F:\Pr\Online-ban\Injector\CrackByKevin\obj\x64\Release\Abc.pdb
Static task
static1
Behavioral task
behavioral1
Sample
d7815df2679efd13115ff3a60111c3d87e214843b1ef4a511f350333276c44e1.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d7815df2679efd13115ff3a60111c3d87e214843b1ef4a511f350333276c44e1.exe
Resource
win10v2004-20240226-en
General
-
Target
d7815df2679efd13115ff3a60111c3d87e214843b1ef4a511f350333276c44e1
-
Size
46KB
-
MD5
2f930f32ac8abeba6d4f39db317f679e
-
SHA1
b11d9a83330895b121094755da0e6ced7fed1e56
-
SHA256
d7815df2679efd13115ff3a60111c3d87e214843b1ef4a511f350333276c44e1
-
SHA512
06279c9229caf9f1d855b8985aed8834154aa3fbaff235f5a37dc2d49ac99aa5010a23e0fc1c1f6e03aef27997881c74dce732d9350caca787a727f39b78910a
-
SSDEEP
768:je4mOSCz/2ydUi5DWq4oBvQmR46bSxmvTQcW/bv5UobOcDh2IkJRxuvtYcFwVc6K:a/C6ydPSq4oRZqCSxWW/bv55xFyiXwVY
Malware Config
Signatures
-
Detects executables using Telegram Chat Bot 1 IoCs
resource yara_rule sample INDICATOR_SUSPICIOUS_EXE_TelegramChatBot -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource d7815df2679efd13115ff3a60111c3d87e214843b1ef4a511f350333276c44e1
Files
-
d7815df2679efd13115ff3a60111c3d87e214843b1ef4a511f350333276c44e1.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Sections
.text Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ