Benign Download

amsi.go

Imports Go's unsafe packageSource names ntdll virtual-memory syscall stubs
SHA-256ac4196ff9e637a39aef956db25dfed84e1e6281c40c15b3cd324daae0f0bf895
MaleculeH₂(DbOs)

Evidence

Imports Go's unsafe package lines 1–14
⋯5 lines
6 "fmt"
7 "syscall"
8 "unsafe"
9
10 "github.com/VoidSecSoftwares/voidsyscall/syscallwin"
⋯4 lines
Converts a Go pointer through unsafe.Pointer lines 26–36
26:5… oldProtect uint32
27 regionSize := uintptr(64)
28 err = syscallwin.NtProtectVirtualMemory(
29 uintptr(0xffffffffffffffff),
30 (*uintptr)(unsafe.Pointer(&baseAddr)),
31 &regionSize,
32 syscallwin.PAGE_EXECUTE_READWRITE,
⋯4 lines

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.