unclassified-go-pe64: a5520aba — Go PE64+ signed with GoDaddy DV cert, MD5/SHA256 crypto routines, zero static C2

Executive Summary

A 2.4 MB PE32+ (x64) compiled in Go 1.25.4 with a Windows GUI subsystem, signed with a GoDaddy DV TLS certificate issued to maybe.us. The binary is statically linked, contains AES and SHA-256 constants, and exposes randomized main.* function names consistent with the golang-stealer-build-pattern. No C2 infrastructure, browser credential targets, or wallet strings were recovered. One main.* function (main.oywrvd) calls crypto/md5.Sum on a 256-byte buffer. Another (main.bwrzkmud) seeds math/rand from time.Now().UnixNano(), generates 512 random bytes, and hashes them with SHA-256. A third (main.rrewqtyq) computes MD5 over a 128-byte slice. Classification: low-confidence unclassified Go PE64 placeholder — a near-identical sibling of the 589af0f8 cluster (see unclassified-go-pe64).

What It Is

• Filename: update.exe
• Size: 2,439,352 bytes
• Type: PE32+ executable (GUI) x86-64, 8 sections ^[file.txt]
• Linker: Go (PE optional header MajorLinkerVersion 3.0) ^[exiftool.json] ^[rabin2-info.txt]
• Subsystem: Windows GUI ^[pefile.txt]
• Compilation time: Unix epoch (Thu Jan 1 00:00:00 1970) — stripped/reproducible build ^[pefile.txt]
• Entropy: .text 6.30, .rdata 6.76, .data 4.36, .pdata 5.18

Build / RE

Compiler & Toolchain

Go compiler, version go1.25.4 ^[strings.txt:1852] ^[strings.txt:6273]. The binary is statically linked with no CGO (no C runtime strings beyond standard library). No absolute module paths are present in the string table, consistent with a go build -trimpath invocation. ^[strings.txt]

Signing

Authenticode signature present at offset 0x253008 (overlay). A DER-encoded X.509 certificate is embedded for CN = maybe.us, issued by Go Daddy Secure Certificate Authority - G2, valid Jun 4 2025 → Jun 4 2026, 4096-bit RSA, SHA-256. Serial: 86:ee:39:e0:b3:fd:88:5f. ^[binwalk.txt] ^[terminal:python cryptography parse]

The domain maybe.us currently resolves to AWS Route 53 parking IPs (15.197.204.56, 3.33.243.145) ^[terminal:dig output]. The combination of a throwaway/parked domain and a one-year DV certificate is a red flag often seen on crimeware that buys cheap certs for code-signing credibility.

Packing / Obfuscation

No packer detected. UPX absent; section names standard (.text, .rdata, .data, .pdata, .xdata, .idata, .reloc, .symtab). No anti-debug or VM detection strings observed.

Notable Functions

The main package contains 23 randomized function names, a hallmark of the golang-stealer-build-pattern: ^[strings.txt:8167-8188]

main.init, main.main, main.oywrvd, main.bwrzkmud, main.cgftydadpmoswzg,
main.ctrlzpxjtcwzpqs, main.rrewqtyq, main.ryywwqduibhi, main.dfodvrytb,
main.gxhsibnl, main.sgpqxnbyzsqx, main.onvxixirjnetyjq, main.lllvrngltnddjuv,
main.shnflwcbgj, main.vdtdwvsnsn, main.vchxgweuaztrdgf, main.yhiccjxz,
main.tijkijpmavjqrg, main.adqjjfzsvwstosn, main.fodhrzsdeh, main.Jndpel,
main.vrhdiy

Decompilation of main.oywrvd (0x14008c700) shows a 256-byte slice allocation, a byte-assignment loop, and a call to crypto/md5.Sum. ^[r2:sym.main.oywrvd]

Decompilation of main.bwrzkmud (0x14008c820) seeds math/rand from time.Now().UnixNano(), generates 512 random bytes, and hashes them with crypto/sha256.Sum256. ^[r2:sym.main.bwrzkmud]

Decompilation of main.rrewqtyq (0x14008cb80) computes MD5 over a 128-byte slice and compares the result byte-by-byte against a hardcoded 16-byte value. ^[r2:sym.main.rrewqtyq]

Decompilation of main.main (0x14008c6c0) is a thin runtime.morestack_noctxt wrapper that calls main.oywrvd, main.bwrzkmud, main.rrewqtyq, and main.cgftydadpmoswzg in sequence. ^[r2:sym.main.main]

Decompilation of main.cgftydadpmoswzg (0x14008c960) allocates a 100-element slice, fills it with rax + rax*2 arithmetic, and calls main.ryywwqduibhi. ^[r2:sym.main.cgftydadpmoswzg]

Embedded Resources

Binwalk identifies AES S-Box and AES Inverse S-Box at 0x2240C0 / 0x2241C0, and SHA-256 hash constants at three locations (0x1A1C40, 0x1A1C50, 0x223FC0). ^[binwalk.txt] These are standard Go crypto/aes and crypto/sha256 lookup tables; they do not indicate custom encryption logic.

Deploy / ATT&CK

No dynamic analysis is available (CAPE skipped — no Windows guest). Static inference only.

TTPs

• T1587.002 — Obtain Digital Certificates: The binary is signed with a valid GoDaddy DV certificate for maybe.us. Low-confidence inference: purchased or fraudulently obtained cert to bypass SmartScreen / EDR reputation checks.
• T1027.002 — Obfuscated Files or Information: Go -trimpath + randomized main.* function names strip developer identity and hinder analyst navigation. ^[strings.txt]
• T1059.003 — Windows Command Shell / Go execution: The binary drops to disk as update.exe and runs as a native PE. No visible command-line staging.

C2 Infrastructure

None recovered. No hardcoded IPs, domains, URLs, mutexes, or named pipes. If the binary exfiltrates or connects outbound, the target is either constructed at runtime (e.g., from a remote fetch, registry, or environment variable) or the strings are encoded in a way not recovered by standard extraction.

Decompiled Behavior

Entry-point analysis via radare2 (aaa) recovered 2,160 functions. The main.main call graph is shallow: it allocates stack space, checks for stack growth, and then calls four main.* functions in sequence before returning. The bulk of application behavior is hidden behind randomized function names.

main.oywrvd is the first main-package function: it fills a 256-byte slice and hashes it with MD5. This could be:

• A loader/decoder producing a key or checksum for an embedded payload.
• A fingerprinting routine generating a system identifier.
• Part of a larger string-decoding routine where the dictionary is built at runtime.

main.bwrzkmud is the second: it seeds the PRNG from wall-clock time, fills a 512-byte buffer with random data, and computes SHA-256. This is consistent with runtime key generation for a second-stage payload.

main.rrewqtyq is the third: it computes MD5 over a 128-byte slice and byte-compares the digest against a fixed 16-byte pattern. This is a classic integrity-check or key-validation routine.

main.cgftydadpmoswzg is the fourth: it fills a 100-element slice with arithmetic (rax + rax*2) and calls main.ryywwqduibhi. The purpose of this arithmetic sequence is unclear without deeper analysis of main.ryywwqduibhi.

No further xref into any of these main.* functions was recovered beyond the single call from main.main; the calling relationship may be obscured by Go's runtime scheduler.

Interesting Tidbits

• Domain maybe.us is a throwaway/parked domain on Route 53. GoDaddy G2 DV certs are cheap (~$50/year). The opsec model is "buy credibility for signing, then park the domain."
• The absence of any browser-credential paths (no Login Data, Cookies, Web Data, wallet regexes, or Discord/Telegram API URLs) distinguishes this sample from the ACR/Lumma/OrderRe Go infostealer cluster, despite sharing the randomized-function-name build artefact. It may be a different tool or an earlier/later build variant with a stripped payload.
• AES+SHA256 constants in .rdata are indistinguishable from benign Go software; they only matter when paired with a calling function that uses them for non-standard crypto (e.g., custom C2 protocol). No such caller was identified.
• The binary is a near-identical sibling of 589af0f8 (/intel/analyses/589af0f87f4087f34750995ce679024df4e04acd0d096fe49e7f1223cb5905ae.html) — same size (2,439,352 bytes), same certificate, same build ID, same function-name randomization pattern, same crypto routine shapes. The only deltas are the randomized function names themselves (different random seeds) and the hardcoded MD5 comparison bytes in main.rrewqtyq.

How To Mess With It (Homelab Replication)

1. Reproduce a comparable binary:

   GOOS=windows GOARCH=amd64 go build -trimpath -ldflags="-H windowsgui" -o repro.exe main.go
   

2. Add randomized function names by compiling with a randomized package main source file (or just renaming functions before build).
3. Sign repro.exe with a self-signed or trial DV cert using signtool.exe to observe SmartScreen behavior.
4. No capa comparison possible — signatures are missing on this host.

Deployable Signatures

YARA

rule unclassified_go_pe64_a5520aba {
    meta:
        description = "Go PE64 with randomized main.* names + GoDaddy DV cert, low-confidence"
        sha256 = "a5520abaff0664d2c9c62b2009f3ad663a2f24edc6307162b2124e5ee1b30abd"
    strings:
        $go_build = "Go build ID:" ascii
        $main_rnd1 = /main\.[a-z]{7,20}/ ascii
        $goddaddy = "Go Daddy Secure Certificate Authority - G2" ascii
    condition:
        uint16(0) == 0x5a4d and
        filesize > 2MB and filesize < 3MB and
        #main_rnd1 > 10 and
        $go_build and
        $goddaddy
}

IOCs

Behavioral Fingerprint

This binary is a Go x64 PE with a GUI subsystem, valid Authenticode signature from a throwaway DV domain, randomized main.* function names, standard Go crypto libraries (AES, SHA-256, MD5), and no obvious C2, credential-target, or wallet strings in static analysis. It may be a downloader, clipper, or signed stub whose payload is constructed at runtime. The presence of MD5/SHA256 routines seeded from time suggests runtime key generation for a second-stage payload.

Detection Signatures

No capa output available (execution failed due to missing signatures). No dynamic analysis available. ATT&CK mapping based solely on static artefacts:

• T1587.002 (digital certificate)
• T1027.002 (software packing/obfuscation — Go trimpath + randomized names)
• T1059.003 (native code execution)

References

• SHA-256: a5520abaff0664d2c9c62b2009f3ad663a2f24edc6307162b2124e5ee1b30abd
• Artifact ID: 71f0718e-3786-417c-8f32-336f9e39a59c
• MalwareBazaar source via mb-fetch.py
• Related entity: unclassified-go-pe64
• Related concept: golang-stealer-build-pattern
• Near-identical sibling: 589af0f8 (/intel/analyses/589af0f87f4087f34750995ce679024df4e04acd0d096fe49e7f1223cb5905ae.html)

Provenance

• file.txt — file(1) output
• pefile.txt — pefile parser (section headers, imports, directories)
• rabin2-info.txt — radare2 rabin2 -I summary
• binwalk.txt — binwalk signature scan
• strings.txt — strings(1) extraction
• exiftool.json — ExifTool PE metadata
• dynamic-analysis.md — CAPE status (skipped)
• capa.txt — capa error output
• floss.txt — floss error output
• radare2 decompilation — r2 -A + s sym.main.* + pdc
• Certificate parsed via Python cryptography library on overlay at offset 0x25309D
• DNS lookup via dig +short maybe.us