Open-source atomic malware analysis

Analyze another

github.com-matthewtolman-urfave-cli-v2-v2.4.2.zip

ZIP
Verdict: BENIGN
Mal-ecule
O(Xe₂)H₅(CmDb₂F₄OsPo₂)Md(Bk)
Size 3.3 MB download
First seen 4 days ago
Analyzed 3 days ago
Ecosystem go
Source googleusercontent.com
build.go go
31 },
32 {
33 Name: "test",Source or test deletion target
34 Action: TestActionFunc,
35 },
56 func runCmd(arg string, args ...string) error {
57 cmd := exec.Command(arg, args...)C2 communication backend
59 cmd.Stdin = os.StdinShell command execution capability detected
60 cmd.Stdout = os.Stdout
61 cmd.Stderr = os.Stderr
70 func TestActionFunc(c *cli.Context) error {func Test prefix
71 for _, pkg := range packages {
72 var packageName string
94 for _, pkg := range packages {
95 file, err := os.Open(fmt.Sprintf("%s.coverprofile", pkg))Open file via os.Open
96 if err != nil {
97 return err
111 err = os.Remove(fmt.Sprintf("%s.coverprofile", pkg))Go file removal capability
112 if err != nil {
113 return err
117 outFile, err := os.Create("coverage.txt")Create file via os.Create
118 if err != nil {
119 return err
flag_test.go go
1 package cliBenign DLL side-loading context
17 var boolFlagTests = []struct {
18 name stringValidation vocabulary string
19 expected stringValidation vocabulary expected
20 }{
21 {"help", "--help\t(default: false)"},
32 func TestBoolFlagHelpOutput(t *testing.T) {Go test t.Error method
33 for _, test := range boolFlagTests {Source or test deletion target
34 fl := &BoolFlag{Name: test.name}
35 output := fl.String()
43 func TestBoolFlagApply_SetsAllNames(t *testing.T) {func Test prefix
44 v := false
54 func TestFlagsFromEnv(t *testing.T) {func Test prefix
55 newSetFloat64Slice := func(defaults ...float64) Float64Slice {
132 for i, test := range flagTests {
133 defer resetEnv(os.Environ())os.Environ() all environment variables
134 os.Clearenv()
135 envVarSlice := reflect.Indirect(reflect.ValueOf(test.flag)).FieldByName("EnvVars").Slice(0, 1)Repeated Go reflection API usage
136 _ = os.Setenv(envVarSlice.Index(0).String(), test.input)
148 err := a.Run([]string{"run"})Container, K8s, or cloud-metadata context
211 expectedSuffix := " [$APP_FOO]"
212 if runtime.GOOS == "windows" {runtime.GOOS OS detection
213 expectedSuffix = " [%APP_FOO%]"
214 }
1751 parts := strings.Split(value, ",")
1752 if len(parts) != 2 {
1753 return fmt.Errorf("invalid format")Validation vocabulary invalid
1754 }
1833 func TestFlagFromFile(t *testing.T) {
1834 temp, err := ioutil.TempFile("", "urfave_cli_test")Create temporary files (Go)
1835 if err != nil {
1836 t.Error(err)t.Error method call
1837 return
1838 }
1845 _ = temp.Close()
1846 defer func() {
1847 _ = os.Remove(temp.Name())Go file removal capability
1848 }()
yaml_file_loader.go go
4 "fmt"
5 "io/ioutil"
6 "net/http"net/http package import
7 "net/url"
8 "os"
67 switch u.Scheme {
68 case "http", "https":
69 res, err := http.Get(filePath)Go http.Get call
70 if err != nil {
71 return nil, err
79 return nil, fmt.Errorf("Cannot read from file: '%s' because it does not exist.", filePath)
80 }
81 return ioutil.ReadFile(filePath)Read file contents via ioutil.ReadFile
82 } else if runtime.GOOS == "windows" && strings.Contains(u.String(), "\\") {runtime.GOOS OS detection
83 // on Windows systems u.Path is always empty, so we need to check the string directly.
84 if _, notFoundFileErr := os.Stat(filePath); notFoundFileErr != nil {
flag.go go
243 suffix := ""
244 sep := ", $"
245 if runtime.GOOS == "windows" {runtime.GOOS OS detection
246 prefix = "%"
247 suffix = "%"
289 func flagValue(f Flag) reflect.Value {Repeated Go reflection API usage
290 fv := reflect.ValueOf(f)
291 for fv.Kind() == reflect.Ptr {
436 for _, fileVar := range strings.Split(filePath, ",") {
437 if fileVar != "" {
438 if data, err := ioutil.ReadFile(fileVar); err == nil {Read file contents via ioutil.ReadFile
439 return string(data), true
440 }
json_source_context.go go
52 func NewJSONSource(data []byte) (InputSourceContext, error) {
53 var deserialized map[string]interface{}
54 if err := json.Unmarshal(data, &deserialized); err != nil {Go JSON unmarshal call
55 return nil, err
56 }
flag_int64_slice.go go
22 // clone allocate a copy of self objectValidation vocabulary object
23 func (i *Int64Slice) clone() *Int64Slice {
24 n := &Int64Slice{
32 // Set parses the value into an integer and appends it to the list of values
33 func (i *Int64Slice) Set(value string) error {Validation vocabulary string
34 if !i.hasBeenSet {
35 i.slice = []int64{}
39 if strings.HasPrefix(value, slPfx) {
40 // Deserializing assumes overwrite
41 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &i.slice)Go JSON unmarshal call
42 i.hasBeenSet = true
43 return nil
61 // Serialize allows Int64Slice to fulfill Serializer
62 func (i *Int64Slice) Serialize() string {
63 jsonBytes, _ := json.Marshal(i.slice)Go JSON marshal call
64 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
65 }
82 EnvVars []string
83 FilePath string
84 Required boolValidation vocabulary required
85 Hidden bool
86 Value *Int64Slice
toml_file_loader.go go
17 m := i.(map[string]interface{})
18 for key, val := range m {
19 v := reflect.ValueOf(val)Repeated Go reflection API usage
20 switch v.Kind() {
21 case reflect.Bool:
flag_int_slice.go go
22 // clone allocate a copy of self objectValidation vocabulary object
23 func (i *IntSlice) clone() *IntSlice {
24 n := &IntSlice{
43 // Set parses the value into an integer and appends it to the list of values
44 func (i *IntSlice) Set(value string) error {Validation vocabulary string
45 if !i.hasBeenSet {
46 i.slice = []int{}
50 if strings.HasPrefix(value, slPfx) {
51 // Deserializing assumes overwrite
52 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &i.slice)Go JSON unmarshal call
53 i.hasBeenSet = true
54 return nil
72 // Serialize allows IntSlice to fulfill Serializer
73 func (i *IntSlice) Serialize() string {
74 jsonBytes, _ := json.Marshal(i.slice)Go JSON marshal call
75 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
76 }
93 EnvVars []string
94 FilePath string
95 Required boolValidation vocabulary required
96 Hidden bool
97 Value *IntSlice
flag_float64_slice.go go
22 // clone allocate a copy of self objectValidation vocabulary object
23 func (f *Float64Slice) clone() *Float64Slice {
24 n := &Float64Slice{
32 // Set parses the value into a float64 and appends it to the list of values
33 func (f *Float64Slice) Set(value string) error {Validation vocabulary string
34 if !f.hasBeenSet {
35 f.slice = []float64{}
39 if strings.HasPrefix(value, slPfx) {
40 // Deserializing assumes overwrite
41 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &f.slice)Go JSON unmarshal call
42 f.hasBeenSet = true
43 return nil
60 // Serialize allows Float64Slice to fulfill Serializer
61 func (f *Float64Slice) Serialize() string {
62 jsonBytes, _ := json.Marshal(f.slice)Go JSON marshal call
63 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
64 }
81 EnvVars []string
82 FilePath string
83 Required boolValidation vocabulary required
84 Hidden bool
85 Value *Float64Slice
flag_string_slice.go go
10 // StringSlice wraps a []string to satisfy flag.ValueValidation vocabulary string
11 type StringSlice struct {
12 slice []string
21 // clone allocate a copy of self objectValidation vocabulary object
22 func (s *StringSlice) clone() *StringSlice {
23 n := &StringSlice{
38 if strings.HasPrefix(value, slPfx) {
39 // Deserializing assumes overwrite
40 _ = json.Unmarshal([]byte(strings.Replace(value, slPfx, "", 1)), &s.slice)Go JSON unmarshal call
41 s.hasBeenSet = true
42 return nil
55 // Serialize allows StringSlice to fulfill Serializer
56 func (s *StringSlice) Serialize() string {
57 jsonBytes, _ := json.Marshal(s.slice)Go JSON marshal call
58 return fmt.Sprintf("%s%s", slPfx, string(jsonBytes))
59 }
76 EnvVars []string
77 FilePath string
78 Required boolValidation vocabulary required
79 Hidden bool
80 TakesFile bool

Showing the top 10 files for legibility — 4 more files (18 results) hidden. Open a file directly to see its full context.

Objectives

Micro-behaviors

notable severity, 80% confident.
fs/file/write Write file via ioutil.WriteFile
notable severity, 90% confident.
process/create/shell PowerShell Invoke-Expression cmdlet

Metadata

notable severity, 92% confident.
build actions/checkout workflow step

20 of 42 traits shown

Identity

SHA-256 68564458dd10604afe1152689e5d3b2bcdfeaaea8c178f5f9ae7da701e0ff0ca
Canonical SHA-256 015ba98ca91de2d8566567330d7c5dd7e776c496d7360dd34f76b1d465e31992
Filename github.com-matthewtolman-urfave-cli-v2-v2.4.2.zip
Package github.com
Version v2.4.2

Origin

Source harvest
Feed pkg.go.dev
Ecosystem go
Domain googleusercontent.com

Timeline

First seen 11 Jun 2026 19:53 UTC
First analyzed 12 Jun 2026 06:27 UTC
Last analyzed 12 Jun 2026 06:27 UTC
Last updated 12 Jun 2026 06:27 UTC

Labeling

Label unknown
Label source harvest
Traits version e31a3