Suspicious ^80% Download

596faf7dab4bcecfaaccd36436152fd066687d10b77e592df08c09775525347f.exe

Self-signed, high-entropy overlay

File changed after it was signedGarble obfuscated Go binary

SHA-256596faf7dab4bcecfaaccd36436152fd066687d10b77e592df08c09775525347f

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeO₂(As₆Er₃)H₅(Cm₃Db₂FOs₂Po)Md₄(Bi₁₀PtSi₄)

Evidence

Go runtime symbol presence 0x433de0–0x433f00

0x433de026000048899c2458120000488b9424f0&..H..$X...H..$.
0x433df00d00004885d2740d31c931f60f1f4000...H..t.1.1...@.
0x433e00e945290000c684245003000000c68424.E)....$P......$
0x433e105003000084488d842450030000bb0100P....H..$P......
0x433e2000004889d9bfb4ffffffe8b174090048..H.........t..H
0x433e308984248825000048899c24c810000031..$.%..H..$....1
0x433e40c931d231f6eb7048898c24080e0000c6.1.1..pH..$.....
0x433e5084245003000000c68424500300008448.$P......$P....H
0x433e608d842450030000bb010000004889d9bf..$P........H...
0x433e70a4ffffffe867740900488b8c24280f00.....gt..H..$(..
0x433e80004889c74889de31c0488b9c24a02400.H..H..1.H..$.$.
0x433e9000e86a86c1ff488b8c24080e000048ff..j...H..$....H.
0x433ea0c14889da4889c6488b84248825000048.H..H..H..$.%..H
0x433eb08b9c24c81000004889b424a024000048..$....H..$.$..H
0x433ec0899424280f00004c8d43f449f7d84c39..$(...L.C.I..L9
0x433ed0c10f8c70ffffffc784244a0300000000...p.....$J.....
0x433ee00000c784244a030000e3c7c0c7488d84....$J.......H..
0x433ef0244a030000bb040000004889d9bfaeff$J........H.....
0x433f00ffffe8d973090048898424982e0000  ....s..H..$.... 

Largest PE section below ten percent 0x5b7cf0–0x5b7d80

0x5b7cf000000000000000000000000000000000................
0x5b7d0000002000080000000000000000000004.. .............
0x5b7d1000000000800000000000000000000000................
0x5b7d2000000000000000000000000000000000................
0x5b7d3000000000000000000000000000000020............... 
0x5b7d40000c0000000000000000000004000000................
0x5b7d5000800000000000000000000000000000................
0x5b7d6000000000000000000000000000000000................
0x5b7d7000000000000000000000000020000e00............ ...
0x5b7d80000000000000000000              .........       

Go syscall LazyProc call 0xb37fed–0xb381bd

0xb37fed6c6c2e282a50726f63292e43616c6c00ll.(*Proc).Call.
0xb37ffd73797363616c6c2e282a50726f63292esyscall.(*Proc).
0xb3800d416464720073797363616c6c2e282a4cAddr.syscall.(*L
0xb3801d617a79444c4c292e4c6f616400737973azyDLL).Load.sys
0xb3802d63616c6c2e282a4c617a79444c4c292ecall.(*LazyDLL).
0xb3803d4c6f61642e6465666572777261703100Load.deferwrap1.
0xb3804d73797363616c6c2e282a4c617a795072syscall.(*LazyPr
0xb3805d6f63292e46696e640073797363616c6coc).Find.syscall
0xb3806d2e282a4c617a7950726f63292e46696e.(*LazyProc).Fin
0xb3807d642e6465666572777261703100737973d.deferwrap1.sys
0xb3808d63616c6c2e282a4c617a7950726f6329call.(*LazyProc)
0xb3809d2e416464720073797363616c6c2e282a.Addr.syscall.(*
0xb380ad4c617a7950726f63292e6d7573744669LazyProc).mustFi
0xb380bd6e640073797363616c6c2e282a4c617and.syscall.(*Laz
0xb380cd7950726f63292e43616c6c0073797363yProc).Call.sysc
0xb380dd616c6c2e42797465536c69636546726fall.ByteSliceFro
0xb380ed6d537472696e670073797363616c6c2emString.syscall.
0xb380fd555446313646726f6d537472696e6700UTF16FromString.
0xb3810d73797363616c6c2e5554463136546f53syscall.UTF16ToS
0xb3811d7472696e670073797363616c6c2e4572tring.syscall.Er
0xb3812d726e6f2e4572726f720073797363616crno.Error.syscal
0xb3813d6c2e4572726e6f2e4973007379736361l.Errno.Is.sysca
0xb3814d6c6c2e57726974650073797363616c6cll.Write.syscall
0xb3815d2e577269746546696c65007379736361.WriteFile.sysca
0xb3816d6c6c2e656e636f646557544631360075ll.encodeWTF16.u
0xb3817d6e69636f64652f75746631362e417070nicode/utf16.App
0xb3818d656e6452756e650073797363616c6c2eendRune.syscall.
0xb3819d6465636f6465575446313600756e6963decodeWTF16.unic
0xb381ad6f64652f75746631362e4465636f6465ode/utf16.Decode
0xb381bd52756e65007379736361            Rune.sysca      

Duplicate object handle 0xbea0f0–0xbea2e0

⋯6 more rows
0xbea15000000000000000000000000000000000................
0xbea16020007e00a10077037a037f0384035605 .~...w.z.....V.
0xbea17059058a058d05c705d005ea05ef05f405Y...............
⋯4 more rows
0xbea1c0dc09e309e609fe09010a0a0a0f0a100a................
0xbea1d0130a390a3c0a420a470a480a4b0a4d0a..9.<.B.G.H.K.M.
0xbea1e0510a510a590a5e0a660a760a810ab90aQ.Q.Y.^.f.v.....
0xbea1f0bc0acd0ad00ad00ae00ae30ae60af10a................
0xbea200f90a0c0b0f0b100b130b390b3c0b440b..........9.<.D.
0xbea210470b480b4b0b4d0b550b570b5c0b630bG.H.K.M.U.W.\.c.
0xbea220660b770b820b8a0b8e0b950b990b9f0bf.w.............
0xbea230a30ba40ba80baa0bae0bb90bbe0bc20b................
0xbea240c60bcd0bd00bd00bd70bd70be60bfa0b................
0xbea250000c390c3c0c4d0c550c5a0c5d0c5d0c..9.<.M.U.Z.].].
0xbea260600c630c660c6f0c770cb90cbc0ccd0c`.c.f.o.w.......
0xbea270d50cd60cdd0ce30ce60cf30c000d4f0d..............O.
0xbea280540d630d660d960d9a0dbd0dc00dc60dT.c.f...........
0xbea290ca0dca0dcf0ddf0de60def0df20df40d................
⋯5 more rows

Go build info marker string 0xc128b4–0xc12974

⋯3 more rows
0xc128e4756e74696d652e697461626c696e6b00untime.itablink.
0xc128f4676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0xc129046275696c64696e666f2e726566007275buildinfo.ref.ru
⋯7 more rows