unclassified-go-pe64: 9665ccc9 — Go 1.25.1 PE64+ with fake WindowsSoundDiagnostics source-path masquerade

Executive Summary

A 1.73 MB stripped Go 1.25.1 PE64+ binary with no observable malicious strings, no network IOCs, and a single kernel32.dll import table. Its only distinguishing static trait is a fabricated GOPATH tree (C:/Users/K/AppData/Local/Packages/Microsoft.WindowsSoundDiagnostics/Cache/Go/src/...) embedded 238 times in the runtime pclntab. Static analysis alone cannot confirm malicious intent; the sample may be an early-stage dropper, a benign utility, or a mislabelled submission.

What It Is

How It Works

The binary is a standard Go command-line application compiled with the standard toolchain. The -s -w linker flags strip DWARF debug info and the external symbol table, leaving only the Go runtime pclntab for stack unwinding. Because pclntab retains source-file names for panic traces, the actor’s fabricated GOPATH survives stripping and is visible in plain strings. This technique is documented at go-fake-sourcepath-masquerade.

No standard Go third-party packages are referenced in strings. The import table resolves exclusively to kernel32.dll functions required by the Go runtime (threading, memory, console, exception handling). There are no net/http, crypto/tls, encoding/json, or browser-/credential-related symbols. The application’s main.main is present at strings.txt:4904 but its body contains no static strings.

Binwalk reports no embedded archives, no zlib overlays, and no UPX/packer signatures. ^[binwalk.txt] Capa analysis failed due to missing signatures on the analysis host. ^[capa.txt] FLOSS failed with a CLI argument error. ^[floss.txt]

The binary may:

1. Download or decrypt a second stage at runtime (no static evidence).
2. Be a benign driver utility mis-submitted to MalwareBazaar.
3. Hide payload logic inside compiled Go bytecode that does not surface asstrings.

Decompiled Behavior

The entry point (entry0 at 0x1400753c0) is the standard Go rt0_windows_amd64 bootstrap: it initializes the G structure, sets up the thread-local storage via qword gs:[rbx], calls runtime·init, and branches to main.main. ^[r2:entry0] No custom TLS callbacks, no anti-debug checks, no VM detection. The cyclomatic complexity of the entry routine is 7 — entirely consistent with a minimal Go stub.

C2 Infrastructure

None observed. No hardcoded IPs, domains, URLs, Telegram bot tokens, or cryptocurrency wallet strings were recovered. All network-related symbols are Go runtime internals (WSAStartup, closesocket, getpeername, etc.) used by the standard library net package. C2, if present, is runtime-resolved or encrypted.

Interesting Tidbits

• The fake package name Microsoft.WindowsSoundDiagnostics masquerades as a legitimate Windows app; the real system packages are Microsoft.WindowsSoundRecorder and RealtekAudio. ^[strings.txt:4908]
• Username K in the path suggests a single developer or small team with minimal OPSEC.
• The 1970-01-01 timestamp is common for Go binaries built without $SOURCE_DATE_EPOCH set, or deliberately zeroed to frustrate chronological clustering.
• Section .text entropy is 6.22, .rdata is 5.49 — both within normal ranges for a Go stdlib binary. ^[pefile.txt:91,111]

How To Mess With It (Homelab Replication)

Build a comparable stripped Go binary:

go1.25.1 version  # verify toolchain
export CGO_ENABLED=0
export GOOS=windows
export GOARCH=amd64
go build -ldflags="-H=windowsgui -s -w" -o stub.exe main.go

Set a fake source path by placing the module inside a directory named Microsoft.WindowsSoundDiagnostics/Cache/Go/src/... before building, or use go build -trimpath which strips source paths entirely (absent here, confirming deliberate placement).

Verification: run strings stub.exe | grep -i realtek — should match this sample’s masquerade fingerprint.

Deployable Signatures

YARA Rule

rule go_fake_sourcepath_masquerade : evasion {
    meta:
        description = "Go binary with fabricated Microsoft.WindowsSoundDiagnostics source path in pclntab"
        author = "pp-hermes"
        date = "2026-06-17"
        hash = "9665ccc9c343bbb48847b09f7b771995083eba55823ad0284caa68a6a032368b"
    strings:
        $a = "Microsoft.WindowsSoundDiagnostics/Cache/Go/src/" ascii wide
        $b = "EnableRealtekHDMIAudio.go" ascii wide
        $c = "Go build ID:" ascii
        $d = "go1.25" ascii
    condition:
        uint16(0) == 0x5A4D and
        ($a or $b) and $c and $d
}

IOC List

Behavioral Fingerprint

A Go 1.25.1 PE64+ with -s -w linker flags launches as a GUI subsystem process, imports only kernel32.dll, and contains no static network or credential-theft indicators. If observed in a sandbox, its behavioral signature is a single-threaded Go runtime init followed by either immediate termination or an opaque network fetch with no static C2 endpoints.

Detection Signatures

No capa output available (signature path missing on host) ^[capa.txt]. Static indicators map loosely to MITRE ATT&CK T1027.002 (Obfuscated Files or Information:Software Packing) because -s -w stripping removes debug symbols, and potentially T1036.005 (Masquerading: Match Legitimate Name or Location) via the fake source path.

References

• Sample: 9665ccc9c343bbb48847b09f7b771995083eba55823ad0284caa68a6a032368b
• MalwareBazaar / abuse.ch (via OpenCTI connector)
• Related wiki pages: unclassified-go-pe64, go-fake-sourcepath-masquerade

Provenance

Sources: file.txt, pefile.txt, strings.txt, rabin2-info.txt, binwalk.txt, capa.txt, floss.txt, exiftool.json, ssdeep.txt, tlsh.txt, triage.json. Radare2 v5.x used for decompilation (function entry0). No Ghidra output produced — radare2 was sufficient for this stripped Go entry routine. Static-only analysis; CAPE detonation skipped because no Windows guest was available. ^[dynamic-analysis.md]