Benign Download

25e7a047b79eb049df4b60224a2812a80a7fafc54ff789abc84ee7154a887a3c.exe

Dynamic library loading via LoadLibraryWencoding/base64 package import

SHA-25625e7a047b79eb049df4b60224a2812a80a7fafc54ff789abc84ee7154a887a3c

MaleculeH(Ds)

Evidence

x509 string reference 0x1223ea–0x12241a

0x1223ea73686131000000000b63727970746f2fsha1.....crypto/
0x1223fa78353039000000000b73796e632f6174x509.....sync/at
0x12240a6f6d696300000b2a2a666c61672e466comic...**flag.Fl
0x12241a61670000                        ag..            

encoding/base64 package import 0x1244f3–0x124523

0x1244f30000000000000000000000000000000f................
0x124503656e636f64696e672f62617365363400encoding/base64.
0x124513000f2a2a72756e74696d652e6d737061..**runtime.mspa
0x1245236e00000f2a5b3133375d74696d652e  n...*[137]time. 

PEM begin marker 0x250030–0x250070

0x25003000b08ef01b0000000000400000000000..........@.....
0x2500400a2d2d2d2d2d454e4420000000000000.-----END ......
0x2500500a2d2d2d2d2d424547494e2000000000.-----BEGIN ....
0x25006000000000000000000000ffff00000000................
0x25007000000100ffff10000100            ..........      

Dynamic library loading via LoadLibraryW 0x252010–0x2520d0

⋯4 more rows
0x2520500047650090326500c03e650000386500.Ge..2e..>e..8e.
0x252060b029650040456500701b4d0010184d00.)[email protected].
0x25207000000000000000000000000000000000................
0x25208000000000080000000100000070316500............p1e.
0x252090b0296500502b65004045650030296500.)e.P+[email protected])e.
0x2520a050316500602665004042650040274d00P1e.`&e.@Be.@'M.
0x2520b000000000000000000000000000000000................
0x2520c0000000000700000002000000c03e6500.............>e.
0x2520d0b0296500                        .)e.            

.dll extension reference 0x265e20–0x265ea0

0x265e2000000000000000006b65726e656c3332........kernel32
0x265e302e646c6c00000000577269746546696c.dll....WriteFil
0x265e40650000005772697465436f6e736f6c65e...WriteConsole
⋯6 more rows