Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior(github.com)
github.com
Neovim tee.exe binary dependency exhibiting illegitimate / unauthorized behavior
https://github.com/neovim/neovim/issues/32431
13 comments
Probably Windows checking certificate revocation on a signed binary (or linked library).
Yeah, I'm inclined to agree. The binaries were probably built by mingw and I've seen "hello world" get flagged by virus total when built by mingw.
If it is the binary itself making those calls (and not the OS), then anyone with a little bit of reverse engineering experience should be able to prove it and post the assembly.
Edit: I was wrong about the build toolchain, they were built by visual studio, see comment below.
If it is the binary itself making those calls (and not the OS), then anyone with a little bit of reverse engineering experience should be able to prove it and post the assembly.
Edit: I was wrong about the build toolchain, they were built by visual studio, see comment below.
the virustotal report shows the output from detectiteasy in "Details" -> "Basic properties":
DetectItEasy
PE64 Compiler: Microsoft Visual C/C++ (19.14.26715) [C++] Linker: Microsoft Linker (14.00.24241) Tool: Visual Studio (2015)
this is not meant to imply anything about whether the binary is malicious or not.
this is not meant to imply anything about whether the binary is malicious or not.
karlgkk(1)
The potentially malicious IP is owned by akamai. Not sure why tee would want to talk out
https://www.whois.com/whois/23.216.147.64
https://www.whois.com/whois/23.216.147.64
It's not.
This is almost certainly Windows performing certificate validation.
The "evidence" was just copy pasted from VirusTotal. In fact he forgot to copy from below the cut, which would have shown it also called out to www.microsoft.com - depending who you ask, definitely a malicious address!
VirusTotal just notes all network traffic during the time the binary executed in the sandbox. It doesn't mean it emanated from the binary.
This is almost certainly Windows performing certificate validation.
The "evidence" was just copy pasted from VirusTotal. In fact he forgot to copy from below the cut, which would have shown it also called out to www.microsoft.com - depending who you ask, definitely a malicious address!
VirusTotal just notes all network traffic during the time the binary executed in the sandbox. It doesn't mean it emanated from the binary.
Is tee.exe supposed to be the normal tee unix tool?
yes, there is also a "cat" executable that is being looked at. In this case it is probably harmless, but I am not sure why they have no source for it. someone suggested it came from gvim.
A proposal in the attached issue suggests just building it from openbsd sources which is probably not the worst place to get source for tee.
A proposal in the attached issue suggests just building it from openbsd sources which is probably not the worst place to get source for tee.
https://www.virustotal.com/gui/file/950eea4e17fa3a7e89fa2c55...