AI
Go shellcode loader with evasion
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₃(AsCEr)H₂(OsPo)Md₃(PtBiSi₃)
Go dynamic x64 shellcode loader: ?????.exe:0x4272
Go PE with opaque identity and raw API dispatch: ?????.exe:0x1c0047
Go PE with opaque build identity and dynamic API dispatch: ?????.exe:0x1c0047
| 0x41f2 | 5890904c0fbcce4d0fafc1458b4c1008 | X..L...M...E.L.. |
| 0x4202 | 4139f975db488b4b604c01c1488d0411 | A9.u.H.K`L..H... |
| 0x4212 | 488d4008904883c4285dc3660fd7d190 | H.@..H..(].f.... |
| 0x4222 | 4885d27541488944243848895c244089 | H..uAH.D$8H.\$@. |
| 0x4232 | 7c245048894c24186689542416488d05 | |$PH.L$.f.T$.H.. |
| 0x4242 | 11f21300bb35000000e8b0850600488b | .....5........H. |
| 0x4252 | 442438488b4c24180fb7542416488b5c | D$8H.L$...T$.H.\ |
| 0x4262 | 24408b7c2450488b73589090480fbcd2 | $@.|$PH.sX..H... |
| 0x4272 | 41b840000000490f44d0480faff24883 | A.@...I.D.H...H.Go dynamic x64 shellcode loader |
| 0x4282 | c6084803742420893e488b7358480faf | ..H.t$ .>H.sXH.. |
| 0x4292 | f248037360488b5c2420488d341e488d | .H.s`H.\$ H.4.H. |
| 0x42a2 | 76089090880c1348ff004889f04883c4 | v......H..H..H.. |
| 0x42b2 | 285dc3488944240848895c241048894c | (].H.D$.H.\$.H.L |
| 0x42c2 | 2418897c2420e813d50600488b442408 | $..|$ .....H.D$. |
| 0x42d2 | 488b5c2410488b4c24188b7c2420e9bb | H.\$.H.L$..|$ .. |
| 0x42e2 | feffffcccccccccccccccccccccccccc | ................ |
| 0x42f2 | cccccccccccccccccccccccccccc493b | ..............I; |
| 0x4302 | 66100f860e010000554889e54883ec28 | f.......UH..H..( |
| 0x4312 | 488b50104889542420488b3283e17f66 | H.P.H.T$ H.2...f |
| 0x4322 | 480f6ec1660f60c0f20f70c00066480f | H.n.f.`...p..fH. |
| 0x4332 | 6ece660f74c1660fd7f0400fb6f6eb08 | n.f.t.f...@..... |
| 0x4342 | 4c8d46ff904c21c64885f6742e4c8b43 | L.F..L!.H..t.L.C |
| 0x4352 | 5890904c0fbcce4d0fafc14d8b4c1008 | X..L...M...M.L.. |
| 0x4362 | 4939f975db488b4b604c01c1488d0411 | I9.u.H.K`L..H... |
| 0x4372 | 488d | H. |
| 0x48fa | 894b0848891a488b4c2460488b415848 | .K.H..H.L$`H.AXH |
| 0x490a | 8b542430480fafc2480341604883c008 | .T$0H...H.A`H... |
| 0x491a | 4803442440904883c4485dc3488b5424 | H.D$@.H..H].H.T$ |
| 0x492a | 40488b1266480f6ec2660fd7d04885d2 | @H..fH.n.f...H.. |
| 0x493a | 7534668954241e488d050feb1300bb35 | u4f.T$.H.......5 |
| 0x494a | 000000e8ae7e0600488b442458488b4c | .....~..H.D$XH.L |
| 0x495a | 24200fb754241e488b5c2460488b7424 | $ ..T$.H.\$`H.t$ |
| 0x496a | 78488b7c24704c8b43589090480fbcd2 | xH.|$pL.CX..H... |
| 0x497a | 41b940000000490f44d14c0fafc24983 | A.@...I.D.L...I.Go dynamic x64 shellcode loader |
| 0x498a | c0084c0344244049897008833d44182a | ..L.D$@I.p..=D.* |
| 0x499a | 0000740f498b30e85aed060049893b49 | ..t.I.0.Z...I.;I |
| 0x49aa | 897308498938488b7358480faff24803 | .s.I.8H.sXH...H. |
| 0x49ba | 7360488b5c2440488d341e488d760890 | s`H.\$@H.4.H.v.. |
| 0x49ca | 90880c1348ff004889f04883c4485dc3 | ....H..H..H..H]. |
| 0x49da | 488944240848895c241048894c241848 | H.D$.H.\$.H.L$.H |
| 0x49ea | 897c24204889742428e8e8cd0600488b | .|$ H.t$(.....H. |
| 0x49fa | 442408488b5c2410488b4c2418488b7c | D$.H.\$.H.L$.H.| |
| 0x4a0a | 2420488b742428e9eafdffffcccccccc | $ H.t$(......... |
| 0x4a1a | cccccccccccc493b66100f86a4000000 | ......I;f....... |
| 0x4a2a | 554889e54883ec20488944243048895c | UH..H.. H.D$0H.\ |
| 0x4a3a | 243848894c244040887c2448488d05d3 | $8H.L$@@.|$HH... |
| 0x4a4a | 9a1200e88e020100488b4c2440488948 | ........H.L$@H.H |
| 0x4a5a | 080fb64c2448884806488b4c24384883 | ...L$H.H.H.L$8H. |
| 0x4a6a | f908ba08000000480f42ca4881f90004 | .......H.B.H.... |
| 0x4a7a | 0000 | .. |
| 0x1bffc7 | 652e6e6577496e6c696e65556e77696e | e.newInlineUnwin |
| 0x1bffd7 | 6465720073797363616c6c2e636f6d70 | der.syscall.comp |
| 0x1bffe7 | 696c6543616c6c6261636b0072756e74 | ileCallback.runt |
| 0x1bfff7 | 696d652e6362734c6f636b0072756e74 | ime.cbsLock.runt |
| 0x1c0007 | 696d652e63616c6c6261636b61736d41 | ime.callbackasmA |
| 0x1c0017 | 6464720072756e74696d652e63627355 | ddr.runtime.cbsU |
| 0x1c0027 | 6e6c6f636b0073797363616c6c2e6c6f | nlock.syscall.lo |
| 0x1c0037 | 616473797374656d6c69627261727900 | adsystemlibrary. |
| 0x1c0047 | 73797363616c6c2e53797363616c6c4e | syscall.SyscallNGo dynamic x64 shellcode loader |
| 0x1c0057 | 0073797363616c6c2e6c6f61646c6962 | .syscall.loadlib |
| 0x1c0067 | 726172790073797363616c6c2e676574 | rary.syscall.get |
| 0x1c0077 | 70726f63616464726573730073797363 | procaddress.syscGo PE with opaque identity and raw API dispatch |
| 0x1c0087 | 616c6c2e53797363616c6c0073797363 | all.Syscall.sysc |
| 0x1c0097 | 616c6c2e53797363616c6c3600737973 | all.Syscall6.sys |
| 0x1c00a7 | 63616c6c2e53797363616c6c39007469 | call.Syscall9.ti |
| 0x1c00b7 | 6d652e72756e74696d654e6f77007469 | me.runtimeNow.ti |
| 0x1c00c7 | 6d652e72756e74696d654e616e6f0074 | me.runtimeNano.t |
| 0x1c00d7 | 696d652e536c6565700072756e74696d | ime.Sleep.runtim |
| 0x1c00e7 | 652e77726974650072756e74696d652e | e.write.runtime. |
| 0x1c00f7 | 7472616365416476616e63650072756e | traceAdvance.run |
| 0x1c0107 | 74696d652f74726163652e72756e7469 | time/trace.runti |
| 0x1c0117 | 6d655f7472616365436c6f636b556e69 | me_traceClockUni |
| 0x1c0127 | 74735065725365636f6e640072756e74 | tsPerSecond.runt |
| 0x1c0137 | 696d652e63616c6c65727300696e7465 | ime.callers.inte |
| 0x1c0147 | 726e616c2f72756e74696d652f6d6170 | rnal/runtime/map |
| 0x1c0157 | 732e74797065537472696e670072756e | s.typeString.run |
| 0x1c0167 | 74696d652e6d6170696e69746e6f6f70 | time.mapinitnoop |
| 0x1c0177 | 00676f676f0063616c6c52657400676f | .gogo.callRet.go |
| 0x1c0187 | 736176655f73797374656d | save_system |
| 0x1c2df0 | 292e4572726f720073797363616c6c2e | ).Error.syscall. |
| 0x1c2e00 | 282a444c4c4572726f72292e556e7772 | (*DLLError).Unwr |
| 0x1c2e10 | 61700073797363616c6c2e4c6f616444 | ap.syscall.LoadD |
| 0x1c2e20 | 4c4c0073797363616c6c2e5554463136 | LL.syscall.UTF16 |
| 0x1c2e30 | 50747246726f6d537472696e67007379 | PtrFromString.sy |
| 0x1c2e40 | 7363616c6c2e282a444c4c292e46696e | scall.(*DLL).Fin |
| 0x1c2e50 | 6450726f630073797363616c6c2e4279 | dProc.syscall.By |
| 0x1c2e60 | 746550747246726f6d537472696e6700 | tePtrFromString. |
| 0x1c2e70 | 73797363616c6c2e282a50726f63292e | syscall.(*Proc).Go dynamic x64 shellcode loader |
| 0x1c2e80 | 43616c6c0073797363616c6c2e282a50 | Call.syscall.(*P |
| 0x1c2e90 | 726f63292e416464720073797363616c | roc).Addr.syscal |
| 0x1c2ea0 | 6c2e282a4c617a79444c4c292e4c6f61 | l.(*LazyDLL).Loa |
| 0x1c2eb0 | 640073797363616c6c2e282a4c617a79 | d.syscall.(*Lazy |
| 0x1c2ec0 | 444c4c292e4c6f61642e646566657277 | DLL).Load.deferw |
| 0x1c2ed0 | 726170310073797363616c6c2e282a4c | rap1.syscall.(*LGo PE with opaque identity and raw API dispatch |
| 0x1c2ee0 | 617a7950726f63292e46696e64007379 | azyProc).Find.sy |
| 0x1c2ef0 | 7363616c6c2e282a4c617a7950726f63 | scall.(*LazyProc |
| 0x1c2f00 | 292e46696e642e646566657277726170 | ).Find.deferwrap |
| 0x1c2f10 | 310073797363616c6c2e282a4c617a79 | 1.syscall.(*Lazy |
| 0x1c2f20 | 50726f63292e43616c6c007379736361 | Proc).Call.sysca |
| 0x1c2f30 | 6c6c2e282a4c617a7950726f63292e6d | ll.(*LazyProc).m |
| 0x1c2f40 | 75737446696e640073797363616c6c2e | ustFind.syscall. |
| 0x1c2f50 | 42797465536c69636546726f6d537472 | ByteSliceFromStr |
| 0x1c2f60 | 696e670073797363616c6c2e55544631 | ing.syscall.UTF1 |
| 0x1c2f70 | 3646726f6d537472696e670073797363 | 6FromString.sysc |
| 0x1c2f80 | 616c6c2e5554463136546f537472696e | all.UTF16ToStrin |
| 0x1c2f90 | 670073797363616c6c2e4572726e6f2e | g.syscall.Errno. |
| 0x1c2fa0 | 4572726f720073796e63 | Error.sync |
| 0x250150 | f101f201f201f301f301f10145039903 | ............E... |
| 0x250160 | 9203b2039503b5039803b8039903b903 | ................ |
| 0x250170 | 9a03ba039c03bc03a003c003a103c103 | ................ |
| 0x250180 | a303c203a603c603a903c903b203d003 | ................ |
| 0x250190 | b503f503b803d103b903be1fba03f003 | ................ |
| 0x2501a0 | bc03b500c003d603c103f103c203c303 | ................ |
| 0x2501b0 | c303a303c603d503c9032621d0039203 | ..........&!.... |
| 0x2501c0 | d103f403d503a603d603a003f0039a03 | ................Go local shellcode execution via Proc.Call |
| 0x2501d0 | f103a103f4039803f503950312043204 | ..............2. |
| 0x2501e0 | 140434041e043e042104410422044204 | ..4...>.!.A.".B. |
| 0x2501f0 | 2a044a043204801c3404811c3e04821c | *.J.2...4...>... |
| 0x250200 | 4104831c4204841c4a04861c62046304 | A...B...J...b.c. |
| 0x250210 | 6304871c801c1204811c1404821c1e04 | c............... |
| 0x250220 | 831c2104841c851c851c2204861c2a04 | ..!......."...*. |
| 0x250230 | 871c6204881c4aa6601e611e611e9b1e | ..b...J.`.a.a...Go dynamic x64 shellcode loader |
| 0x250240 | 9b1e601e9e1edf00be1f45032621a903 | ..`.......E.&!.. |
| 0x250250 | 2a214b002b21c5004aa64ba64ba6881c | *!K.+!..J.K.K... |
| 0x250260 | 203f1b4001000000803f1b4001000000 | ?.@.....?.@.... |
| 0x250270 | f080010000000000f080010000000000 | ................Go PE with opaque identity and raw API dispatch |
| 0x250280 | 80c01c4001000000180e000000000000 | ...@............ |
| 0x250290 | 180e000000000000a0ce1c4001000000 | ...........@.... |
| 0x2502a0 | 30160000000000003016000000000000 | 0.......0....... |
| 0x2502b0 | e0e41c4001000000a0fb040000000000 | ...@............ |
| 0x2502c0 | a0fb04000000000080e0214001000000 | ..........!@.... |
| 0x2502d0 | 68190300000000006819030000000000 | h.......h....... |
| 0x2502e0 | 80e0214001000000c208000000000000 | ..!@............ |
| 0x2502f0 | c20800000000000080b7174001000000 | ...........@.... |
| 0x250300 | 001000400100000061b6104001000000 | ...@....a..@.... |
| 0x250310 | 001000400100000070b6104001000000 | ...@....p..@.... |
| 0x250320 | 00032540010000006287254001000000 | ..%@....b.%@.... |
| 0x250330 | 8087254001000000f20f264001000000 | ..%@......&@.... |
| 0x250340 | 001026400100000038692a4001000000 | ..&@....8i*@.... |
| 0x250350 | 40692a4001000000e8a52a4001000000 | @i*@......*@.... |
| 0x250360 | e8a52a4001000000e8a52a4001000000 | ..*@......*@.... |
| 0x250370 | e8a52a40010000004861174001000000 | ..*@....Ha.@.... |
| 0x250380 | da6217400100000000c01040 | .b.@.......@ |
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
signed
Authenticode chain CN: spolawerte.to
notable severity, 100% confident.
signed/certificate
PE leaf certificate is self-issued
baseline severity, 95% confident.
lang
Go binary built with trimpath flag
Identity
| SHA-256 | 07e0b63badbcdc1efa43a932a7025c1b50d3ba8a446223ce3659541a41133a5b |
|---|---|
| Filename | ?????.exe |
| Package | 07e0b63badbcdc1efa43a932a7025c1b50d3ba8a446223ce3659541a41133a5b |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | windows |
| Domain | abuse.ch |
Timeline
| First seen | 21 Jul 2026 04:14 UTC |
|---|---|
| First analyzed | 26 Jul 2026 06:36 UTC |
| Last analyzed | 26 Jul 2026 06:36 UTC |
| Last updated | 26 Jul 2026 06:36 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 9266e |
Not seeing what you expected? Let us know