Hostile ^93% windows Download

Download_Movie_Maker_2.6_For_Windows_7.exe

Obfuscated Go dropper, self-signed

Go PE hides path and resolves Win32 via SyscallNObfuscated Go PE with renamed main symbols

SHA-2560bb70961853f4ce36650d296b7e945e0dda5a9ac2964e7a217cc35bbfbb1f253

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

Obfuscated Go PE with renamed main symbols 0x21580e–0x21592e

⋯5 more rows
0x21585e000b2a66756e63282920696e74010b2a..*func() int..*
0x21586e6d61696e2e44414e3065000b70304932main.DAN0e..p0I2
0x21587e5635786b725169000b65554838437652V5xkrQi..eUH8CvR
⋯11 more rows

Randomized Go main package symbol names 0x2abca4–0x2abea4

⋯5 more rows
0x2abcf4426a4d312e5735333764517965314400BjM1.W537dQye1D.
0x2abd046d61696e2e5048633276484c74006d61main.PHc2vHLt.ma
0x2abd14696e2e282a4649316f504b4a52495953in.(*FI1oPKJRIYS
0x2abd2469356d292e426a3936326e6e5143306di5m).Bj962nnQC0m
0x2abd34006d61696e2e6d4971307a6f4d6c6a4c.main.mIq0zoMljL
0x2abd4439006d61696e2e6933506357384d42739.main.i3PcW8MBs
0x2abd5442006d61696e2e736763695163793159B.main.sgciQcy1Y
0x2abd64006d61696e2e6f33446356514551616d.main.o3DcVQEQam
0x2abd7438664c006d61696e2e754f73596179428fL.main.uOsYayB
⋯3 more rows
0x2abdb461696e2e6f5174526f006d61696e2e75ain.oQtRo.main.u
0x2abdc432334f385a6734734f343836006d616923O8Zg4sO486.mai
0x2abdd46e2e625933746976723843774f68524en.bY3tivr8CwOhRN
0x2abde4006d61696e2e706b524668596a52444b.main.pkRFhYjRDK
0x2abdf4006d61696e2e654870376a6f5569006d.main.eHp7joUi.m
⋯11 more rows

Go PE hides path and resolves Win32 via SyscallN 0x3370f0–0x3372d0

⋯13 more rows
0x3371c036085608f308040a140a180a7f0eaa0e6.V.............
0x3371d0bd103511e0111212871289128e129e12..5.............
0x3371e004132913311334133a135c1414191719..).1.4.:.\.....
0x3371f03619091c371ca81c071d0a1d3b1d3e1d6...7.......;.>.
0x337200661d691d8f1d921d111f6f245f6abf6af.i.......o$_j.j
0x3372105a6b626bf4affcafffaf55d49dd4add4Zkbk......U.....
0x337220bad4bcd4c4d406d515d51dd53ad53fd5............:.?.
0x33723045d551d5a0da07e022e025e0e7e7ece7E.Q.....".%.....
0x337240efe7ffe704ee20ee23ee28ee33ee38ee...... .#.(.3.8.
0x3372503aee48ee4aee4cee50ee53ee58ee5aee:.H.J.L.P.S.X.Z.
⋯8 more rows

Go PE with retained symbol metadata 0x34bbc0–0x34bc80

⋯3 more rows
0x34bbf000000000000000000000000000000000................
0x34bc0000000000040000000000000001002000.............. .
0x34bc10030000000000110000007d2f21000100..........}/!...
⋯7 more rows

Go PE hides build path with SyscallN dispatch 0x361596–0x361716

⋯7 more rows
0x361606756e74696d652e697461626c696e6b00untime.itablink.
0x361616676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0x3616266275696c64696e666f2e726566007275buildinfo.ref.ru
⋯15 more rows