34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 43:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4dd,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious VirTool/Obfuscator.tv Sample 76470b750d92… — Score 70/100 — Hybrid Analysis","description":"Suspicious verdict for sample 76470b750d92…. Malware family: VirTool/Obfuscator.tv. Threat score 70/100. 1/27 AV engines flagged this file. 0 malicious and 3 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/76470b750d926c3ad4a0a6a87d45f463a5be32735b627c0e5f2d687d0b301ff7","keywords":["Suspicious","VirTool/Obfuscator.tv","malware analysis","sandbox report","threat intelligence","76470b750d926c3ad4a0a6a87d45f463a5be32735b627c0e5f2d687d0b301ff7"],"about":{"@type":"SoftwareApplication","name":"76470b750d926c3ad4a0a6a87d45f463a5be32735b627c0e5f2d687d0b301ff7","applicationCategory":["peexe","64bits","executable"],"identifier":"76470b750d926c3ad4a0a6a87d45f463a5be32735b627c0e5f2d687d0b301ff7","additionalType":"Suspicious sample"},"threatScore":70,"malwareFamily":"VirTool/Obfuscator.tv","antivirusDetections":{"malicious":1,"total":27},"behavioralIndicators":{"malicious":0,"suspicious":3},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T456,Pattern match: "https://go.dev/issue/66821", Pattern match: "tern.dev/windows/cmd/teal-setup", Pattern match: "https://go.dev/doc/godebug#go-1casgstatus", Heuristic match: "runtime.srcfunc.name", Heuristic match: "runtime.(*bucket).mp", Heuristic match: "internal/abi.(*name).name", Heuristic match: "internal/runtime/syscall/windows.(*context).lr", Heuristic match: "runtime.(*polldesc).info", Pattern match: "https://github\.com/tealvpn/(windows|linux)/releases/download/v[0-9][0-9.]{0,30}/[a-za-z0-9._-]{1,120}$go", Pattern match: "download.tealvpn.com/windows/x64time", Heuristic match: "internal/abi.name.name", Pattern match: "golang.org/s/cgihttpproxyexpected", Pattern match: "https://github.com/instrument/instrument-sans", Heuristic match: "ceos: unexpected result from waitforsingleobjectruntime.addcleanup: ptr not in allocated blockslice bounds out of range [:%x] with length %ypanicwrap: unexpected string after type name: memory reservation exceeds address space limitfailed to put span on ne", Pattern match: "tealvpn.com/quietuninstallstringinvalid", Pattern match: "https://tealvpn.com/terms"37:T9ad," ptrSize= targetpc= until pc=active < 0unknown pcruntime: ggoroutine (durable)terminatedowner diedDnsQuery_WGetIfEntryCancelIoExCreatePipeGetVersionLocalAllocWSACleanupWSAStartupgetsockoptsetsockoptdnsapi.dllws2_32.dll%!Weekday(BackupReadIsValidSidLockFileExOpenEventWOpenMutexWOpenThreadPulseEventResetEventWSASocketW"&|<>^%! github.comUser-Agentobject key for type ParseFloatGlobalFree86.0.616.0UnassignedBeria_ErfeChorasmianDevanagariGlagoliticKharoshthiManichaeanOld_ItalicOld_PermicOld_TurkicOld_UyghurPhoenicianSaurashtraRIPEMD-160complex128t.Kind == LogonUserWReOpenFileNetUserAddNetUserDelNtOpenFile12207031256103515625isNeoversefips140emscrypto/tlshttp2debugrsa1024mincrypto/rsax509rsacrt[:^alnum:][:^alpha:][:^ascii:][:^blank:][:^cntrl:][:^digit:][:^graph:][:^lower:][:^print:][:^punct:][:^space:][:^upper:][:xdigit:]rune netGo = .localhostIP addressunixpacketlocal-addrimpossiblejsontext: AppendText2006-01-02TypeAssertLoadImageWParseAddr(invalid IPClassCSNETClassCHAOSAdditionalskipping: res masterSHA" (Indicator: "github.com"), "path tern.dev/windows/cmd/teal-setup mod tern.dev/windows (devel) dep github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY= dep github.com/amnezia-vpn/amneziawg-windows/v3 v3.1.20260814 h1:R5J1awr5at7/4kHFPZaN0zeLKW1/zR/E37lhMgnsyD0= dep github.com/wailsapp/go-webview2 v1.0.23 h1:jmv8qhz1lHibCc79bMM/a/FqOnnzOGEisLav+a0b9P0= dep golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= build -buildmode=exe build -compiler=gc build -trimpath=true build CGO_ENABLED=0 build GOARCH=arm64 build GOOS=windows build GOARM64=v8.0 build vcs=git build vcs.revision=f5c52f9796957b49af30753589b2623076721a6d build vcs.time=2026-11-04T20:46:17Z build vcs.modified=true " (Indicator: "github.com"), "nCopyright 2022 The Instrument Sans Project Authors (https://github.com/Instrument/instrument-sans)Instrument SansRegular1.000;NONE;InstrumentSans-RegularInstrument Sans RegularVersion 1.000;gftools[0.9.28]InstrumentSans-RegularfragTYPERodrigo Fuenzalidawww.fragtypefoundry.xyzwww.rfuenzalida.comThis Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: https://scripts.sil.org/OFLhttps://scripts.sil.org/OFLInstrumentSansRound dotsSingle Story aAlternate yAlternate KAlternate RAlternate MAlternate GAlternate JAlternate QAlternate 2Alternate AmpersandAlternate CurrencyWidthWeightNormalItalicRoman" (Indicator: "github.com")38:T189a,"nctest channel from outside bubble may be in the same tiny block as finalizer transitioning GC to the same state as before?produced a trigger greater than the heap goaltried to run scavenger from another goroutineruntime: failed mSpanList.remove span.npages=runtime.minit: duplicatehandle failed; errno=runtime: CreateWaitableTimerEx failed; errno=runtime error: panic called with nil argumentexitsyscall: syscall frame is no longer validunsafe.String: ptr is nil and len is not zerocannot send after transport endpoint shutdownbufio.Scanner: Read returned impossible countRegisterVTable '%s': '%s' must implement '%s'reflect: internal error: invalid method indexcontext: internal error: missing cancel errornumber of URL query parameters exceeded limitmath/big: cannot unmarshal %q into a *big.Intparsing/packing of this section has completedcrypto/rsa: message too long for RSA key sizew must be at least 2 by the definition of NAF\Software\Microsoft\Windows\CurrentVersion\Runbytes.Reader.UnreadByte: at beginning of sli" in Source: sample.bin, "for next generation goroutine running on other thread; stack unavailable RegisterVTable '%s': Parent VTable '%s' not registeredarch-specific crc32 instruction for IEEE not availablereflect: Value.SetIterKey called on exhausted iteratorBUG: must be called on an object after writing a valueGo struct field %s has unsupported `format` tag optionname is not in canonical format (it must end with a .)internal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesbufio.Scanner: SplitFunc returns negative advance countreflect: internal error: invalid use of makeMethodValueInterface '%s' is already implemented by another objecteach colon-separated field must have at least one digitecdsa: internal error: shift can only be by 1 to 7 bitsrequest header list larger than peer's advertised limitedwards25519: invalid " in Source: sample.bin, "ntime: unexpected metric registration for gcmarknewobject called while doing checkmarkactive sweepers found at start of mark phaseno P available, write barriers are forbiddencompileCallback: float results not supportedcannot trace user goroutine on its own stackunsafe.Slice: ptr is nil and len is not zeroencoding alphabet contains newline characterencoding alphabet includes duplicate symbols[WebView2] Environment created successfully crypto/sha256: invalid hash state identifier using value obtained using unexported fieldreflect: Value.SetIterKey called before Nextreflect: funcLayout with interface receiver reflect: slice length out of range in SetLenjsontext.Value: UnmarshalJSON on nil pointerinsufficient data for calculated length typemime: unexpected content after media subtypeentropy: repetition count health test failedcrypto/sha512: invalid hash state identifierSoftware\Microsoft\Windows\CurrentVersion\RunhandleTransientAcquire called in invalid modehandleTransientRelease called in invalid modeclose of sy" in Source: sample.bin, "SetBytesWithClamping input lengthmldsa: internal error: invalid bitUnpack18 input lengthmldsa: internal error: invalid bitUnpack20 input lengthSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileListstrings: illegal use of non-zero Builder copied by valuerange function continued iteration after loop body panicrange function continued iteration after whole loop exitprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersfailed to allocate aligned heap memory; too many retriesin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= LocalAlloc for security descriptor with of length %d: %wnon-empty pointer map passed for non-pointer-size valuesreflect: Value.SetIterValue called on exhausted iteratorSOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected u" in Source: sample.bin, "nmarked object obj=sync: WaitGroup misuse: Add called concurrently with Waitsync: WaitGroup.Add called from multiple synctest bubblesRegisterVTable '%s': T and TParent can't be the same typecrypto/drbg: internal error: request size exceeds maximumBUG: must be called on an object after writing first nameGODEBUG=execwait=2 detected a leaked exec.Cmd created by: Software\Microsoft\Windows\CurrentVersion\Uninstall\TealVPNtried to trace goroutine with invalid or unsupported statusbufio.Scanner: SplitFunc returns advance count beyond inputsync: WaitGroup is reused before previous Wait has returnedreflect: reflect.Value.Elem on an invalid notinheap pointersync/atomic: store of inconsistently typed value into ValueGo struct field %s is missing value for `format` tag optioncrypto/md5: use of MD5 is not allowed in FIPS 140-only modeSoftware\Microsoft\Windows\CurrentVersion\Themes\Personalizemanual span allocation called with non-manually-managed typeaddr range base and limit are not in the same memory segmentruntime: n" in Source: sample.bin, "shalBinary: unexpected zone offsetlooking for beginning of object key stringerror getting Webview2 runtime version: %sSoftware\Microsoft\EdgeUpdate\ClientState\MapIter.Value called on exhausted iteratorreflect: negative length passed to ArrayOfreflect: cannot convert slice with length sync/atomic: store of nil value into Value173472347597680709441192448139190673828125867361737988403547205962240695953369140625after array element (expecting ',' or ']')inaccurate year, month, week, or day unitssingle-quoted string not terminated: %s...insufficient data for resource body lengthcrypto/sha1: invalid hash state identifiermultiple Read calls return no data or errorexec: WaitDelay expired before I/O complete/memory/classes/metadata/mcache/inuse:bytesruntime.SetFinalizer: first argument is nilruntime.SetFinalizer: finalizer already setgcBgMarkWorker: unexpected gcMarkWorkerModenon in-use span found with specials bit setgrew heap, but no adequate free space foundroot level max pages doesn't fit in summaryruntime.Pinner:" in Source: sample.bin39:Tf11,file/memory contains long string with (Indicator: "IsValidSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetAce"; Source: "sample.bin"), file/memory contains long string with (Indicator: "ImpersonateSelf"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsWellKnownSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "MakeAbsoluteSD"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorControl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "InitializeSecurityDescriptor"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorRMControl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorRMControl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetTokenInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetTokenInformation"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorDacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorSacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsValidSecurityDescriptor"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorDacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorSacl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorGroup"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorOwner"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorGroup"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetSecurityDescriptorOwner"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CopySid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "FreeSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetLengthSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "RevertToSelf"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidSubAuthority"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; Source: "sample.bin"), file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetKernelObjectSecurity"; Source: "sample.bin"), file/memory contains long string with (Indicator: "CreateWellKnownSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "MakeSelfRelativeSD"; Source: "sample.bin"), file/memory contains long string with (Indicator: "GetSecurityDescriptorLength"; Source: "sample.bin"), file/memory contains long string with (Indicator: "AdjustTokenGroups"; Source: "sample.bin"), file/memory contains long string with (Indicator: "IsTokenRestricted"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DuplicateToken"; Source: "sample.bin"), file/memory contains long string with (Indicator: "DuplicateTokenEx"; Source: "sample.bin"), file/memory contains long string with (Indicator: "SetEntriesInAcl"; Source: "sample.bin"), file/memory contains long string with (Indicator: "EqualSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), file/memory contains long string with (Indicator: "InitializeSid"; Source: "sample.bin")3a:T129b,Found reference to API "actions">