uniqfile: a1943a9a — Go 1.18.5 PE64+ signed with starkvillesd.com cert, zero static C2, gcleaner umbrella drop

Executive Summary

Go-compiled PE32+ x64 binary (1.65 MB) distributed under the dropped-by-gcleaner umbrella label. Authenticode-signed with a short-lived R12 intermediate cert issued to starkvillesd.com. No hardcoded C2, no .rsrc section, and no observable malicious strings in the static image — the payload logic is either runtime-resolved or lives inside the (unsigned) Go runtime itself. Static-only analysis; no CAPE detonation available. Family attribution is the OpenCTI label uniq.file, treated here as a low-confidence umbrella tag.

What It Is

The binary carries a .symtab section (discardable, entropy 5.03) that holds Go symbol table data — typical for Go builds that are not stripped with -s -w. This gives us rich runtime type names but no payload-specific strings.

How It Works

Static analysis reveals a standard Go Windows runtime bootstrap with no custom imports beyond the Go syscall shims (kernel32.dll: VirtualAlloc, CreateThread, LoadLibraryA/W, etc.) ^[pefile.txt:248]. The import table is small (42 imports) and entirely runtime/syscall surface — no WinInet, no Crypt32, no WS2_32 direct imports. This is consistent with Go's preference for internal syscall wrappers.

There is no CAPE detonation for this sample (Windows guest unavailable) ^[dynamic-analysis.md]. All behavior inference below is static-only and therefore speculative:

• The dropped-by-gcleaner tag places this sample in a multi-payload distribution cluster that drops disparate families (euone, bb5file, us0file, etc.) ^[gcleaner].
• The randomized module path vFsFeEitfcsqNDz is a known anti-triage / anti-reputation technique shared with the golang-stealer-build-pattern cluster (Go 1.25.4+), but this sample uses the older Go 1.18.5 toolchain — a possible precursor or separate branch.
• No hardcoded C2 URLs, IP addresses, Telegram bot tokens, wallet addresses, or credential paths appear in the string table. Any C2 logic is either:
  • Encrypted / obfuscated and decrypted at runtime inside the .data section, or
  • Downloaded as a second stage by the gcleaner dropper infrastructure.
• The Authenticode certificate (starkvillesd.com) is a short-lived DV-style intermediate (R12). Certificate overlap with other samples in this corpus is not observed; it may be campaign-specific.

Decompiled Behavior

Entry point 0x00457e00 is the standard Go rt0_go bootstrap sequence on Windows amd64:

1. Reads argc/argv from stack.
2. Aligns RSP to 16-byte boundary.
3. Calls cpuid to probe CPU features (Intel fingerprint check: ebx == 0x756e6547 / 'Genu', ecx == 0x6c65746e / 'ntel') ^[r2:entry0].
4. Stores the result in runtime.cpu globals.
5. Invokes runtime.args, runtime.osinit, runtime.schedinit, then runtime.main → main.main.

The decompiled entry shows no anti-debug checks, no VM detection, and no process hollowing — just the standard Go runtime preamble. No user-defined main function symbols were recovered by radare2 (Go symbol table mangling / lack of DWARF), but the string table references main.gpqgytyvzhz, main.kixtpejkctlm, etc. ^[strings.txt:4921], indicating randomized function names consistent with Go obfuscation or automatic name generation.

C2 Infrastructure

None observable statically.

No domains, IPs, URLs, mutex names, named pipes, registry keys, or file paths recovered from strings, floss, or capa. The .rdata section contains only Go runtime error strings and syscall wrapper names. Dynamic execution would be required to surface any runtime-resolved C2.

Interesting Tidbits

• Go 1.18.5 is end-of-life (last security patch Aug 2022). A 2026-signed binary using a 3-year-old Go runtime is unusual — possible indicator of a static / frozen builder image, or deliberate downgrading to evade modern EDR signatures tuned for newer Go versions.
• No .rsrc section means no icon masquerade, no manifest, no version-info social engineering — unusually bare for a dropper.
• .idata entropy 3.53 — low, confirming a small, predictable import table (only kernel32.dll via Go syscall layer).
• PE checksum matches header (0x1A61A4 both computed and stored) ^[rabin2-info.txt], suggesting the binary was not modified post-link (signing happened on the original build artifact).
• 8 samples in this corpus share the uniq.file label; they are heterogeneous in architecture, size, and section count — confirming the label is an umbrella tag, not a single-family fingerprint.

How To Mess With It (Homelab Replication)

To reproduce a comparable binary:

# Install Go 1.18.5 (older, but reproducible)
go version  # ensure 1.18.5

# Build a minimal Windows PE with randomized module path
cat > main.go <<'EOF'
package main
import "fmt"
func main() { fmt.Println("stub") }
EOF

GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -ldflags="-s -w" -o stub.exe main.go
# For the *exact* fingerprint seen here (symtab present), omit -s -w:
GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -o uniqfile_repro.exe main.go

Verification: Run rabin2 -I uniqfile_repro.exe — expect lang: c, compiled: Thu Jan 1 00:00:00 1970, stripped: true, and .symtab section present. Compare module path in strings with strings uniqfile_repro.exe | grep "path\t".

Deployable Signatures

YARA Rule

rule Go_Gcleaner_Uniqfile_Starkville_Signed {
    meta:
        description = "Go 1.18.5 PE64+ with starkvillesd.com Authenticode, gcleaner context"
        author = "PacketPursuit"
        date = "2026-06-17"
        sha256 = "a1943a9a0da739def64dc1842e122f5885642a174609d3fa2869ba03f8eb2347"
    strings:
        $go_build = "go1.18.5" ascii wide
        $go_buildid = "Go build ID:" ascii
        $mod_path = "path\tvFsFeEitfcsqNDz" ascii
        $cert_cn = "starkvillesd.com" ascii wide
        $gcleaner_label = "dropped-by-gcleaner" ascii wide
    condition:
        uint16(0) == 0x5A4D and
        uint32(uint32(0x3C)) == 0x00004550 and
        uint16(uint32(0x3C)+0x18) == 0x020B and  // PE32+
        ($go_build and $go_buildid) and
        ($mod_path or $cert_cn or $gcleaner_label)
}

Sigma Rule

Not applicable — no runtime process-tree or registry behavior observable from static data. When CAPE Windows guest becomes available, this section should be updated with process_creation or network_connection rules.

IOC List

Behavioral Fingerprint Statement

This binary is a Go 1.18.5 PE64+ Windows executable with a zero-timestamp PE header, no .rsrc section, and no hardcoded network indicators. It is Authenticode-signed with a short-lived R12 intermediate certificate for CN starkvillesd.com. The import table contains only kernel32.dll APIs surfaced through Go syscall wrappers. No anti-analysis or anti-VM logic is visible in the static image. Dynamic execution is required to determine payload behavior; static indicators alone are insufficient for family-level attribution beyond the gcleaner distribution umbrella.

Detection Signatures

• Mandiant capa: Failed — signatures not installed on analysis host ^[capa.txt].
• YARA: Only PE_File_Generic matched (trivial PE64 rule) ^[yara.txt].
• PE features: ASLR-compatible (DYNAMIC_BASE + HIGH_ENTROPY_VA), NX-compatible (NX_COMPAT), Terminal Server aware ^[pefile.txt:73]. Standard Windows hardening flags; not inherently suspicious.

References

• Artifact ID: 8d464416-96d0-49e7-a344-3155dc1fa006
• OpenCTI labels: dropped-by-gcleaner, exe, malware-bazaar, u, uniq.file ^[triage.json]
• Related wiki pages: gcleaner

Provenance

Analysis based on static artifacts produced by the triage pipeline (file, exiftool, pefile, strings, ssdeep, tlsh, yara, binwalk, rabin2) and manual radare2 decompilation of entry point 0x00457e00. No dynamic execution (CAPE skipped — no Windows guest). Report written 2026-06-17.