Benign windows Download

KDE.Ark

Signed legitimate KDE Ark release bundle

Archive contains path traversal entries (zip slip).rdata significantly larger than .text

SHA-256e7951a6a2d9d9f7d0c4fbb866f1d4ece4a8a03236a9cd68ef7fdd7f9179f7364

URLhttps://cdn.kde.org/ci-builds/utilities/ark/release-26.08/windows/ark-release_26.08-2697-windows-cl-msvc2022-x86_64.exe

MaleculeK₆(Am₃GaLi₂₈Lu₂Mc₆Te₈)O₁₃(Al₇As₁₉C₂₇Ca₂Co₃Dy₅Er₁₆I₁₀LaP₆Pr₂S₅Xe₅)H₁₁(Cm₆₄Cr₂₂Db₄₆Ds₂F₄₈Hf₁₄Mg₅Os₅₇Po₄₉Ti₃U₁₁)Md₈(Bi₃₄Bk₆InPa₅Pt₃Si₅)

Evidence

NSIS self-extracting installer 0x2521–0x25f1

⋯3 more rows
0x25512e00008b45d8a9f0ffffff7572817ddc....E......ur.}.
0x2561efbeadde7569817de8496e7374756081....ui.}.Instu`.
0x25717de4736f66747557817de04e756c6c75}.softuW.}.Nullu
0x25814e0945088b45088b0d18ea410083e002N.E..E.....A....
⋯7 more rows

ExitWindowsEx shutdown/restart API symbol 0x80e0–0x8300

⋯3 more rows
0x81107061636557000a02476c6f62616c556epaceW...GlobalUn
0x81206c6f636b00000302476c6f62616c4c6flock....GlobalLo
0x8130636b00006f0043726561746554687265ck..o.CreateThre
0x81406164000071014765744c617374457272ad..q.GetLastErr
⋯10 more rows
0x81f047657453797374656d4469726563746fGetSystemDirecto
0x820072795700a00147657450726f63416464ryW...GetProcAdd
0x82107265737300007f014765744d6f64756cress....GetModul
0x82206548616e646c654100005a0147657445eHandleA..Z.GetE
⋯14 more rows

NSIS runtime error URL in data 0x8410–0x8540

⋯3 more rows
0x844072003a00200025006400250025000000r.:. .%.d.%.%...
0x845049006e007300740061006c006c006500I.n.s.t.a.l.l.e.
0x84607200200069006e007400650067007200r. .i.n.t.e.g.r.
0x847069007400790020006300680065006300i.t.y. .c.h.e.c.
0x84806b002000680061007300200066006100k. .h.a.s. .f.a.
0x849069006c00650064002e00200043006f00i.l.e.d... .C.o.
0x84a06d006d006f006e002000630061007500m.m.o.n. .c.a.u.
0x84b0730065007300200069006e0063006c00s.e.s. .i.n.c.l.
0x84c07500640065000a0069006e0063006f00u.d.e...i.n.c.o.
0x84d06d0070006c0065007400650020006400m.p.l.e.t.e. .d.
⋯7 more rows

NSIS runtime error title in data 0x867c–0x873c

⋯3 more rows
0x86ac000000004e0043005200430000000000....N.C.R.C.....
0x86bc4e005300490053002000450072007200N.S.I.S. .E.r.r.
0x86cc6f007200000000000000000045007200o.r.........E.r.
⋯7 more rows

NSIS exehead assembly manifest 0x25de8–0x25f18

⋯3 more rows
0x25e18010000000000010020006c3c00000300........ .l<....
0x25e283c3f786d6c2076657273696f6e3d2231<?xml version="1
0x25e382e302220656e636f64696e673d225554.0" encoding="UT
0x25e48462d3822207374616e64616c6f6e653dF-8" standalone=
0x25e5822796573223f3e3c617373656d626c79"yes"?><assembly
0x25e6820786d6c6e733d2275726e3a73636865 xmlns="urn:sche
0x25e786d61732d6d6963726f736f66742d636fmas-microsoft-co
0x25e886d3a61736d2e763122206d616e696665m:asm.v1" manife
0x25e98737456657273696f6e3d22312e30223estVersion="1.0">
0x25ea83c617373656d626c794964656e746974<assemblyIdentit
⋯7 more rows