Local reference
Suspicious dependency
Inferred
Mal-ecule
O(As)H₃(DsOsPo)Md₃(BiPtSi₃)
Go PE loader with opaque identity and oversized rdata payload: 09abf355cbd02decf15685d6dfc47e032edd30546da64425e56721490695ffbb.exe:0x0
Go PE with opaque build identity and dynamic API dispatch: 09abf355cbd02decf15685d6dfc47e032edd30546da64425e56721490695ffbb.exe:0x264299
Large overlay with very low entropy: 09abf355cbd02decf15685d6dfc47e032edd30546da64425e56721490695ffbb.exe:0x0
| 0x0 | 4d5a90000300000004000000ffff0000 | MZ..............Go PE loader with opaque identity and oversized rdata payload |
| 0x10 | 8b000000000000004000000000000000 | ........@....... |
| 0x20 | 00000000000000000000000000000000 | ................ |
| 0x30 | 00000000000000000000000080000000 | ................ |
| 0x40 | 0e1fba0e00b409cd21b8014ccd215468 | ........!..L.!Th |
| 0x50 | 69732070726f6772616d2063616e6e6f | is program canno |
| 0x60 | 742062652072756e20696e20444f5320 | t be run in DOS |
| 0x70 | 6d6f64652e0d0d0a2400000000000000 | mode....$....... |
| 0x80 | 50450000648608000000000000a82700 | PE..d.........'. |
| 0x90 | d5090000f00022000b02030000b40c00 | ......"......... |
| 0xa0 | 00d6000000000000e031070000100000 | .........1...... |
| 0xb0 | 00000040010000000010000000020000 | ...@............ |
| 0xc0 | 06000100010000000600010000000000 | ................ |
| 0xd0 | 00302e0000060000fa81a90002006081 | .0............`. |
| 0xe0 | 00002000000000000010000000000000 | .. ............. |
| 0xf0 | 00001000000000000010000000000000 | ................ |
| 0x100 | 00000000100000000000000000000000 | ................ |
| 0x110 | 00302c003e0500000000000000000000 | .0,.>........... |
| 0x120 | 00d02b00b44b00000056a90068090000 | ..+..K...V..h... |
| 0x130 | 00 | . |
| 0xcb9e0 | cccccccccccccccccccccccccccccccc | ................ |
| 0xcb9f0 | cc000000000000000000000000000000 | ................ |
| 0xcba00 | 000000015f01014600017600016c0001 | ...._..F..v..l..Go PE loader with opaque identity and oversized rdata payload |
| 0xcba10 | 6800017300016901015200016d000166 | h..s..i..R..m..f |
| 0xcba20 | 00017000017500016e00016100017800 | ..p..u..n..a..x. |
| 0xcba30 | 017900016700016308016d0001740001 | .y..g..c..m..t.. |
| 0xcba40 | 6f010258300102497300026d75010258 | o..X0..Is..mu..X |
| 0xcba50 | 3100026f730102446f01024f72000273 | 1..os..Do..Or..s |
| 0xcba60 | 70000270630002666e0102504300026c | p..pc..fn..PC..l |
| 0xcba70 | 6f0002686900026c7200026670000262 | o..hi..lr..fp..b |
| 0xcba80 | 70000269640002747300027231000272 | p..id..ts..r1..r |
| 0xcba90 | 32000267300002677000026d70000266 | 2..g0..gp..mp..f |
| 0xcbaa0 | 64000272670002776700027274000272 | d..rg..wg..rt..r |
| 0xcbab0 | 6400027774000277640002706400026b | d..wt..wd..pd..k |
| 0xcbac0 | 70000274690002747400027431000274 | p..ti..tt..t1..t |
| 0xcbad0 | 320002696f01024f7001024664000272 | 2..io..Op..Fd..r |
| 0xcbae0 | 6f0102496e01024c6f01024869000273 | o..In..Lo..Hi..s |
| 0xcbaf0 | 61000361727200037261770103457272 | a..arr..raw..Err |
| 0xcbb00 | 01034d736701034c656e0103446c6c01 | ..Msg..Len..Dll. |
| 0xcbb10 | 0350616400036b65790103416c6c0103 | .Pad..key..All.. |
| 0xcbb20 | 4275660003646c6c0003657272000366 | Buf..dll..err..f |
| 0xcbb30 | 6d74000362756600036d736700037061 | mt..buf..msg..pa |
| 0xcbb40 | 64000377696400036172670103547970 | d..wid..arg..Typ |
| 0xcbb50 | 010353747200037074720003766f6c00 | ..Str..ptr..vol. |
| 0xcbb60 | 0373657400036164640003656e640103 | .set..add..end.. |
| 0xcbb70 | 4361700003747970000376616c01034e | Cap..typ..val..N |
| 0xcbb80 | 65770103476574010350757400037069 | ew..Get..Put..pi |
| 0xcbb90 | 6e01034164640103416e640003627373 | n..Add..And..bss |
| 0xcbba0 | 0003626164010350696e00036c656e00 | ..bad..Pin..len. |
| 0xcbbb0 | 03737562000370637300036765740003 | .sub..pcs..get.. |
| 0xcbbc0 | 6d617800036d696e0003706f7000036e | max..min..pop..n |
| 0xcbbd0 | 6f77000372756e000373657100036f66 | ow..run..seq..of |
| 0xcbbe0 | 6600036f626a00036763770003706f73 | f..obj..gcw..pos |
| 0xcbbf0 | 0003746c7308036d4f53000373696700 | ..tls..mOS..sig. |
| 0xcbc00 | 03636173000368617300036d69640003 | .cas..has..mid.. |
| 0xcbc10 | 71747901034b657901034f6c64000370 | qty..Key..Old..p |
| 0xcbc20 | 666401035461670103496e7401035365 | fd..Tag..Int..Se |
| 0xcbc30 | 71010353657401034f75740003726574 | q..Set..Out..ret |
| 0x2641e0 | 00000000000000000000000000000000 | ................ |
| 0x2641f0 | 00000000000000000000000000000000 | ................ |
| 0x264200 | ff20476f206275696c64696e663a0802 | . Go buildinf:.. |
| 0x264210 | 00000000000000000000000000000000 | ................ |
| 0x264220 | 08676f312e32352e34de013077af0c92 | .go1.25.4..0w... |
| 0x264230 | 74080241e1c107e6d618e67061746809 | t..A.......path. |
| 0x264240 | 744865686648746768715757574a476d | tHehfHtghqWWWJGm |
| 0x264250 | 710a6d6f640974486568664874676871 | q.mod.tHehfHtghq |
| 0x264260 | 5757574a476d710928646576656c2909 | WWWJGmq.(devel). |
| 0x264270 | 0a6275696c64092d6275696c646d6f64 | .build.-buildmod |
| 0x264280 | 653d6578650a6275696c64092d636f6d | e=exe.build.-com |
| 0x264290 | 70696c65723d67630a6275696c64092d | piler=gc.build.-Go PE with opaque build identity and dynamic API dispatch |
| 0x2642a0 | 7472696d706174683d747275650a6275 | trimpath=true.bu |
| 0x2642b0 | 696c640943474f5f454e41424c45443d | ild.CGO_ENABLED= |
| 0x2642c0 | 300a6275696c6409474f415243483d61 | 0.build.GOARCH=a |
| 0x2642d0 | 6d6436340a6275696c6409474f4f533d | md64.build.GOOS= |
| 0x2642e0 | 77696e646f77730a6275696c6409474f | windows.build.GO |
| 0x2642f0 | 414d4436343d76310af9324331861820 | AMD64=v1..2C1.. |
| 0x264300 | 72008242104116d8f200000000000000 | r..B.A.......... |
| 0x264310 | 00000000000000000000000000000000 | ................ |
| 0x264320 | ff20476f2066697073696e666f20ff00 | . Go fipsinfo .. |
| 0x264330 | 8338e13978d76d6dcdc3a0a32061e7fa | .8.9x.mm.... a.. |
| 0x264340 | 061d29103b17e60bb7a148743ba53753 | ..).;.....Ht;.7S |
| 0x264350 | 2061264001000000c0c30c4001000000 | a&@.......@.... |
| 0x264360 | e0c30c400100000095101e4001000000 | ...@.......@.... |
| 0x264370 | 96101e400100000020b1264001000000 | ...@.... .&@.... |
| 0x264380 | 21b1264001000000f035274001000000 | !.&@.....5'@.... |
| 0x264390 | f1352740010000000000000000000000 | .5'@............ |
| 0x2643a0 | 36302c000000000042302c0000 | 60,.....B0,.. |
| 0x28dab2 | 43616c6c6261636b0073797363616c6c | Callback.syscall |
| 0x28dac2 | 2e6c6f616473797374656d6c69627261 | .loadsystemlibra |
| 0x28dad2 | 72790073797363616c6c2e6c6f61646c | ry.syscall.loadl |
| 0x28dae2 | 6962726172790073797363616c6c2e67 | ibrary.syscall.g |
| 0x28daf2 | 657470726f6361646472657373007379 | etprocaddress.sy |
| 0x28db02 | 7363616c6c2e53797363616c6c007379 | scall.Syscall.sy |
| 0x28db12 | 7363616c6c2e53797363616c6c360073 | scall.Syscall6.s |
| 0x28db22 | 797363616c6c2e53797363616c6c3900 | yscall.Syscall9. |
| 0x28db32 | 73797363616c6c2e53797363616c6c4e | syscall.SyscallNGo PE with opaque build identity and dynamic API dispatch |
| 0x28db42 | 0074696d652e72756e74696d654e616e | .time.runtimeNan |
| 0x28db52 | 6f0074696d652e536c6565700072756e | o.time.Sleep.run |
| 0x28db62 | 74696d652e77726974650072756e7469 | time.write.runti |
| 0x28db72 | 6d652e7472616365416476616e636500 | me.traceAdvance. |
| 0x28db82 | 72756e74696d652e63616c6c65727300 | runtime.callers. |
| 0x28db92 | 696e7465726e616c2f72756e74696d65 | internal/runtime |
| 0x28dba2 | 2f6d6170732e74797065537472696e67 | /maps.typeString |
| 0x28dbb2 | 0072756e74696d652e6d6170696e6974 | .runtime.mapinit |
| 0x28dbc2 | 6e6f6f7000676f736176655f73797374 | noop.gosave_syst |
| 0x28dbd2 | 656d737461636b5f7377697463680061 | emstack_switch.a |
| 0x28dbe2 | 657368617368626f6479006763577269 | eshashbody.gcWri |
| 0x28dbf2 | 74654261727269657200646562756743 | teBarrier.debugC |
| 0x28dc02 | 616c6c333200646562756743616c6c36 | all32.debugCall6 |
| 0x28dc12 | 3400646562756743616c6c3132380064 | 4.debugCall128.d |
| 0x28dc22 | 6562756743616c6c3235360064656275 | ebugCall256.debu |
| 0x28dc32 | 6743616c6c3531320064656275674361 | gCall512.debugCa |
| 0x295329 | 746166697073656e6400676f3a6d6169 | tafipsend.go:mai |
| 0x295339 | 6e2e696e69747461736b7300676f3a72 | n.inittasks.go:r |
| 0x295349 | 756e74696d652e696e69747461736b73 | untime.inittasks |
| 0x295359 | 0072756e74696d652e6275696c645665 | .runtime.buildVe |
| 0x295369 | 7273696f6e2e7374720072756e74696d | rsion.str.runtim |
| 0x295379 | 652e6d6f64696e666f2e737472007275 | e.modinfo.str.ru |
| 0x295389 | 6e74696d652e747970656c696e6b0072 | ntime.typelink.r |
| 0x295399 | 756e74696d652e697461626c696e6b00 | untime.itablink. |
| 0x2953a9 | 676f3a6275696c64696e666f00676f3a | go:buildinfo.go:Go PE loader with opaque identity and oversized rdata payload |
| 0x2953b9 | 6275696c64696e666f2e726566007275 | buildinfo.ref.ru |
| 0x2953c9 | 6e74696d652e70636c6e746162007275 | ntime.pclntab.ru |
| 0x2953d9 | 6e74696d652e66696e6466756e637461 | ntime.findfuncta |
| 0x2953e9 | 620072756e74696d652e726f64617461 | b.runtime.rodata |
| 0x2953f9 | 0072756e74696d652e65726f64617461 | .runtime.erodata |
| 0x295409 | 0072756e74696d652e74797065730072 | .runtime.types.r |
| 0x295419 | 756e74696d652e657479706573007275 | untime.etypes.ru |
| 0x295429 | 6e74696d652e6e6f7074726461746100 | ntime.noptrdata. |
| 0x295439 | 72756e74696d652e656e6f7074726461 | runtime.enoptrda |
| 0x295449 | 74610072756e74696d652e6461746100 | ta.runtime.data. |
| 0x295459 | 72756e74696d652e6564617461007275 | runtime.edata.ru |
| 0x295469 | 6e74696d652e6273730072756e74696d | ntime.bss.runtim |
| 0x295479 | 652e656273730072756e74696d652e6e | e.ebss.runtime.n |
| 0x295489 | 6f7074726273730072756e74696d652e | optrbss.runtime. |
| 0x295499 | 656e6f7074726273730072756e74696d | enoptrbss.runtim |
| 0x2954a9 | 652e636f7663747273007275 | e.covctrs.ru |
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
signed
Authenticode chain CN: opensooq.com
notable severity, 100% confident.
signed/certificate
PE leaf certificate self-issued metadata
Identity
| SHA-256 | 09abf355cbd02decf15685d6dfc47e032edd30546da64425e56721490695ffbb |
|---|---|
| Filename | 09abf355cbd02decf15685d6dfc47e032edd30546da64425e56721490695ffbb.exe |
| Package | 09abf355cbd02decf15685d6dfc47e032edd30546da64425e56721490695ffbb |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | windows |
| Domain | abuse.ch |
Timeline
| First seen | 13 Jul 2026 11:05 UTC |
|---|---|
| First analyzed | 14 Jul 2026 03:59 UTC |
| Last analyzed | 14 Jul 2026 03:59 UTC |
| Last updated | 14 Jul 2026 03:59 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | ec1eb |
Not seeing what you expected? Let us know