Open-source atomic malware analysis

Analyze another

github.com-matthewtolman-urfave-cli-v2-v2.17.2.zip

ZIP
Verdict: BENIGN
Mal-ecule
O₂(ErXe)H₅(Cm₂Db₂F₈OsPo₂)Md(Bk)
Size 3.4 MB download
First seen 4 days ago
Analyzed 2 days ago
Ecosystem go
Source googleusercontent.com
cli.yml github-actions
1 name: Run TestsSource or test deletion target
2 on:
3 push:
83 - run: make set-mkdocs-remote
84 env:
85 MKDOCS_REMOTE_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}Targets GitHub Actions environment
86 - run: make deploy-mkdocs
flag_test.go go
1 package cliBenign DLL side-loading context
17 var boolFlagTests = []struct {
18 name stringValidation vocabulary string
19 expected stringValidation vocabulary expected
20 }{
21 {"help", "--help\t(default: false)"},
32 func TestBoolFlagHelpOutput(t *testing.T) {Go test t.Error method
33 for _, test := range boolFlagTests {Source or test deletion target
34 fl := &BoolFlag{Name: test.name}
35 output := fl.String()
43 func TestBoolFlagApply_SetsAllNames(t *testing.T) {func Test prefix
44 v := false
54 func TestBoolFlagValueFromContext(t *testing.T) {func Test prefix
55 set := flag.NewFlagSet("test", 0)
56 set.Bool("trueflag", true, "doc")Regex component marker
57 set.Bool("falseflag", false, "doc")
58 ctx := NewContext(nil, set, nil)
222 for i, test := range flagTests {
223 defer resetEnv(os.Environ())os.Environ() all environment variables
224 os.Clearenv()
234 Flags: []Flag{test.flag},
235 Action: func(ctx *Context) error {
236 if !reflect.DeepEqual(ctx.Value(test.flag.Names()[0]), test.output) {Repeated Go reflection API usage
237 t.Errorf("ex:%01d expected %q to be parsed as %#v, instead was %#v", i, test.input, test.output
238 }
247 err := a.Run([]string{"run"})Container, K8s, or cloud-metadata context
507 expectedSuffix := " [$APP_FOO]"
508 if runtime.GOOS == "windows" {runtime.GOOS OS detection
509 expectedSuffix = " [%APP_FOO%]"
510 }
2691 parts := strings.Split(value, ",")
2692 if len(parts) != 2 {
2693 return fmt.Errorf("invalid format")Validation vocabulary invalid
2694 }
2773 func TestFlagFromFile(t *testing.T) {
2774 temp, err := ioutil.TempFile("", "urfave_cli_test")Create temporary files (Go)
2775 if err != nil {
2776 t.Error(err)t.Error method call
2777 return
2778 }
2785 _ = temp.Close()
2786 defer func() {
2787 _ = os.Remove(temp.Name())Go file removal capability
2788 }()
build.go go
11 "log"
12 "math"
13 "net/http"net/http package import
14 "net/url"
15 "os"
49 return os.Getwd()Working directory manipulation
50 }()
51 if err != nil {
169 func sh(exe string, args ...string) (string, error) {
170 cmd := exec.Command(exe, args...)C2 communication backend
171 cmd.Stdin = os.StdinShell command execution capability detected
172 cmd.Stderr = os.Stderr
179 func topRunAction(arg string, args ...string) cli.ActionFunc {
180 return func(cCtx *cli.Context) error {
181 os.Chdir(cCtx.Path("top"))os.Chdir working directory change
198 func downloadFile(src, dest string, dirPerm, perm os.FileMode) error {
199 req, err := http.NewRequest(http.MethodGet, src, nil)Creates a new HTTP request
200 if err != nil {
201 return err
202 }
204 resp, err := http.DefaultClient.Do(req)Executes an HTTP request in
205 if err != nil {
206 return err
215 if err := os.MkdirAll(filepath.Dir(dest), dirPerm); err != nil {Create directory tree via os.MkdirAll
216 return err
217 }
219 out, err := os.Create(dest)Create file via os.Create
220 if err != nil {
221 return err
222 }
224 if _, err := io.Copy(out, resp.Body); err != nil {Copy data via io.Copy
225 return err
226 }
232 return os.Chmod(dest, perm)Modify permissions via os.Chmod
233 }
278 lineBytes, err := os.ReadFile(filename)Read file contents via os.ReadFile
279 if err != nil {
280 return err
287 if err := os.Remove(filename); err != nil {Go file removal capability
288 return err
289 }
290 }
json_command_test.go go
1 package altsrcBenign DLL side-loading context
12 const (
13 fileName = "current.json"
14 simpleJSON = `{"test": 15, "testb": false}`Source or test deletion target
15 nestedJSON = `{"top": {"test": 15}}`
16 )
18 func TestCommandJSONFileTest(t *testing.T) {Go testing package
19 cleanup := writeTempFile(t, fileName, simpleJSON)
20 defer cleanup()
54 func TestCommandJSONFileTestGlobalEnvVarWins(t *testing.T) {func Test prefix
55 cleanup := writeTempFile(t, fileName, simpleJSON)
89 func TestCommandJSONFileTestGlobalEnvVarWinsNested(t *testing.T) {func Test prefix
90 cleanup := writeTempFile(t, fileName, nestedJSON)
320 func writeTempFile(t *testing.T, name string, content string) func() {
321 if err := ioutil.WriteFile(name, []byte(content), 0666); err != nil {Go output file writer
322 t.Fatalf("cannot write %q: %v", name, err)
323 }
324 return func() {
325 if err := os.Remove(name); err != nil {Go file removal capability
326 t.Errorf("cannot remove %q: %v", name, err)
327 }
github.com-matthewtolman-urfave-cli-v2-v2.17.2.zip zip
0x0 504b0304140008000800000000000000 PK..............actions/checkout workflow step
0x10 00000000000000000000360000006769 ..........6...gi
0x20 746875622e636f6d2f6d617474686577 thub.com/matthew
0x30 746f6c6d616e2f7572666176652d636c tolman/urfave-cl
0x40 692f i/
yaml_file_loader.go go
4 "fmt"
5 "io/ioutil"
6 "net/http"net/http package import
7 "net/url"
8 "os"
65 switch u.Scheme {
66 case "http", "https":
67 res, err := http.Get(filePath)Go http.Get call
68 if err != nil {
69 return nil, err
77 return nil, fmt.Errorf("Cannot read from file: '%s' because it does not exist.", filePath)
78 }
79 return ioutil.ReadFile(filePath)Read file contents via ioutil.ReadFile
80 } else if runtime.GOOS == "windows" && strings.Contains(u.String(), "\\") {runtime.GOOS OS detection
81 // on Windows systems u.Path is always empty, so we need to check the string directly.
82 if _, notFoundFileErr := os.Stat(filePath); notFoundFileErr != nil {
flag_uint_slice.go go
50 if strings.HasPrefix(value, slPfx) {
51 // Deserializing assumes overwrite
52 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &i.slice)Go JSON unmarshal call
53 i.hasBeenSet = true
54 return nil
83 // Serialize allows UintSlice to fulfill Serializer
84 func (i *UintSlice) Serialize() string {
85 jsonBytes, _ := json.Marshal(i.slice)Go JSON marshal call
86 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
87 }
flag_float64_slice.go go
39 if strings.HasPrefix(value, slPfx) {
40 // Deserializing assumes overwrite
41 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &f.slice)Go JSON unmarshal call
42 f.hasBeenSet = true
43 return nil
67 // Serialize allows Float64Slice to fulfill Serializer
68 func (f *Float64Slice) Serialize() string {
69 jsonBytes, _ := json.Marshal(f.slice)Go JSON marshal call
70 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
71 }
flag_string_slice.go go
39 if strings.HasPrefix(value, slPfx) {
40 // Deserializing assumes overwrite
41 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &s.slice)Go JSON unmarshal call
42 s.hasBeenSet = true
43 return nil
58 // Serialize allows StringSlice to fulfill Serializer
59 func (s *StringSlice) Serialize() string {
60 jsonBytes, _ := json.Marshal(s.slice)Go JSON marshal call
61 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
62 }
flag_int_slice.go go
50 if strings.HasPrefix(value, slPfx) {
51 // Deserializing assumes overwrite
52 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &i.slice)Go JSON unmarshal call
53 i.hasBeenSet = true
54 return nil
79 // Serialize allows IntSlice to fulfill Serializer
80 func (i *IntSlice) Serialize() string {
81 jsonBytes, _ := json.Marshal(i.slice)Go JSON marshal call
82 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
83 }

Showing the top 10 files for legibility — 6 more files (37 results) hidden. Open a file directly to see its full context.

Well-known

Objectives

suspicious severity, 90% confident.
evasion/masquerade/process Go assigns argv zero

Micro-behaviors

notable severity, 80% confident.
fs/file/write Write file via ioutil.WriteFile
notable severity, 90% confident.
process/create/shell PowerShell Invoke-Expression cmdlet

Metadata

20 of 45 traits shown

Identity

SHA-256 420b8a3c3558bfe992fe59d53a3b0448e4a5113189aa2e8956f1442b856ca1a9
Canonical SHA-256 010db4d066435dc085eabd096592d369949ded124b33e4f551d7a10541dcaf67
Filename github.com-matthewtolman-urfave-cli-v2-v2.17.2.zip
Package github.com
Version v2.17.2

Origin

Source harvest
Feed pkg.go.dev
Ecosystem go
Domain googleusercontent.com

Timeline

First seen 11 Jun 2026 19:53 UTC
First analyzed 13 Jun 2026 16:23 UTC
Last analyzed 13 Jun 2026 16:23 UTC
Last updated 13 Jun 2026 16:23 UTC

Labeling

Label unknown
Label source harvest
Traits version 40f6c