Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Static task
static1
Behavioral task
behavioral1
Sample
nouactelegram.vmp.dll
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
nouactelegram.vmp.dll
Resource
win10v2004-en-20220113
General
-
Target
nouactelegram.vmp.dll
-
Size
5.5MB
-
MD5
52703c8091a4e3ac70d95c6acbf7dd0d
-
SHA1
671467744181cd12695db8e5ba1d79b0d83271c0
-
SHA256
02dfd5448fecf132e9c2062dce335945d220e7fd1a0ab0885ac20d409da02bbf
-
SHA512
ae54f063f36e13f6f04971b54dc19cb915a774dd0f35035c13ca61ce716515b9740695cae5035ff66bc5a44cf9c9d4979f21e5eab2409920cb0ec0fdb781bf90
-
SSDEEP
98304:ioPJmyimgZU7wMJhKeqtOn7FdDajagO4H39ionDbJYKSBk5a+1qSOI/DTscHAbPI:/Jm75ReKzOn7Fd+O4H39dx5a+ASZDTsw
Malware Config
Signatures
Files
-
nouactelegram.vmp.dll.dll windows x86
cf222563c53053956842cc0ea7224a90
Code Sign
23:d6:08:40:7c:c7:e8:7a:b9:8c:fc:a7:f3:8b:06:93Certificate
IssuerCN=Telegram FZ-LLC,C=JapanNot Before22/12/2021, 09:43Not After30/12/2099, 16:00SubjectCN=Telegram FZ-LLC,C=Japan0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate
IssuerCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before01/01/2021, 00:00Not After06/01/2031, 00:00SubjectCN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate
IssuerCN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=USNot Before07/01/2016, 12:00Not After07/01/2031, 12:00SubjectCN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
34:c2:eb:7a:65:c5:10:6f:3e:dc:de:ef:a2:85:41:43:90:47:a9:6fSigner
Actual PE Digest34:c2:eb:7a:65:c5:10:6f:3e:dc:de:ef:a2:85:41:43:90:47:a9:6fDigest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Telegram FZ-LLC,C=Japan30/01/2022, 07:34 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
VirtualQuery
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shlwapi
PathFileExistsA
ws2_32
htons
wtsapi32
WTSSendMessageW
Exports
Exports
w"4jn\p��&�7����>N�j���m-���s.n�K�p��@e�����S����d�n~�иxK�Z��5ޥ��Gs%�)���o8Z[�%�����o�Ѳ+�,�roe" �ȏ ��<�.=i�?�ȑѲ� ��W���8�h��[�z�����F��(��� S�� TX��F���Ǐ͔X�3�~��/wP��!��R���e��L8�L���^�0�j� �=�=��dk�9�W�&�n��&�aS�.Ԟ���pWE:a�'�ײ���i\��Od��1�����2&���P+��u[����5<�A�`@�l�����34_���������)[�la�I�<Ӗ��x��{�U�ȝ�b2��>���L @-�V #��,"���f���4���K�� ,p�(釥�����N��q^��j��!Q�Srh����0�-'k�d�Ҳ�ÿퟭL.7��D����Q���Ҽt>l蚄��son/-����X�y���)d�M!�����SU�?��S�B`� :J�B�bgK�]�31d\8���sZSk�dQ5��>��&M�Y3۴��^d�ys����\����$m D��pa�]�D���Z��v�u��QBb����OC�;�]�[+f�s���e#�C���D��i�X�͛.��{0N�_�g�_۞&�����G�SS���8�6��2.�s�|�po��w�oE�&��㖇��V��Y�Gw��*!՞!6��?��<�y�XX_[���?��ϼ�x���Ż��v���b��VQ���_هv���uχ���y��6D������k�`U�K������ψ�P�?�� e�:�$��^�F�(U:w�2���E4�l��=��V����D���͏����_���l�]�ڡ0o��,�Jd�>��|�d1�hx���dw �>� ؚE��X���N�K�ܝA=��V|$>R�`8q��!�i��93�B�WI�W[sMj0��q��Te0��0�F�̠�Y�!ѻ��o@��x�ΰ�[onp#�����rє��v��� � g���#��F�q���-��o?�Р�#���֛�~v��Sa�Q�A��P��<\�?�X^�=����J��Ġ����%�� �%c���Ē�\�)9�Q�X�kɾ<0��/�b�rߔ��AMv�Ҵ�Z�fr��buϛ��jYgKaO�>�8w,��~b+�J����H����C���Zhn A��Y�5 ���CkV�3.T��t,}5 �{>�a�?Swn~EE�s��&����s�6 �P�M/��`L �����P���"U���'Z�z�Lc8C� �<Y�¸�$���ǦaG/G�cO�����Y����Ń�����6��6��z�bA#�hޜn�Q0.i���|T��"�1�j�4*��A�~�6���Č��!w�m����>i���y�Z�����S�?eqd�0�z�u��{d���H$�g�]tg����ϩP���r�U�!V%ϛlj5���O�R���a�u��\���st��g�����uũ��ƀA߮�����$9tװ�D S��MNw8<��T�̛�@��88�ҾJ2���C@b6�2�_@X�Zfs���`yrǬ���~�|�~R榪V�Nh�^�)O��j�B��b\�݄�;vS�ܒ�Ȭ:��4]�z/s,�KGL�Y�W��E���b����h�VWQ������,� ���A^/�.����1���Q�U��.�%��)<���� �y'J�Z��v��S���x��<����+�q��r;N���!��>�-����R�/GcR������ � +���Mn�{����AA���5_GQ<9=g�{j��V1�:�>'��M�@!d��C����q/*������T�����V��� ?a�{������<X����R�t7Al�֭\,1h����ΎʸgP����A�qG��OmD�C������lxP0e�G'��K�����O���J݉8�Bm)�"ξ� k���ǝ=K6i�TN�h��7*���WKs�ՓGZ��f���/��Rm|]�2,�4���� �����B`jx�H���c�KM��̤��R``J�E���}�9[����j�Ono���+��xVS��c�� �{2d�ū���wm��#�4����oB#���{�`��a���_�ިpK��YV��/��e�g៝�)��E�♼�7 ��5y������EAL�T����<Җ ��Z�+ ����O8�ט��J���>G����*&�O]Ij)\<��)�b�%3p�,)D��W�:�sc����Ѫ�L\�� X�й�l?�t���w�DVzѲ�� )c5q艻&h��*~V��Q�̪;�8���!?�Ҟ� %�;c���b�;�/E�[�;��R:��F�}�*+�|�Nu<PI�K~=�������)�Tg��� qχep���KG�m=[� ��{[�L98���@��gֲ���x&���~b$M�����. ��[+G�������i?QT��6Vڞ���%a���`��u�Ж�����w���x�#[f7��C�9�n����������&0����'[k{p.9�8�-N=����2��qM�^5U��f1Cd:��(�'ݳ����aQ�S"މx@�Ns߹��+���m[�����zR�����M\�A'�H8�/^�u�,(^c����g<R�;�5M�� ]*�>���)����\.�/��^�1]%v>%��5d"\��Ng`�������s|�L�������1����&T�d$t�NZ)�ԕ?�T1�Q|�6��E�n�9���d��7�Y�"�q{Zn}�A��cf��9��g��h�?�]������� ���-(�v /4�����O�ߟ� f�Uu��m;�mf$�W=u{͖��?w�Rz#Wq^3/,�Omt����o-������;'!��4S6�Hv;;�KI���'|@�.0��>�` �9��D6im*��V_�=�s�>S\�J��ڌI�/����?z �Wf c[+T+��w��[���w�(���=�1�쳰��<h"��������/��P�[aJHV>��9�T����oc-��8�N����0�P|���)
cYreenQillm
Sections
.text Size: - Virtual size: 50KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmps0 Size: - Virtual size: 3.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmps1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 233B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ