Hostile ^93% windows Download

cx-programmer 9.1 free download full.exe

Obfuscated Go dropper, fake name

Go PE hides path and resolves Win32 via SyscallNObfuscated Go PE with renamed main symbols

SHA-2561a44bfbdd9f4bbca790207cdd75e4b263922178077d616e1905ae84d55815ea0

URLhttps://mb-api.abuse.ch/api/v1/

Evidence

PE certificate table with mismatched checksum 0x0–0xd0

0x04d5a90000300040000000000ffff0000MZ..............
0x108b000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000080000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯8 more rows

Obfuscated Go PE with renamed main symbols 0x270c42–0x270d62

⋯5 more rows
0x270c922a6a736f6e2e7363616e6e6572010d2a*json.scanner..*
0x270ca26d61696e2e574e5867633144000d2a6dmain.WNXgc1D..*m
0x270cb261705b696e745d626f6f6c000d2a706fap[int]bool..*po
⋯11 more rows

Randomized Go main package symbol names 0x3d2574–0x3d27c4

⋯5 more rows
0x3d25c45278366f79634330292e4d6630747500Rx6oycC0).Mf0tu.
0x3d25d46d61696e2e7048334f4c55546f006d61main.pH3OLUTo.ma
0x3d25e4696e2e282a524970426b4d43714a325ain.(*RIpBkMCqJ2Z
0x3d25f4395763292e676e496167447939006d619Wc).gnIagDy9.ma
0x3d2604696e2e282a524970426b4d43714a325ain.(*RIpBkMCqJ2Z
0x3d2614395763292e70487359745467557356779Wc).pHsYtTgUsVw
0x3d26244448006d61696e2e686b66705037486eDH.main.hkfpP7Hn
0x3d26344d44006d61696e2e6952353651595773MD.main.iR56QYWs
0x3d264467006d61696e2e674a584f6d53337061g.main.gJXOmS3pa
0x3d26544a006d61696e2e696e47444c006d6169J.main.inGDL.mai
0x3d26646e2e67554c4966484a6e006d61696e2en.gULIfHJn.main.
0x3d26747378645142354f51307733006d61696esxdQB5OQ0w3.main
0x3d26842e72683147663375366a006d61696e2e.rh1Gf3u6j.main.
0x3d2694774b4434336a577332504b507135006dwKD43jWs2PKPq5.m
⋯4 more rows
0x3d26e4763469006d61696e2e77684f4972006dv4i.main.whOIr.m
0x3d26f461696e2e715479464f006d61696e2e78ain.qTyFO.main.x
0x3d27046d4e39694c34434f596b6f006d61696emN9iL4COYko.main
⋯12 more rows

Go PE hides path and resolves Win32 via SyscallN 0x4620f0–0x4622b0

⋯11 more rows
0x4621a001000000000000000000000000000000................
0x4621b000000000000000000000000000000000................
0x4621c0006f01004a6f0100010000004f6f0100.o..Jo......Oo..
0x4621d0876f0100010000008f6f01009f6f0100.o.......o...o..
0x4621e001000000000000000000000000000000................
0x4621f000000000000000000000000000000000................
0x46220000180118010004180618020007180e18................
0x46221001001018191801002018781801008018........ .x.....
0x462220aa180100000000000000000000000000................
⋯9 more rows

Go PE hides build path with SyscallN dispatch 0x49a495–0x49a615

⋯7 more rows
0x49a505756e74696d652e697461626c696e6b00untime.itablink.
0x49a515676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0x49a5256275696c64696e666f2e726566007275buildinfo.ref.ru
⋯15 more rows