Benign go Download

github.com/KitWare/Cmake v4.2.0+incompatible

Source references XOR syntaxGeneric OLE compound-file storage kind
SHA-256edf7e3b78a65c3b9cfd9b7d3bd67948cc6312d1003e00b13f45b1a96cd63313d
MaleculeO(C)Md

Evidence

OLE document embeds executable binary CMakeVSMacros1.vsmacros · 0xcbc0–0xcd70
⋯3 more rows
0xcbf000000000000000000000000000000000................
0xcc004d5a90000300000004000000ffff0000MZ..............
0xcc10b8000000000000004000000000000000........@.......
0xcc2000000000000000000000000000000000................
0xcc3000000000000000000000000080000000................
0xcc400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0xcc5069732070726f6772616d2063616e6e6fis program canno
0xcc60742062652072756e20696e20444f5320t be run in DOS
0xcc706d6f64652e0d0d0a2400000000000000mode....$.......
0xcc80504500004c01020001bf414700000000PE..L.....AG....
0xcc9000000000e0000e210b01080000400000.......!.....@..
0xcca00010000000000000ee54000000200000.........T... ..
0xccb000600000000040000020000000100000.`....@.. ......
0xccc004000000000000000400000000000000................
0xccd000800000001000000000000002000004................
0xcce000001000001000000000100000100000................
0xccf000000000100000000000000000000000................
0xcd00a05400004b0000000000000000000000.T..K...........
⋯7 more rows
C declares a character or byte buffer xxhash.h · lines 436–443
436:16… FILE* stream)
437 * {
438 * XXH32_state_t* state;
439 * unsigned char buf[BUFFER_SIZE];
440 * size_t amt;
441 * XXH32_hash_t hash;
442 *
443 * state = XXH32_createState(); // Create a sta …
Candidate bytes decoded: hex xxhash.h · lines 2387–2389
2387:55… tializers */
2388#define XXH_PRIME64_1 0x9E3779B185EBCA87ULL /*!< 0b1001111000110111011110011011000110000101111010111100101010000111 */
2389#define XXH_PRIME64_2 0xC2B2AE3D27D4EB4FULL /*!< 0b110000101011001010101110 …
Source references XOR syntax xxhash.h · lines 2726–2732
2726:58… ts, and therefore,
2727 * we can ignore the upper 32 bits in the xor.
2728 *
2729 * Thanks to this optimization, XXH3 only requires these features to be efficient:
2730 *
2731 * - Usable unaligned access
2732 * - A …
Source embeds a long hexadecimal byte array xxhash.h · lines 3191–3195
3191:11… 64) static const xxh_u8 XXH3_kSecret[XXH_SECRET_DEFAULT_SIZE] = {
3192 0xb8, 0xfe, 0x6c, 0x39, 0x23, 0xa4, 0x4b, 0xbe, 0x7c, 0x01, 0x81, 0x2c, 0xf7, 0x21, 0xad, 0x1c,
3193 0xde, 0xd4, 0x6d, 0xe9, 0x83, 0x90, 0x97, 0xdb, 0x72, 0x40, 0xa4, 0xa4, 0xb7, 0xb3, 0x67, 0x1f,
3194 0xcb, 0x79, 0xe6, 0x4e, 0xcc, 0xc0, 0xe5, 0x78, 0x82, 0x5a, 0xd0, 0x7d, 0xcc, 0xff, 0x72, 0x21,
3195 0xb8, 0x08, 0x46, 0x74, …

No evidence locations were recorded for this file. Raw result

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.