Benign Download

3c8df2f95eebab3c1ea28f767db7f4118755bed957cfd69ecd90df509d1a9ff1.exe

Dynamic library loading via LoadLibraryWTCPConn type

SHA-2563c8df2f95eebab3c1ea28f767db7f4118755bed957cfd69ecd90df509d1a9ff1

MaleculeH(Ds)

Evidence

x509 string reference 0x121861–0x121891

0x12186173686131000000000b63727970746f2fsha1.....crypto/
0x12187178353039000000000b73796e632f6174x509.....sync/at
0x1218816f6d6963000b2a5b305d75696e747074omic..*[0]uintpt
0x12189172000b2a                        r..*            

Go runtime markers 0x193056–0x193096

0x1930566d652e68657864756d70576f72647300me.hexdumpWords.
0x19306672756e74696d652e6d61696e0072756eruntime.main.run
0x19307674696d652e6d61696e2e66756e633200time.main.func2.
0x19308672756e74696d652e696e69742e360072runtime.init.6.r
0x193096756e74696d652e666f72            untime.for      

os.Remove string in binary 0x19bab8–0x19bae8

0x19bab8732e282a66696c65292e636c6f736500s.(*file).close.
0x19bac86f732e52656d6f7665006f732e506970os.Remove.os.Pip
0x19bad865006f732e74656d70446972006f732ee.os.tempDir.os.
0x19bae84d6b646972416c6c00              MkdirAll.       

TCPConn type 0x19f119–0x19f149

0x19f1196e486f7374506f7274006e65742e282anHostPort.net.(*
0x19f129544350436f6e6e292e5265616446726fTCPConn).ReadFro
0x19f1396d006e65742e736f636b61646472546fm.net.sockaddrTo
0x19f149544350006e6574                  TCP.net         

Dynamic library loading via LoadLibraryW 0x232010–0x2320d0

⋯4 more rows
0x23205070296300c03463001032630020276300p)c..4c..2c. 'c.
0x232060f00e5000000000000000000000000000..P.............
0x23207000000000000000000000000000000000................
0x232080000000000500000001000000b02a6300.............*c.
0x232090903063007029630000476300f0316300.0c.p)c..Gc..1c.
0x2320a0504e5100000000000000000000000000PNQ.............
0x2320b000000000000000000000000000000000................
0x2320c000000000050000000100000000476300.............Gc.
0x2320d0d0316300003663002036630000416300.1c..6c. 6c..Ac.