Local reference
Suspicious dependency
Inferred
Mal-ecule
O₃(AsCEr)H₂(OsPo)Md₃(PtBiSi₃)
Go dynamic x64 shellcode loader: file:0x3852
Go PE with opaque identity and raw API dispatch: file:0x243530
Go PE with opaque build identity and dynamic API dispatch: file:0x243530
| 0x37d2 | 5890904c0fbcce4d0fafc1458b4c1008 | X..L...M...E.L.. |
| 0x37e2 | 4139f975db488b4b604c01c1488d0411 | A9.u.H.K`L..H... |
| 0x37f2 | 488d4008904883c4285dc3660fd7d190 | H.@..H..(].f.... |
| 0x3802 | 4885d27541488944243848895c244089 | H..uAH.D$8H.\$@. |
| 0x3812 | 7c245048894c24186689542416488d05 | |$PH.L$.f.T$.H.. |
| 0x3822 | e2f00f00bb35000000e8906d0600488b | .....5.....m..H. |
| 0x3832 | 442438488b4c24180fb7542416488b5c | D$8H.L$...T$.H.\ |
| 0x3842 | 24408b7c2450488b73589090480fbcd2 | $@.|$PH.sX..H... |
| 0x3852 | 41b840000000490f44d0480faff24883 | A.@...I.D.H...H.Go dynamic x64 shellcode loader |
| 0x3862 | c6084803742420893e488b7358480faf | ..H.t$ .>H.sXH.. |
| 0x3872 | f248037360488b5c2420488d341e488d | .H.s`H.\$ H.4.H. |
| 0x3882 | 76089090880c1348ff004889f04883c4 | v......H..H..H.. |
| 0x3892 | 285dc3488944240848895c241048894c | (].H.D$.H.\$.H.L |
| 0x38a2 | 2418897c2420e833b90600488b442408 | $..|$ .3...H.D$. |
| 0x38b2 | 488b5c2410488b4c24188b7c2420e9bb | H.\$.H.L$..|$ .. |
| 0x38c2 | feffffcccccccccccccccccccccccccc | ................ |
| 0x38d2 | cccccccccccccccccccccccccccc493b | ..............I; |
| 0x38e2 | 66100f860e010000554889e54883ec28 | f.......UH..H..( |
| 0x38f2 | 488b50104889542420488b3283e17f66 | H.P.H.T$ H.2...f |
| 0x3902 | 480f6ec1660f60c0f20f70c00066480f | H.n.f.`...p..fH. |
| 0x3912 | 6ece660f74c1660fd7f0400fb6f6eb08 | n.f.t.f...@..... |
| 0x3922 | 4c8d46ff904c21c64885f6742e4c8b43 | L.F..L!.H..t.L.C |
| 0x3932 | 5890904c0fbcce4d0fafc14d8b4c1008 | X..L...M...M.L.. |
| 0x3942 | 4939f975db488b4b604c01c1488d0411 | I9.u.H.K`L..H... |
| 0x3952 | 488d | H. |
| 0x3eda | 894b0848891a488b4c2460488b415848 | .K.H..H.L$`H.AXH |
| 0x3eea | 8b542430480fafc2480341604883c008 | .T$0H...H.A`H... |
| 0x3efa | 4803442440904883c4485dc3488b5424 | H.D$@.H..H].H.T$ |
| 0x3f0a | 40488b1266480f6ec2660fd7d04885d2 | @H..fH.n.f...H.. |
| 0x3f1a | 7534668954241e488d05e0e90f00bb35 | u4f.T$.H.......5 |
| 0x3f2a | 000000e88e660600488b442458488b4c | .....f..H.D$XH.L |
| 0x3f3a | 24200fb754241e488b5c2460488b7424 | $ ..T$.H.\$`H.t$ |
| 0x3f4a | 78488b7c24704c8b43589090480fbcd2 | xH.|$pL.CX..H... |
| 0x3f5a | 41b940000000490f44d14c0fafc24983 | A.@...I.D.L...I.Go dynamic x64 shellcode loader |
| 0x3f6a | c0084c0344244049897008833d348630 | ..L.D$@I.p..=4.0 |
| 0x3f7a | 0000740f498b30e87ad1060049893b49 | ..t.I.0.z...I.;I |
| 0x3f8a | 897308498938488b7358480faff24803 | .s.I.8H.sXH...H. |
| 0x3f9a | 7360488b5c2440488d341e488d760890 | s`H.\$@H.4.H.v.. |
| 0x3faa | 90880c1348ff004889f04883c4485dc3 | ....H..H..H..H]. |
| 0x3fba | 488944240848895c241048894c241848 | H.D$.H.\$.H.L$.H |
| 0x3fca | 897c24204889742428e808b20600488b | .|$ H.t$(.....H. |
| 0x3fda | 442408488b5c2410488b4c2418488b7c | D$.H.\$.H.L$.H.| |
| 0x3fea | 2420488b742428e9eafdffffcccccccc | $ H.t$(......... |
| 0x3ffa | cccccccccccc493b66100f86a4000000 | ......I;f....... |
| 0x400a | 554889e54883ec20488944243048895c | UH..H.. H.D$0H.\ |
| 0x401a | 243848894c244040887c2448488d0533 | $8H.L$@@.|$HH..3 |
| 0x402a | cb0e00e8cef20000488b4c2440488948 | ........H.L$@H.H |
| 0x403a | 080fb64c2448884806488b4c24384883 | ...L$H.H.H.L$8H. |
| 0x404a | f908ba08000000480f42ca4881f90004 | .......H.B.H.... |
| 0x405a | 0000 | .. |
| 0x2434b0 | 652e6e6577496e6c696e65556e77696e | e.newInlineUnwin |
| 0x2434c0 | 6465720073797363616c6c2e636f6d70 | der.syscall.comp |
| 0x2434d0 | 696c6543616c6c6261636b0072756e74 | ileCallback.runt |
| 0x2434e0 | 696d652e6362734c6f636b0072756e74 | ime.cbsLock.runt |
| 0x2434f0 | 696d652e63616c6c6261636b61736d41 | ime.callbackasmA |
| 0x243500 | 6464720072756e74696d652e63627355 | ddr.runtime.cbsU |
| 0x243510 | 6e6c6f636b0073797363616c6c2e6c6f | nlock.syscall.lo |
| 0x243520 | 616473797374656d6c69627261727900 | adsystemlibrary. |
| 0x243530 | 73797363616c6c2e53797363616c6c4e | syscall.SyscallNGo PE with opaque identity and raw API dispatch |
| 0x243540 | 0073797363616c6c2e6c6f61646c6962 | .syscall.loadlib |
| 0x243550 | 726172790073797363616c6c2e676574 | rary.syscall.get |
| 0x243560 | 70726f63616464726573730073797363 | procaddress.sysc |
| 0x243570 | 616c6c2e53797363616c6c0073797363 | all.Syscall.sysc |
| 0x243580 | 616c6c2e53797363616c6c3600737973 | all.Syscall6.sys |
| 0x243590 | 63616c6c2e53797363616c6c39007469 | call.Syscall9.ti |
| 0x2435a0 | 6d652e72756e74696d654e616e6f0074 | me.runtimeNano.t |
| 0x2435b0 | 696d652e536c6565700072756e74696d | ime.Sleep.runtim |
| 0x2435c0 | 652e77726974650072756e74696d652e | e.write.runtime. |
| 0x2435d0 | 7472616365416476616e63650072756e | traceAdvance.run |
| 0x2435e0 | 74696d652f74726163652e72756e7469 | time/trace.runti |
| 0x2435f0 | 6d655f7472616365436c6f636b556e69 | me_traceClockUni |
| 0x243600 | 74735065725365636f6e640072756e74 | tsPerSecond.runt |
| 0x243610 | 696d652e63616c6c65727300696e7465 | ime.callers.inte |
| 0x243620 | 726e616c2f72756e74696d652f6d6170 | rnal/runtime/map |
| 0x243630 | 732e74797065537472696e670072756e | s.typeString.run |
| 0x243640 | 74696d652e6d6170696e69746e6f6f70 | time.mapinitnoop |
| 0x243650 | 00676f676f0063616c6c52657400676f | .gogo.callRet.go |
| 0x243660 | 736176655f73797374656d737461636b | save_systemstack |
| 0x243670 | 5f73776974636800736574 | _switch.set |
| 0x245ebf | 292e4572726f720073797363616c6c2e | ).Error.syscall. |
| 0x245ecf | 282a444c4c4572726f72292e556e7772 | (*DLLError).Unwr |
| 0x245edf | 61700073797363616c6c2e4c6f616444 | ap.syscall.LoadD |
| 0x245eef | 4c4c0073797363616c6c2e5554463136 | LL.syscall.UTF16 |
| 0x245eff | 50747246726f6d537472696e67007379 | PtrFromString.sy |
| 0x245f0f | 7363616c6c2e282a444c4c292e46696e | scall.(*DLL).Fin |
| 0x245f1f | 6450726f630073797363616c6c2e4279 | dProc.syscall.By |
| 0x245f2f | 746550747246726f6d537472696e6700 | tePtrFromString. |
| 0x245f3f | 73797363616c6c2e282a50726f63292e | syscall.(*Proc).Go dynamic x64 shellcode loader |
| 0x245f4f | 43616c6c0073797363616c6c2e282a50 | Call.syscall.(*P |
| 0x245f5f | 726f63292e416464720073797363616c | roc).Addr.syscal |
| 0x245f6f | 6c2e282a4c617a79444c4c292e4c6f61 | l.(*LazyDLL).Loa |
| 0x245f7f | 640073797363616c6c2e282a4c617a79 | d.syscall.(*Lazy |
| 0x245f8f | 444c4c292e4c6f61642e646566657277 | DLL).Load.deferw |
| 0x245f9f | 726170310073797363616c6c2e282a4c | rap1.syscall.(*LGo PE with opaque identity and raw API dispatch |
| 0x245faf | 617a7950726f63292e46696e64007379 | azyProc).Find.sy |
| 0x245fbf | 7363616c6c2e282a4c617a7950726f63 | scall.(*LazyProc |
| 0x245fcf | 292e46696e642e646566657277726170 | ).Find.deferwrap |
| 0x245fdf | 310073797363616c6c2e282a4c617a79 | 1.syscall.(*Lazy |
| 0x245fef | 50726f63292e43616c6c007379736361 | Proc).Call.sysca |
| 0x245fff | 6c6c2e282a4c617a7950726f63292e6d | ll.(*LazyProc).m |
| 0x24600f | 75737446696e640073797363616c6c2e | ustFind.syscall. |
| 0x24601f | 42797465536c69636546726f6d537472 | ByteSliceFromStr |
| 0x24602f | 696e670073797363616c6c2e55544631 | ing.syscall.UTF1 |
| 0x24603f | 3646726f6d537472696e670073797363 | 6FromString.sysc |
| 0x24604f | 616c6c2e5554463136546f537472696e | all.UTF16ToStrin |
| 0x24605f | 670073797363616c6c2e4572726e6f2e | g.syscall.Errno. |
| 0x24606f | 4572726f720073796e63 | Error.sync |
| 0x2ba170 | ca0dca0dcf0ddf0de60def0df20df40d | ................ |
| 0x2ba180 | 010e3a0e3f0e5b0e810ebd0ec00ed90e | ..:.?.[......... |
| 0x2ba190 | dc0edf0e000f6c0f710fda0f0010c710 | ......l.q....... |
| 0x2ba1a0 | cd10cd10d0104d1250125d1260128d12 | ......M.P.].`... |
| 0x2ba1b0 | 9012b512b812c512c812151318135a13 | ..............Z. |
| 0x2ba1c0 | 5d137c1380139913a013f513f813fd13 | ].|............. |
| 0x2ba1d0 | 00149c16a016f816001715171f173617 | ..............6. |
| 0x2ba1e0 | 40175317601773178017dd17e017e917 | @.S.`.s.........Go local shellcode execution via Proc.Call |
| 0x2ba1f0 | f017f91700181918201878188018aa18 | ........ .x..... |
| 0x2ba200 | b018f51800192b1930193b1940194019 | ......+.0.;.@.@. |
| 0x2ba210 | 44196d19701974198019ab19b019c919 | D.m.p.t......... |
| 0x2ba220 | d019da19de191b1a1e1a7c1a7f1a891a | ..........|..... |
| 0x2ba230 | 901a991aa01aad1ab01ace1a001b4c1b | ..............L. |
| 0x2ba240 | 501bf31bfc1b371c3b1c491c4d1c881c | P.....7.;.I.M... |
| 0x2ba250 | 901cba1cbd1cc71cd01cfa1c001d151f | ................Go dynamic x64 shellcode loader |
| 0x2ba260 | 181f1d1f201f451f481f4d1f501f7d1f | .... .E.H.M.P.}. |
| 0x2ba270 | 801fd31fd61fef1ff21ffe1f10202720 | ............. ' |
| 0x2ba280 | 30205e207020712074209c20a020c020 | 0 ^ p q t . . . |
| 0x2ba290 | d020f02000218b219021262440244a24 | . . .!.!.!&$@$J$Go PE with opaque identity and raw API dispatch |
| 0x2ba2a0 | 6024732b762bf32cf92c272d2d2d2d2d | `$s+v+.,.,'----- |
| 0x2ba2b0 | 302d672d6f2d702d7f2d962da02d5d2e | 0-g-o-p-.-.-.-]. |
| 0x2ba2c0 | 802ef32e002fd52ff02ffb2f01309630 | ....././././.0.0 |
| 0x2ba2d0 | 9930ff300531e331f0318ca490a4c6a4 | .0.0.1.1.1...... |
| 0x2ba2e0 | d0a42ba640a6f7a600a7caa7d0a7d9a7 | ..+.@........... |
| 0x2ba2f0 | f2a72ca830a839a840a877a880a8c5a8 | ..,.0.9.@.w..... |
| 0x2ba300 | cea8d9a8e0a853a95fa97ca980a9d9a9 | ......S._.|..... |
| 0x2ba310 | dea936aa40aa4daa50aa59aa5caac2aa | ..6.@.M.P.Y.\... |
| 0x2ba320 | dbaaf6aa01ab06ab09ab0eab11ab16ab | ................ |
| 0x2ba330 | 20ab6bab70abedabf0abf9ab00aca3d7 | .k.p........... |
| 0x2ba340 | b0d7c6d7cbd7fbd700f96dfa70fad9fa | ..........m.p... |
| 0x2ba350 | 00fb06fb13fb17fb1dfbc2fbd3fb8ffd | ................ |
| 0x2ba360 | 92fdc7fdcffdcffdf0fd19fe20fe6bfe | ............ .k. |
| 0x2ba370 | 70fefcfe01ffbeffc2ffc7ffcaffcfff | p............... |
| 0x2ba380 | d2ffd7ffdaffdcffe0ffeefffcfffdff | ................ |
| 0x2ba390 | 00000000000000000000000000000000 | ................ |
| 0x2ba3a0 | 000001004d00010050000100 | ....M...P... |
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
signed
Authenticode chain CN: goglabar.on
notable severity, 100% confident.
signed/certificate
PE leaf certificate is self-issued
baseline severity, 95% confident.
lang
Go binary built with trimpath flag
Identity
| SHA-256 | 11c217bf00fb258a9ee43151d7f33c39b1aa8b69bd40ad86c9dcbb0211eeffdd |
|---|---|
| Filename | file |
| Package | 11c217bf00fb258a9ee43151d7f33c39b1aa8b69bd40ad86c9dcbb0211eeffdd |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | windows |
| Domain | abuse.ch |
Timeline
| First seen | 24 Jul 2026 10:25 UTC |
|---|---|
| First analyzed | 25 Jul 2026 14:40 UTC |
| Last analyzed | 25 Jul 2026 14:40 UTC |
| Last updated | 25 Jul 2026 14:40 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 9266e |
Not seeing what you expected? Let us know