Benign Download

376abec32ec9400b58354ad6f53f102cae695ae6f1a2d4395f7abbdc0b472613.exe

Dynamic library loading via LoadLibraryW

SHA-256376abec32ec9400b58354ad6f53f102cae695ae6f1a2d4395f7abbdc0b472613

MaleculeH(Ds)

Evidence

Go runtime markers 0xa5c62–0xa5c92

0xa5c626d652e68657864756d70576f72647300me.hexdumpWords.
0xa5c7272756e74696d652e6d61696e0072756eruntime.main.run
0xa5c8274696d652e696e69742e360072756e74time.init.6.runt
0xa5c92696d652e666f726365676368        ime.forcegch    

Dynamic library loading via LoadLibraryW 0xe5010–0xe5160

⋯9 more rows
0xe50a0b00f000000000000b00f000000000000................
0xe50b020ba4a0000000000c011020000000000 .J.............
0xe50c0c011020000000000e0cb4c0000000000..........L.....
0xe50d0b083010000000000b083010000000000................
0xe50e0e0cb4c00000000002204000000000000..L.....".......
0xe50f0220400000000000040174a0000000000"[email protected].....
0xe51000010400000000000c1ef460000000000[email protected].....
0xe51100010400000000000d0ef460000000000[email protected].....
0xe512060514e000000000080644e0000000000`QN......dN.....
0xe513080644e000000000050894e0000000000.dN.....P.N.....
⋯3 more rows

Configure waitable timer 0x13fccc–0x13fcfc

0x13fccc6872656164000000536c656570000000hread...Sleep...
0x13fcdc5365745761697461626c6554696d6572SetWaitableTimer
0x13fcec00000000536574556e68616e646c6564....SetUnhandled
0x13fcfc457863657074696f6e46696c74657200ExceptionFilter.

Create extended waitable timer 0x13fea8–0x13ff28

0x13fea8706c696361746548616e646c65000000plicateHandle...
0x13feb84372656174655761697461626c655469CreateWaitableTi
0x13fec86d657245785700000000437265617465merExW....Create
0x13fed854687265616400000000437265617465Thread....Create
⋯5 more rows

Go PE retains .symtab section 0x144bf0–0x144c20

0x144bf000000000000000000000000000000000................
0x144c0000000000690000000000000001000803....i...........
0x144c1003000000000076000000d0df06000100......v.........
0x144c2008030300000000                  .......         