Fake academic resume → Go loader → SNOWLIGHT → fileless VShell: full malware analysis

I analyzed a Chinese language archive posing as a fresh-graduate resume from Beijing Institute of Technology. The executable opens a genuine DOCX decoy while a custom 32-bit Go loader continues in the background. A few things I found particularly interesting: • ThreatBook/Weibu-specific sandbox detection • exit when fewer than four logical CPUs...