Static task
static1
Behavioral task
behavioral1
Sample
499ab1eb0cdd4f93c7b139677d62e98adeee98aa2121d58aac0b54957712c57b.exe
Resource
win7-20240508-en
General
-
Target
499ab1eb0cdd4f93c7b139677d62e98adeee98aa2121d58aac0b54957712c57b.zip
-
Size
1.6MB
-
MD5
6d193b645e9af396449379a0105840bf
-
SHA1
5096b115a638ea12761eb0edc19c84f1d5e53f8e
-
SHA256
692da2d734811810726f55c7c6b31d5e7d2d329791c0c1f71f9d69e50ceb7882
-
SHA512
b9a7675f54594b76ab99241436df3af06cbf8e3a4bc38bc988db5a2fe2fb32f04104dca90dc0b0f673782ae5182f1dcf32d838e956e1f7fb941f35005bbe5fd1
-
SSDEEP
24576:wI8uAjpvmrf2vSMEB0B8WQCVHfDuzfNAMwLR1OA931+WeP7Wfx+AhyLnNEByR0Sd:wI8ljx4NMlroSl9931+WeP7WwzNEBDOZ
Malware Config
Signatures
-
Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/499ab1eb0cdd4f93c7b139677d62e98adeee98aa2121d58aac0b54957712c57b suspicious_telegram_bot -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/499ab1eb0cdd4f93c7b139677d62e98adeee98aa2121d58aac0b54957712c57b
Files
-
499ab1eb0cdd4f93c7b139677d62e98adeee98aa2121d58aac0b54957712c57b.zip.zip
Password: infected
-
499ab1eb0cdd4f93c7b139677d62e98adeee98aa2121d58aac0b54957712c57b.exe windows:4 windows x86 arch:x86
Password: infected
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 54KB - Virtual size: 54KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ