Open-source atomic malware analysis

Analyze another

decoder.go

GO
Verdict: HOSTILE
SHA256: 766f95cedb31f68b0e1e24553d281d317d108d05447db6045b64b01c92d2aaee
Mal-ecule
O(Eu)H₂(CrDb)Md
Size 6.4 KB download
First seen 38 days ago
Analyzed 37 days ago
Ecosystem windows

Found in 3 archives

Objectives

Micro-behaviors

Metadata

0x1a bytes
0x1b bytes
0x23 debug/dwarf
0x24 debug/dwarf
0x32 errors
0x33 errors
0x3c fmt
0x3d fmt
0x43 io
0x44 io
0x4a github.com/tetratelabs/wazero/api
0x4b github.com/tetratelabs/wazero/api
0x6f github.com/tetratelabs/wazero/internal/leb128
0x70 github.com/tetratelabs/wazero/internal/leb128
0xa0 github.com/tetratelabs/wazero/internal/wasm
0xa1 github.com/tetratelabs/wazero/internal/wasm
0xcf github.com/tetratelabs/wazero/internal/wasmdebug
0xd0 github.com/tetratelabs/wazero/internal/wasmdebug
0x163 // See https://www.w3.org/TR/2019/REC-wasm-core-1-20191205/#binary-format①
0x4b5 // See https://www.w3.org/TR/2019/REC-wasm-core-1-20191205/#modules①⓪
0x57f read section id: %w
0x580 read section id: %w
0x5fc get size of section %s: %v
0x5fd get size of section %s: %v
0x726 custom section name
0x727 custom section name
0x7af malformed custom section %s
0x7b0 malformed custom section %s
0x7f3 name
0x7f4 name
0x829 redundant custom section %s
0x82a redundant custom section %s
0x8e7 name
0x8e8 name
0x989 failed to read custom section name[%s]: %w
0x98a failed to read custom section name[%s]: %w
0xa33 .debug_info
0xa34 .debug_info
0xa62 .debug_line
0xa63 .debug_line
0xa91 .debug_str
0xa92 .debug_str
0xabe .debug_abbrev
0xabf .debug_abbrev
0xaf1 .debug_ranges
0xaf2 .debug_ranges
0xb97 failed to skip name[%s]: %w
0xb98 failed to skip name[%s]: %w
0x1026 multiple start sections are invalid
0x1027 multiple start sections are invalid
0x121e data count section not supported as %v
0x121f data count section not supported as %v
0x132a invalid section length: expected to be %d but got %d
0x132b invalid section length: expected to be %d but got %d
0x13ab section %s: %v
0x13ac section %s: %v
0x1520 function and code section have inconsistent lengths: %d != %d
0x1521 function and code section have inconsistent lengths: %d != %d

Imports

bytes.NewReader
make
io.ReadFull
bytes.Equal
io.ReadFull
bytes.Equal
newMemorySizer
r.ReadByte
fmt.Errorf
leb128.DecodeUint32
fmt.Errorf
wasm.SectionIDName
r.Len
decodeUTF8
fmt.Errorf
fmt.Errorf
decodeCustomSection
uint64
fmt.Errorf
append
io.CopyN
int64
fmt.Errorf
decodeNameSection
uint64
decodeTypeSection
decodeImportSection
decodeFunctionSection
decodeTableSection
decodeMemorySection
decodeGlobalSection
decodeExportSection
errors.New
decodeStartSection
decodeElementSection
decodeCodeSection
decodeDataSection
enabledFeatures.RequireEnabled
fmt.Errorf
decodeDataCountSection
r.Len
int
fmt.Errorf
fmt.Errorf
wasm.SectionIDName
dwarf.New
wasmdebug.NewDWARFLines
m.SectionElementCount
m.SectionElementCount
fmt.Errorf
io
bytes
github.com/tetratelabs/wazero/internal/leb128
github.com/tetratelabs/wazero/internal/wasm
fmt
debug/dwarf
errors
github.com/tetratelabs/wazero/api
github.com/tetratelabs/wazero/internal/wasmdebug
No sections found

comments

base64 in comments 1
chars 900
high entropy comments 3
lines 16
to code ratio 0.09
todo count 1
total 16
url in comments 2

file

size 6574

functions

avg length lines 85
avg name length 13
code in functions ratio 0.88
density per 100 lines 1.04
length stddev 63
max length lines 148
min length lines 22
no params count 2
over 100 lines 1
total 2

identifiers

all lowercase ratio 0.43
all uppercase ratio 0.01
avg entropy 2.5
avg length 9.87
base64 like names 1
has digit ratio 0.06
high entropy count 4
high entropy ratio 0.06
length stddev 6.58
max length 22
min length 1
numeric suffix count 4
reuse ratio 0.23
sequential names 4
single char count 5
single char ratio 0.07
total 302
underscore prefix count 1
unique count 70

imports

stdlib count 5
stdlib ratio 0.08
third party count 54
third party ratio 0.92
total 59
unique modules 44

strings

avg entropy 3.29
avg length 23.18
embedded code candidates 2
entropy stddev 0.86
max length 61
total 56
total bytes 1298

text

avg line length 33.06
char entropy 5.09
digit ratio 0.02
empty line ratio 0.09
identifier density 1.56
identifiers to functions ratio 35
import density 30.57
imports to functions ratio 29.5
last line length 1
line length stddev 30.69
max inline whitespace run 1
max line length 197
most common char e
most common ratio 0.09
normalized function count 0.14
normalized import count 4.25
normalized string count 4.03
normalized unique identifiers 9.22
space count 578
string density 0.29
strings to functions ratio 28
suspicious comment ratio 0.25
suspicious identifier ratio 0.07
suspicious string ratio 0.04
tab count 455
total lines 193
unique chars 80
whitespace ratio 0.19
source.functions[0] DecodeModule
source.functions[1] newMemorySizer
source.has_imports true
source.imports[0] append
source.imports[10] decodeExportSection
source.imports[11] decodeFunctionSection
source.imports[12] decodeGlobalSection
source.imports[13] decodeImportSection
source.imports[14] decodeMemorySection
source.imports[15] decodeNameSection
source.imports[16] decodeStartSection
source.imports[17] decodeTableSection
source.imports[18] decodeTypeSection
source.imports[19] decodeUTF8
source.imports[1] bytes
source.imports[20] dwarf.New
source.imports[21] enabledFeatures.RequireEnabled
source.imports[22] errors
source.imports[23] errors.New
source.imports[24] fmt
source.imports[25] fmt.Errorf
source.imports[26] github.com/tetratelabs/wazero/api
source.imports[27] github.com/tetratelabs/wazero/internal/leb128
source.imports[28] github.com/tetratelabs/wazero/internal/wasm
source.imports[29] github.com/tetratelabs/wazero/internal/wasmdebug
source.imports[2] bytes.Equal
source.imports[30] int
source.imports[31] int64
source.imports[32] io
source.imports[33] io.CopyN
source.imports[34] io.ReadFull
source.imports[35] leb128.DecodeUint32
source.imports[36] m.SectionElementCount
source.imports[37] make
source.imports[38] newMemorySizer
source.imports[39] r.Len
source.imports[3] bytes.NewReader
source.imports[40] r.ReadByte
source.imports[41] uint64
source.imports[42] wasm.SectionIDName
source.imports[43] wasmdebug.NewDWARFLines
source.imports[4] debug/dwarf
source.imports[5] decodeCodeSection
source.imports[6] decodeCustomSection
source.imports[7] decodeDataCountSection
source.imports[8] decodeDataSection
source.imports[9] decodeElementSection
source.strings[0] .debug_abbrev
source.strings[10] errors
source.strings[11] failed to read custom section name[%s]: %w
source.strings[12] failed to skip name[%s]: %w
source.strings[13] function and code section have inconsistent lengths: %d != %d
source.strings[14] get size of section %s: %v
source.strings[15] github.com/tetratelabs/wazero/api
source.strings[16] github.com/tetratelabs/wazero/internal/leb128
source.strings[17] github.com/tetratelabs/wazero/internal/wasm
source.strings[18] github.com/tetratelabs/wazero/internal/wasmdebug
source.strings[19] invalid section length: expected to be %d but got %d
source.strings[1] .debug_info
source.strings[20] malformed custom section %s
source.strings[21] multiple start sections are invalid
source.strings[22] read section id: %w
source.strings[23] redundant custom section %s
source.strings[24] section %s: %v
source.strings[2] .debug_line
source.strings[3] .debug_ranges
source.strings[4] .debug_str
source.strings[5] // See https://www.w3.org/TR/2019/REC-wasm-core-1-20191205/#binary-format①
source.strings[6] // See https://www.w3.org/TR/2019/REC-wasm-core-1-20191205/#modules①⓪
source.strings[7] custom section name
source.strings[8] data count section not supported as %v
source.strings[9] debug/dwarf

Identity

SHA-256 766f95cedb31f68b0e1e24553d281d317d108d05447db6045b64b01c92d2aaee
Filename decoder.go

Origin

Ecosystem windows

Timeline

First seen 7 May 2026 10:22 UTC
Last analyzed 8 May 2026 17:24 UTC