Benign Download

android.toolchain.cmake

Script loads from a Google-brand lookalike hostEmbeds a remote script element

SHA-256e8f6578c3b41339bf36e09f29ef76056c8325be933622df964a863f1f4666e8a

URLhttps://android-review.googlesource.com/admin/repos/edit/repo/platform/ndk/branch/refs/heads/ndk-release-r21/file/build/cmake/android.toolchain.cmake

MaleculeH(Cm₃)Md

Evidence

English function-word token "and" lines 6–7

6:56… ial-scale=1, maximum-scale=1, user-scalable=0">
7<noscript>To use PolyGerrit, please enable JavaScript in your browser settings, and then refresh this page.</noscript><script nonce="-yG9EWsvX4QtP0lUBU_GOw">window.polymerSkipLoadingFontRoboto = true; window.CLOSURE_NO_DEPS = true; window.DEFAULT_DETAIL …

Dense neighboring backslash escape sequences line 7

7:501… assets\/pga_20261019.00_p0';window.INITIAL_DATA = JSON.parse('\x7b\x22\/config\/server\/version\x22: \x223.15.0-rc0-23-gc93251f9d6\x22, \x22\/config\/server\/info\x22: \x7b\x22accounts\x22:\x7b\x22visibility\x22:\x22 …

curl output file source line 7

7:1398… asic_auth_policy\x22:\x22HTTP\x22,\x22max_token_lifetime\x22:0\x7d,\x22change\x22:\x7b\x22disable_private_changes\x22:true,\x22update_delay\x22:30,\x22submit_whole_topic\x22:true,\x22mergeability_computation_behavior\x22:\x22NEVER\x22\x7d,\x22download\x22:\x7b\x22schemes\x22:\x7b\x22repo\x22:\x7b\x22url\x22:\x22$\x7bproject\x7d\x22,\x22is_auth_supported\x22:true,\x22commands\x22:\x7b\x7d,\x22clone_commands\x22:\x7b\x22Clone with commit-msg hook\x22:\x22git clone $\x7bproject\x7d \\u0026\\u0026 (cd $\x7bproject-base-name\x7 …

Script loads from a Google-brand lookalike host lines 13–16

13:61… lygerrit_ui/pg_20261019.00_p0/styles/main.css">
14<body unresolved>
15<gr-app id="pg-app"></gr-app>
16<script src="https://cdn.googlesource.com/polygerrit_ui/pg_20261019.00_p0/elements/gr-app.js" crossorigin="anonymous" nonce="-yG9EWsvX4QtP0lUBU_GOw"></script>