Hostile 92% windows Download

f4b330adc3e1cb5d4ba6f1c506d0e4d6821b83d9b033f6e0f21cfdb94c35d2c2.bin

Go PE hides path and resolves Win32 via SyscallNGo PE signed by abused TLS server certificate
SHA-256f4b330adc3e1cb5d4ba6f1c506d0e4d6821b83d9b033f6e0f21cfdb94c35d2c2
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO₂(As₂C)H(Os)Md₂(PtSi₃)

Evidence

Go types with concatenated-word obfuscation 0x164d97–0x164ec7
⋯5 more rows
0x164de72e547970652920626f6f6c001d2a5b5d.Type) bool..*[]
0x164df76d61696e2e4f65686a726f657372726emain.Oehjroesrrn
0x164e076e627375737166766661001d2a696e74nbsusqfvfa..*int
0x164e17657266616365207b204973286572726ferface { Is(erro
⋯11 more rows
Go PE hides build path with SyscallN dispatch 0x3b7356–0x3b7516
⋯7 more rows
0x3b73c6616473797374656d6c69627261727900adsystemlibrary.
0x3b73d673797363616c6c2e53797363616c6c4esyscall.SyscallN
0x3b73e60073797363616c6c2e6c6f61646c6962.syscall.loadlib
0x3b73f6726172790073797363616c6c2e676574rary.syscall.get
0x3b740670726f63616464726573730073797363procaddress.sysc
0x3b7416616c6c2e53797363616c6c0073797363all.Syscall.sysc
0x3b7426616c6c2e53797363616c6c3600737973all.Syscall6.sys
⋯15 more rows
Go PE hides path and resolves Win32 via SyscallN 0x3ba153–0x3ba263
⋯3 more rows
0x3ba1834c6f61642e6465666572777261703100Load.deferwrap1.
0x3ba19373797363616c6c2e282a4c617a795072syscall.(*LazyPr
0x3ba1a36f63292e46696e640073797363616c6coc).Find.syscall
0x3ba1b32e282a4c617a7950726f63292e46696e.(*LazyProc).Fin
0x3ba1c3642e6465666572777261703100737973d.deferwrap1.sys
0x3ba1d363616c6c2e282a4c617a7950726f6329call.(*LazyProc)
0x3ba1e32e43616c6c0073797363616c6c2e282a.Call.syscall.(*
0x3ba1f34c617a7950726f63292e6d7573744669LazyProc).mustFi
⋯7 more rows
Go PE with retained symbol metadata 0x453fc0–0x454080
⋯3 more rows
0x453ff000000000000000000000000000000000................
0x45400000000000040000000000000001002000.............. .
0x4540100300000000001100000050e415000100..........P.....
⋯7 more rows
Go PE signed by abused TLS server certificate 0x46f3e1–0x46f561
⋯7 more rows
0x46f451756e74696d652e697461626c696e6b00untime.itablink.
0x46f461676f3a6275696c64696e666f00676f3ago:buildinfo.go:
0x46f4716275696c64696e666f2e726566007275buildinfo.ref.ru
⋯15 more rows

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.