AI
Obfuscated Go loader with direct syscalls
Local reference
Suspicious dependency
Inferred
Mal-ecule
O₂(As₂C)H(Os)Md₃(PtBiSi₃)
Go PE with opaque identity and raw API dispatch: QuickFetch.exe:0x1a418c
Go PE with opaque build identity and dynamic API dispatch: QuickFetch.exe:0x1a418c
Go build path is opaque random: QuickFetch.exe
| 0x1a410c | 652e6e6577496e6c696e65556e77696e | e.newInlineUnwin |
| 0x1a411c | 6465720073797363616c6c2e636f6d70 | der.syscall.comp |
| 0x1a412c | 696c6543616c6c6261636b0072756e74 | ileCallback.runt |
| 0x1a413c | 696d652e6362734c6f636b0072756e74 | ime.cbsLock.runt |
| 0x1a414c | 696d652e63616c6c6261636b61736d41 | ime.callbackasmA |
| 0x1a415c | 6464720072756e74696d652e63627355 | ddr.runtime.cbsU |
| 0x1a416c | 6e6c6f636b0073797363616c6c2e6c6f | nlock.syscall.lo |
| 0x1a417c | 616473797374656d6c69627261727900 | adsystemlibrary. |
| 0x1a418c | 73797363616c6c2e53797363616c6c4e | syscall.SyscallNGo PE with opaque build identity and dynamic API dispatch |
| 0x1a419c | 0073797363616c6c2e6c6f61646c6962 | .syscall.loadlib |
| 0x1a41ac | 726172790073797363616c6c2e676574 | rary.syscall.get |
| 0x1a41bc | 70726f63616464726573730073797363 | procaddress.syscGo PE with opaque identity and raw API dispatch |
| 0x1a41cc | 616c6c2e53797363616c6c0073797363 | all.Syscall.sysc |
| 0x1a41dc | 616c6c2e53797363616c6c3600737973 | all.Syscall6.sys |
| 0x1a41ec | 63616c6c2e53797363616c6c39007469 | call.Syscall9.ti |
| 0x1a41fc | 6d652e72756e74696d654e6f77007469 | me.runtimeNow.ti |
| 0x1a420c | 6d652e72756e74696d654e616e6f0074 | me.runtimeNano.t |
| 0x1a421c | 696d652e536c6565700074696d652e6e | ime.Sleep.time.n |
| 0x1a422c | 657754696d65720074696d652e73746f | ewTimer.time.sto |
| 0x1a423c | 7054696d65720072756e74696d652e77 | pTimer.runtime.w |
| 0x1a424c | 726974650072756e74696d652e747261 | rite.runtime.tra |
| 0x1a425c | 6365416476616e63650072756e74696d | ceAdvance.runtim |
| 0x1a426c | 652f74726163652e72756e74696d655f | e/trace.runtime_ |
| 0x1a427c | 7472616365436c6f636b556e69747350 | traceClockUnitsP |
| 0x1a428c | 65725365636f6e640072756e74696d65 | erSecond.runtime |
| 0x1a429c | 2e63616c6c65727300696e7465726e61 | .callers.interna |
| 0x1a42ac | 6c2f72756e74696d652f6d6170732e74 | l/runtime/maps.t |
| 0x1a42bc | 797065537472696e670072756e74696d | ypeString.runtim |
| 0x1a42cc | 652e6d6170696e69746e6f | e.mapinitno |
| 0x1a6fcc | 6450726f630073797363616c6c2e4279 | dProc.syscall.By |
| 0x1a6fdc | 746550747246726f6d537472696e6700 | tePtrFromString. |
| 0x1a6fec | 73797363616c6c2e282a50726f63292e | syscall.(*Proc). |
| 0x1a6ffc | 43616c6c0073797363616c6c2e282a50 | Call.syscall.(*P |
| 0x1a700c | 726f63292e416464720073797363616c | roc).Addr.syscal |
| 0x1a701c | 6c2e282a4c617a79444c4c292e4c6f61 | l.(*LazyDLL).Loa |
| 0x1a702c | 640073797363616c6c2e282a4c617a79 | d.syscall.(*Lazy |
| 0x1a703c | 444c4c292e4c6f61642e646566657277 | DLL).Load.deferw |
| 0x1a704c | 726170310073797363616c6c2e282a4c | rap1.syscall.(*LGo PE with opaque identity and raw API dispatch |
| 0x1a705c | 617a7950726f63292e46696e64007379 | azyProc).Find.sy |
| 0x1a706c | 7363616c6c2e282a4c617a7950726f63 | scall.(*LazyProc |
| 0x1a707c | 292e46696e642e646566657277726170 | ).Find.deferwrap |
| 0x1a708c | 310073797363616c6c2e282a4c617a79 | 1.syscall.(*Lazy |
| 0x1a709c | 50726f63292e43616c6c007379736361 | Proc).Call.sysca |
| 0x1a70ac | 6c6c2e282a4c617a7950726f63292e6d | ll.(*LazyProc).m |
| 0x1a70bc | 75737446696e640073797363616c6c2e | ustFind.syscall. |
| 0x1a70cc | 42797465536c69636546726f6d537472 | ByteSliceFromStr |
| 0x1a70dc | 696e670073797363616c6c2e55544631 | ing.syscall.UTF1 |
| 0x1a70ec | 3646726f6d537472696e670073797363 | 6FromString.sysc |
| 0x1a70fc | 616c6c2e5554463136546f537472696e | all.UTF16ToStrin |
| 0x1a710c | 670073797363616c6c2e4572726e6f2e | g.syscall.Errno. |
| 0x1a711c | 4572726f720073796e63 | Error.sync |
| 0x1af0c1 | 6c77677572006d61696e2e666365636b | lwgur.main.fceck |
| 0x1af0d1 | 67666c767064767a6c6c6278646d7600 | gflvpdvzllbxdmv. |
| 0x1af0e1 | 6d61696e2e756771786e727667746c7a | main.ugqxnrvgtlz |
| 0x1af0f1 | 7277006d61696e2e6a766e6a7a72626b | rw.main.jvnjzrbk |
| 0x1af101 | 786c74760073797363616c6c2e282a4c | xltv.syscall.(*L |
| 0x1af111 | 617a79444c4c292e4e657750726f6300 | azyDLL).NewProc. |
| 0x1af121 | 6d61696e2e4979777062657a7179776d | main.IywpbezqywmGo types with concatenated-word obfuscation |
| 0x1af131 | 797374667a6974006d61696e2e436a6e | ystfzit.main.Cjn |
| 0x1af141 | 626a6b736f6c616e64696f6262666300 | bjksolandiobbfc. |
| 0x1af151 | 6d61696e2e626a78696d71666a6a7069 | main.bjximqfjjpi |
| 0x1af161 | 6a796c646668006d6174682f72616e64 | jyldfh.math/rand |
| 0x1af171 | 2e4e6577006d6174682f72616e642e4e | .New.math/rand.N |
| 0x1af181 | 6577536f75726365006d6174682f7261 | ewSource.math/ra |
| 0x1af191 | 6e642e6e6577536f75726365006d6174 | nd.newSource.mat |
| 0x1af1a1 | 682f72616e642e282a52616e64292e46 | h/rand.(*Rand).F |
| 0x1af1b1 | 6c6f61743634006d61696e2e70787a6c | loat64.main.pxzl |
| 0x1af1c1 | 6e006d61696e2e627469637100656e63 | n.main.bticq.enc |
| 0x1af1d1 | 6f64696e672f6865782e456e636f6465 | oding/hex.Encode |
| 0x1af1e1 | 546f537472696e6700656e636f64696e | ToString.encodin |
| 0x1af1f1 | 672f6865782e456e636f6465006d6169 | g/hex.Encode.mai |
| 0x1af201 | 6e2e687373666762636f6e7079766e | n.hssfgbconpyvn |
| 0x23c150 | 9a999901185d740156555501b2133b01 | .....]t.VUU...;. |
| 0x23c160 | 4a9224011211110100000001398ee300 | J.$.........9... |
| 0x23c170 | cdcccc008c2eba00abaaaa00d9899d00 | ................ |
| 0x23c180 | 2549920089888800000080001dc77100 | %I............q. |
| 0x23c190 | 6766660046175d005655550093244900 | gff.F.].VUU..$I. |
| 0x23c1a0 | 000040008fe3380034333300a38b2e00 | ..@...8.433..... |
| 0x23c1b0 | abaa2a004a92240000002000c8711c00 | ..*.J.$... ..q.. |
| 0x23c1c0 | 8761180056551500e27a140085f61200 | .a..VU...z...... |
| 0x23c1d0 | 0000100044790d00c4300c00abaa0a00 | ....Dy...0...... |
| 0x23c1e0 | 0b0a0a000fa90900437b090000000800 | ........C{...... |
| 0x23c1f0 | 3feb0600a2bc06006766060007060600 | ?.......gf...... |
| 0x23c200 | 5655050088d404004a92040000000400 | VU......J....... |
| 0x23c210 | 398e0300ae6f03003433030004030300 | 9....o..43...... |
| 0x23c220 | abaa02005d6702002549020000000200 | ....]g..%I...... |
| 0x23c230 | 00000000000000000000000000000000 | ................Go PE with opaque identity and raw API dispatch |
| 0x23c240 | 70c5234001000000b0c4234001000000 | p.#@......#@.... |
| 0x23c250 | a0c423400100000080c4234001000000 | ..#@......#@.... |
| 0x23c260 | 00ca23400100000070c4234001000000 | ..#@....p.#@.... |
| 0x23c270 | 40c523400100000030c6234001000000 | @.#@....0.#@.... |
| 0x23c280 | 00c523400100000050c4234001000000 | ..#@....P.#@.... |
| 0x23c290 | c0c423400100000020c4234001000000 | ..#@.... .#@.... |
| 0x23c2a0 | 20c523400100000050c5234001000000 | .#@....P.#@.... |
| 0x23c2b0 | 90c423400100000030c5234001000000 | ..#@....0.#@.... |
| 0x23c2c0 | 10c5234001000000e0c6234001000000 | ..#@......#@.... |
| 0x23c2d0 | f0c4234001000000e0c4234001000000 | ..#@......#@.... |
| 0x23c2e0 | 90c623400100000060c5234001000000 | ..#@....`.#@.... |
| 0x23c2f0 | 40c723400100000060c7234001000000 | @.#@....`.#@.... |
| 0x23c300 | 90c523400100000080c5234001000000 | ..#@......#@.... |
| 0x23c310 | 80c723400100000070c6234001000000 | ..#@....p.#@.... |
| 0x23c320 | a0c7234001000000d0c4234001000000 | ..#@......#@.... |
| 0x23c330 | 30c423400100000040c42340 | 0.#@....@.#@ |
| 0x27e5e5 | 746166697073656e6400676f3a6d6169 | tafipsend.go:mai |
| 0x27e5f5 | 6e2e696e69747461736b7300676f3a72 | n.inittasks.go:r |
| 0x27e605 | 756e74696d652e696e69747461736b73 | untime.inittasks |
| 0x27e615 | 0072756e74696d652e6275696c645665 | .runtime.buildVe |
| 0x27e625 | 7273696f6e2e7374720072756e74696d | rsion.str.runtim |
| 0x27e635 | 652e6d6f64696e666f2e737472007275 | e.modinfo.str.ru |
| 0x27e645 | 6e74696d652e747970656c696e6b0072 | ntime.typelink.r |
| 0x27e655 | 756e74696d652e697461626c696e6b00 | untime.itablink. |
| 0x27e665 | 676f3a6275696c64696e666f00676f3a | go:buildinfo.go:Go PE with opaque build identity and dynamic API dispatch |
| 0x27e675 | 6275696c64696e666f2e726566007275 | buildinfo.ref.ru |
| 0x27e685 | 6e74696d652e70636c6e746162007275 | ntime.pclntab.ru |
| 0x27e695 | 6e74696d652e66696e6466756e637461 | ntime.findfuncta |
| 0x27e6a5 | 620072756e74696d652e726f64617461 | b.runtime.rodata |
| 0x27e6b5 | 0072756e74696d652e65726f64617461 | .runtime.erodata |
| 0x27e6c5 | 0072756e74696d652e74797065730072 | .runtime.types.r |
| 0x27e6d5 | 756e74696d652e657479706573007275 | untime.etypes.ru |
| 0x27e6e5 | 6e74696d652e6e6f7074726461746100 | ntime.noptrdata. |
| 0x27e6f5 | 72756e74696d652e656e6f7074726461 | runtime.enoptrda |
| 0x27e705 | 74610072756e74696d652e6461746100 | ta.runtime.data. |
| 0x27e715 | 72756e74696d652e6564617461007275 | runtime.edata.ru |
| 0x27e725 | 6e74696d652e6273730072756e74696d | ntime.bss.runtim |
| 0x27e735 | 652e656273730072756e74696d652e6e | e.ebss.runtime.n |
| 0x27e745 | 6f7074726273730072756e74696d652e | optrbss.runtime. |
| 0x27e755 | 656e6f7074726273730072756e74696d | enoptrbss.runtim |
| 0x27e765 | 652e636f7663747273007275 | e.covctrs.ru |
Objectives
Micro-behaviors
Metadata
notable severity, 100% confident.
signed
Authenticode chain CN: trust.me
notable severity, 100% confident.
signed/certificate
PE leaf certificate is self-issued
baseline severity, 95% confident.
lang
Go binary built with trimpath flag
Identity
| SHA-256 | 941839c9e6720789cfacbe9993db460b8033a1da421ef3abacd94b75d5c886b3 |
|---|---|
| Filename | QuickFetch.exe |
| Package | 941839c9e6720789cfacbe9993db460b8033a1da421ef3abacd94b75d5c886b3 |
Origin
| Source | harvest |
|---|---|
| Feed | malwarebazaar |
| Ecosystem | windows |
| Domain | abuse.ch |
Timeline
| First seen | 23 Jul 2026 13:33 UTC |
|---|---|
| First analyzed | 25 Jul 2026 06:06 UTC |
| Last analyzed | 25 Jul 2026 06:06 UTC |
| Last updated | 25 Jul 2026 06:06 UTC |
Labeling
| Label | bad |
|---|---|
| Label source | harvest |
| Traits version | 9266e |
Not seeing what you expected? Let us know