Suspicious 80% windows Download

fnproject

Unsigned Go binary, crypto, evasion

Go PE sparse dynamic importsdebugpy debugger package bundle
SHA-256c54a1215c96a016a119db65017b2583f1e5693524452b8bbd86ca44e6715eb92
URLhttps://github.com/fnproject/cli/releases/download/0.6.66/fn.exe
MaleculeK(Te)O₂(AsDy₂)H₆(Cm₁₁Cr₁₀Db₄F₂Os₇Po₄)Md₄(BiPt)

Evidence

English function-word token "this" 0x0–0xd0
0x04d5a90000300000004000000ffff0000MZ..............
0x108b000000000000004000000000000000........@.......
0x2000000000000000000000000000000000................
0x3000000000000000000000000080000000................
0x400e1fba0e00b409cd21b8014ccd215468........!..L.!Th
0x5069732070726f6772616d2063616e6e6fis program canno
⋯8 more rows
Go syscall.Syscall function-pointer dispatch 0x92bd2d–0x92be8d
⋯5 more rows
0x92bd7d616473797374656d6c69627261727900adsystemlibrary.
0x92bd8d73797363616c6c2e53797363616c6c4esyscall.SyscallN
0x92bd9d0073797363616c6c2e6c6f61646c6962.syscall.loadlib
0x92bdad726172790073797363616c6c2e676574rary.syscall.get
0x92bdbd70726f63616464726573730073797363procaddress.sysc
0x92bdcd616c6c2e53797363616c6c0073797363all.Syscall.sysc
0x92bddd616c6c2e53797363616c6c3600737973all.Syscall6.sys
⋯11 more rows
LoadLibraryExW API reference 0xd61b90–0xd61d70
⋯13 more rows
0xd61c6002000000000000000500000000000000................
0xd61c7004000000000000000600000000000000................
0xd61c8002000000000000000500000000000000................
0xd61c9004000000000000000a00000000000000................
0xd61ca002000000000000000500000000000000................
0xd61cb004000000000000000b00000000000000................
0xd61cc002000000000000000500000000000000................
0xd61cd004000000000000000300000000000000................
0xd61ce002000000000000000500000000000000................
0xd61cf004000000000000000500000000000000................
0xd61d0002000000000000000500000000000000................
⋯7 more rows
Go PE retains .symtab section 0x12b27c0–0x12b2880
⋯3 more rows
0x12b27f000000000000000000000000000000000................
0x12b2800000000007d0000000000000001002000....}......... .
0x12b28100300000000008a000000701366000100..........p.f...
⋯7 more rows
Go build info marker string 0x13fd76a–0x13fd82a
⋯3 more rows
0x13fd79a756e74696d652e697461626c696e6b00untime.itablink.
0x13fd7aa676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0x13fd7ba6275696c64696e666f2e726566007275buildinfo.ref.ru
⋯7 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.