bdf356a5f2c8f3efd8a357b1f044860216e15e654a9a7105ca4e5dd5b5697ee4

URLhttps://github.com/docker/buildx/releases/download/v0.37.1/buildx-v0.37.1.windows-arm64.exe#/docker-buildx.exe

MaleculeO(I)H₅(Cm₁₃Cr₉Db₆Os₅Po₅)Md₄(Bi₂Si₄)

Evidence

AES key option for Kerberos authentication 0x171df42–0x171e012

⋯3 more rows
0x171df7209410100000000066167654164640006.A......ageAdd..
0x171df826165734b657900066b65794c656e0006aesKey..keyLen..
0x171df92696e6353657100066369706865720006incSeq..cipher..
0x171dfa2646964485252000672616e646f6d0006didHRR..random..
⋯7 more rows

Uses ciphertext, shared-secret, or trailer terms 0x172fbeb–0x172fcab

⋯3 more rows
0x172fc1b7274000a76657269667944617461000art..verifyData..
0x172fc2b63697068657274657874010a5363616cciphertext..Scal
0x172fc3b61724d756c74010a5261775375626a65arMult..RawSubje
⋯7 more rows

Cipher terminology near CTR or counter mode 0x1736c4c–0x1736d6c

⋯5 more rows
0x1736c9c616e010b507265636f6d707574656400an..Precomputed.
0x1736cac0b2a6369706865722e637472000b2a63.*cipher.ctr..*c
0x1736cbc69706865722e636662000b2a63697068ipher.cfb..*ciph
0x1736ccc65722e636263000b2a5b36305d75696eer.cbc..*[60]uin
0x1736cdc743332000b7072656669785265616479t32..prefixReady
0x1736cec010b2a7263342e436970686572000b6f..*rc4.Cipher..o
0x1736cfc70656e47656e65726963000b7365616cpenGeneric..seal
⋯7 more rows

References the OAuth 2 protocol 0x1740c7e–0x1740d3e

⋯3 more rows
0x1740cae4465766963654175746855524c010d2aDeviceAuthURL..*
0x1740cbe6f61757468322e416c696173000d2a5boauth2.Alias..*[
0x1740cce5d2a6e65742e49504e6574000d707265]*net.IPNet..pre
⋯7 more rows

Obfuscated Go key generation 0x2734e2c–0x2734f6c

⋯5 more rows
0x2734e7c6e4d61696c2f676f2d63727970746f2fnMail/go-crypto/
0x2734e8c6269746375727665732e282a42697443bitcurves.(*BitC
0x2734e9c75727665292e47656e65726174654b65urve).GenerateKe
0x2734eac79006769746875622e636f6d2f50726fy.github.com/Pro
0x2734ebc746f6e4d61696c2f676f2d6372797074tonMail/go-crypt
⋯11 more rows