Open-source atomic malware analysis

Analyze another

known_windows_test.go

GO
Verdict: HOSTILE
Mal-ecule
O(Eu)H₂(CrDb)Md
Size 2.8 KB download
First seen 37 days ago
Analyzed 36 days ago
Ecosystem windows

Objectives

Micro-behaviors

Metadata

0x2e errors
0x2f errors
0x38 strings
0x39 strings
0x43 testing
0x44 testing
0x4f golang.org/x/sys/windows
0x50 golang.org/x/sys/windows
0x21d Profile
0x21e Profile
0x246 Desktop
0x247 Desktop
0x26f Documents
0x270 Documents
0x29c Downloads
0x29d Downloads
0x2c9 LocalAppData
0x2ca LocalAppData
0x2fc RoamingAppData
0x2fd RoamingAppData
0x333 Programs
0x334 Programs
0x35e Startup
0x35f Startup
0x387 System
0x388 System
0x3ae Windows
0x3af Windows
0x3d7 ProgramFiles
0x3d8 ProgramFiles
0x40a ProgramFilesX86
0x40b ProgramFilesX86
0x443 PublicDesktop
0x444 PublicDesktop
0x517 GetKnown(%s) err = %v, want nil
0x518 GetKnown(%s) err = %v, want nil
0x56d GetKnown(%s) returned empty path
0x56e GetKnown(%s) returned empty path
0x5d4 GetKnown(%s) = %q, want drive-letter prefix
0x5d5 GetKnown(%s) = %q, want drive-letter prefix
0x778 GetKnown(Documents, KF_FLAG_CREATE) err = %v
0x779 GetKnown(Documents, KF_FLAG_CREATE) err = %v
0x7dd documents
0x7de documents
0x7f7 expected path containing 'documents', got %q
0x7f8 expected path containing 'documents', got %q
0x967 A @A
0x98d {DEADBEEF-DEAD-BEEF-DEAD-BEEFDEADBEEF}
0x98e {DEADBEEF-DEAD-BEEF-DEAD-BEEFDEADBEEF}
0x9d3 guid parse: %v
0x9d4 guid parse: %v
0xa73 GetKnown(bogus) err = %v, want ErrKnownFolderNotFound
0xa74 GetKnown(bogus) err = %v, want ErrKnownFolderNotFound
0xad0 GetKnown(bogus) path = %q, want empty
0xad1 GetKnown(bogus) path = %q, want empty

Imports

t.Run
GetKnown
t.Fatalf
t.Fatalf
len
t.Errorf
GetKnown
t.Fatalf
strings.Contains
strings.ToLower
t.Errorf
windows.GUIDFromString
t.Fatalf
windows.KNOWNFOLDERID
GetKnown
errors.Is
t.Fatalf
t.Errorf
testing
strings
errors
golang.org/x/sys/windows
No sections found

comments

base64 in comments 5
chars 718
high entropy comments 3
lines 13
to code ratio 0.19
total 13

file

size 2820

functions

avg length lines 19
avg name length 34.33
code in functions ratio 0.69
density per 100 lines 3.61
high entropy names 3
length stddev 10.8
max length lines 34
min length lines 9
no params count 3
total 3

identifiers

all lowercase ratio 0.65
all uppercase ratio 0.06
avg entropy 2.18
avg length 10.82
high entropy count 3
high entropy ratio 0.18
length stddev 13.22
max length 54
min length 1
reuse ratio 0.22
sequential names 1
single char count 2
single char ratio 0.12
total 78
underscore prefix count 1
unique count 17

imports

stdlib count 3
stdlib ratio 0.14
third party count 19
third party ratio 0.86
total 22
unique modules 14

strings

avg entropy 3.31
avg length 19.07
entropy stddev 0.71
max length 53
total 54
total bytes 1030

text

avg line length 32.98
char entropy 5.41
digit ratio 0.01
empty line ratio 0.07
high byte ratio 0
identifier density 0.94
identifiers to functions ratio 5.67
import density 26.51
imports to functions ratio 7.33
last line length 1
line length stddev 25.56
max inline whitespace run 3
max line length 79
most common char t
most common ratio 0.06
non ascii ratio 0
normalized function count 0.33
normalized import count 2.41
normalized string count 5.93
normalized unique identifiers 2.67
space count 222
string density 0.65
strings to functions ratio 18
suspicious comment ratio 0.62
suspicious identifier ratio 0.06
tab count 100
total lines 83
unique chars 82
whitespace ratio 0.14
source.functions[0] TestGetKnown_KFCreate
source.functions[1] TestGetKnown_KnownIDsResolve
source.functions[2] TestGetKnown_UnknownGUID_ReturnsErrKnownFolderNotFound
source.has_imports true
source.imports[0] GetKnown
source.imports[10] t.Run
source.imports[11] testing
source.imports[12] windows.GUIDFromString
source.imports[13] windows.KNOWNFOLDERID
source.imports[1] errors
source.imports[2] errors.Is
source.imports[3] golang.org/x/sys/windows
source.imports[4] len
source.imports[5] strings
source.imports[6] strings.Contains
source.imports[7] strings.ToLower
source.imports[8] t.Errorf
source.imports[9] t.Fatalf
source.strings[0] A @A
source.strings[10] LocalAppData
source.strings[11] Profile
source.strings[12] ProgramFiles
source.strings[13] ProgramFilesX86
source.strings[14] Programs
source.strings[15] PublicDesktop
source.strings[16] RoamingAppData
source.strings[17] Startup
source.strings[18] System
source.strings[19] Windows
source.strings[1] Desktop
source.strings[20] documents
source.strings[21] errors
source.strings[22] expected path containing 'documents', got %q
source.strings[23] golang.org/x/sys/windows
source.strings[24] guid parse: %v
source.strings[25] strings
source.strings[26] testing
source.strings[27] {DEADBEEF-DEAD-BEEF-DEAD-BEEFDEADBEEF}
source.strings[2] Documents
source.strings[3] Downloads
source.strings[4] GetKnown(%s) = %q, want drive-letter prefix
source.strings[5] GetKnown(%s) err = %v, want nil
source.strings[6] GetKnown(%s) returned empty path
source.strings[7] GetKnown(Documents, KF_FLAG_CREATE) err = %v
source.strings[8] GetKnown(bogus) err = %v, want ErrKnownFolderNotFound
source.strings[9] GetKnown(bogus) path = %q, want empty

Identity

SHA-256 26a52e4c58ba8ea5e28d9f9e894757685a4944a2a8f855697b4baf619bffb5da
Filename known_windows_test.go

Origin

Ecosystem windows

Timeline

First seen 8 May 2026 16:27 UTC
Last analyzed 9 May 2026 16:49 UTC