Static task
static1
Behavioral task
behavioral1
Sample
点击安装-纸飞机简体中文包 (3).exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
点击安装-纸飞机简体中文包 (3).exe
Resource
win10v2004-20220812-en
General
-
Target
telegram_cn.zip
-
Size
1.5MB
-
MD5
12c9492712d79698fb510241b6d769dd
-
SHA1
20ca5f14da0896588cc800a3a023d154f44e4e8c
-
SHA256
def213b91a9a9ee1cc547b0e9530b445e7152e4fcac3895b57673da935074590
-
SHA512
c3389055052fdbe614bfc25d33786dc977d0ac7227c0d60e127369955cc1e964306856698775e26ccbb2944612b3e2f6bf2e555f36ae937bdec65af7c443e145
-
SSDEEP
24576:MMiV9qYPTt5jn8hIiU3gA+axj8gIubop1cQ5PAunrA8y4fKlcR6aNve/JGK:jKggpWhIiUQA+IQgIFPHc0ylAN6GK
Malware Config
Signatures
Files
-
telegram_cn.zip.zip
Password: infected
-
点击安装-纸飞机简体中文包 (3).com.exe windows x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Sections
Size: 89KB - Virtual size: 192KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 18KB - Virtual size: 64KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 2KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 8KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 239KB - Virtual size: 4.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 1.2MB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE