Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Behavioral task
behavioral1
Sample
Telegram.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
Telegram.exe
Resource
win10v2004-20240709-en
Target
Telegram.exe
Size
132.7MB
MD5
4b358f540c561aa22343864deb0eb1df
SHA1
d882e8cb4477f71ba1ea168adeeaaa5a12c069a6
SHA256
b30365ef73df4b17ca3ae829b5cdd5b8ad375d3ca5a8460ac31eae3133f6c5eb
SHA512
df1a0bf1bbd39598de2544046ef3a730d1b9677f34f589fa0b23b4e3f3470b78a24dc275f34cc201b7ae2cfc67ac89f59f38b9c45fa8919ccdf70cde181f32d3
SSDEEP
1572864:2iP/X/tsHVU6QRWCalIJmxzhj4aZVrGjN9aHs/tIaD07gKLr70abs2U7+d/U7J3G:2DWnCbDoJ3p6G0h71fh3S8
Embeds OpenSSL, may be used to circumvent TLS interception.
resource | yara_rule |
---|---|
sample | embeds_openssl |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
C:\Telegram\twin\out\Release\Telegram.pdb
CopyFileW
GetLastError
DeleteFileW
QueryPerformanceFrequency
QueryPerformanceCounter
CreateFileW
WriteFile
CloseHandle
LocalFree
GetCommandLineW
RaiseException
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
DecodePointer
EncodePointer
GetCurrentProcessId
InitOnceExecuteOnce
RemoveDirectoryW
GetModuleFileNameW
GetEnvironmentVariableW
GetCurrentProcess
WinExec
GetModuleHandleW
GetFileInformationByHandle
FindFirstFileExW
GetFileAttributesW
FindNextFileW
FindClose
LoadLibraryW
GetModuleHandleExW
GetProcAddress
CreateEventW
WaitForMultipleObjects
CreateThread
SetThreadPriority
SetEvent
WaitForSingleObject
ResetEvent
InterlockedFlushSList
FreeLibrary
InterlockedPushEntrySList
InitializeSListHead
ReleaseSemaphore
CreateSemaphoreW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
VerSetConditionMask
VerifyVersionInfoW
GetLocaleInfoW
GetUserDefaultUILanguage
GetTickCount
GetTickCount64
MoveFileExW
FlushFileBuffers
FindFirstFileW
LockFile
UnlockFile
PowerCreateRequest
PowerSetRequest
PowerClearRequest
GetSystemPowerStatus
FormatMessageW
LocalAlloc
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
GetCurrentThreadId
FormatMessageA
CreateEventExW
WaitForMultipleObjectsEx
GetCurrentThread
WaitForSingleObjectEx
IsDebuggerPresent
DebugBreak
CreateSemaphoreA
ReadFile
SetFilePointerEx
Sleep
OpenThread
TlsAlloc
TlsGetValue
TlsSetValue
GetStdHandle
OutputDebugStringA
SetLastError
QueueUserAPC
CreateEventA
GetThreadId
GetModuleHandleA
TryEnterCriticalSection
GetNativeSystemInfo
OpenProcess
QueryFullProcessImageNameW
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
GetModuleHandleExA
ExpandEnvironmentStringsW
GetVersionExW
lstrcpyW
lstrlenW
lstrcpynW
GetSystemInfo
GetCurrentDirectoryW
InitializeCriticalSectionEx
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
WakeAllConditionVariable
GetFullPathNameW
MoveFileExA
InitOnceBeginInitialize
InitOnceComplete
InitializeSRWLock
SleepConditionVariableSRW
GetSystemDirectoryW
LoadLibraryExA
LoadLibraryExW
ReleaseMutex
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetProcessAffinityMask
CreateMutexA
LoadLibraryA
OutputDebugStringW
GetProcessHeap
HeapFree
RtlCaptureContext
GetProcessId
ResumeThread
TerminateThread
VirtualQueryEx
SetUnhandledExceptionFilter
DuplicateHandle
WaitNamedPipeW
SignalObjectAndWait
GetThreadGroupAffinity
SetEnvironmentVariableW
VirtualProtect
SetCurrentDirectoryW
GetFileAttributesExW
GetTempPathA
GetTempFileNameA
TlsFree
GetOEMCP
VirtualAlloc
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemTime
SystemTimeToFileTime
GetSystemDirectoryA
GetExitCodeThread
GetFileType
GetACP
ConvertFiberToThread
ConvertThreadToFiberEx
SetConsoleMode
ReadConsoleA
ReadConsoleW
ConnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
DisconnectNamedPipe
GlobalFree
SetHandleInformation
GetVolumeInformationW
GetLongPathNameW
GetDriveTypeW
GetConsoleWindow
CompareStringEx
GetLocalTime
TerminateProcess
IsProcessorFeaturePresent
SwitchToThread
GetThreadPriority
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetExitCodeProcess
CreateProcessW
UnregisterWaitEx
RegisterWaitForSingleObject
ReadFileEx
PeekNamedPipe
CancelIoEx
SleepEx
WriteFileEx
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
GetStartupInfoW
CreateDirectoryW
GetLogicalDrives
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
SetErrorMode
DeviceIoControl
MoveFileW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
GetFileInformationByHandleEx
SetEndOfFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
CompareStringW
LCMapStringW
CreateMutexW
CheckRemoteDebuggerPresent
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
GetUserDefaultLangID
SetFileAttributesW
AreFileApisANSI
GetLocaleInfoEx
TryAcquireSRWLockExclusive
GetStringTypeW
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
LCMapStringEx
CreateSemaphoreExW
FlushProcessWriteBuffers
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetCPInfo
UnhandledExceptionFilter
InterlockedPopEntrySList
QueryDepthSList
GetCurrentProcessorNumberEx
GetLogicalProcessorInformationEx
GetNumaHighestNodeNumber
SetThreadGroupAffinity
GetThreadTimes
FreeLibraryAndExitThread
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
ExitThread
SetStdHandle
ExitProcess
SystemTimeToTzSpecificLocalTime
GetConsoleOutputCP
GetCommandLineA
GetFileSizeEx
HeapAlloc
IsValidLocale
EnumSystemLocalesW
HeapReAlloc
HeapSize
HeapQueryInformation
IsValidCodePage
VirtualQuery
??0Animation@rlottie@@AAE@XZ
??0PlatformMethods@angle@@QAE@XZ
??0Surface@rlottie@@QAE@PAIIII@Z
??0Surface@rlottie@@QAE@XZ
??1Animation@rlottie@@QAE@XZ
??4PlatformMethods@angle@@QAEAAU01@$$QAU01@@Z
??4PlatformMethods@angle@@QAEAAU01@ABU01@@Z
??4Surface@rlottie@@QAEAAV01@$$QAV01@@Z
??4Surface@rlottie@@QAEAAV01@ABV01@@Z
?buffer@Surface@rlottie@@QBEPAIXZ
?bytesPerLine@Surface@rlottie@@QBEIXZ
?configureModelCacheSize@@YAXI@Z
?drawRegionHeight@Surface@rlottie@@QBEIXZ
?drawRegionPosX@Surface@rlottie@@QBEIXZ
?drawRegionPosY@Surface@rlottie@@QBEIXZ
?drawRegionWidth@Surface@rlottie@@QBEIXZ
?duration@Animation@rlottie@@QBENXZ
?frameAtPos@Animation@rlottie@@QAEIN@Z
?frameRate@Animation@rlottie@@QBENXZ
?height@Surface@rlottie@@QBEIXZ
?layers@Animation@rlottie@@QBEABV?$vector@V?$tuple@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HH@std@@V?$allocator@V?$tuple@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HH@std@@@2@@std@@XZ
?loadFromData@Animation@rlottie@@SA?AV?$unique_ptr@VAnimation@rlottie@@U?$default_delete@VAnimation@rlottie@@@std@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@ABV54@1_NABV?$vector@U?$pair@II@std@@V?$allocator@U?$pair@II@std@@@2@@4@W4FitzModifier@2@@Z
?loadFromFile@Animation@rlottie@@SA?AV?$unique_ptr@VAnimation@rlottie@@U?$default_delete@VAnimation@rlottie@@@std@@@std@@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@_N@Z
?render@Animation@rlottie@@QAE?AV?$future@VSurface@rlottie@@@std@@IVSurface@2@_N@Z
?renderSync@Animation@rlottie@@QAEXIVSurface@2@_N@Z
?renderTree@Animation@rlottie@@QBEPBULOTLayerNode@@III@Z
?setDrawRegion@Surface@rlottie@@QAEXIIII@Z
?setValue@Animation@rlottie@@AAEXUColor_Type@2@W4Property@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QAV?$function@$$A6A?AUColor@rlottie@@ABUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AAEXUColor_Type@2@W4Property@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UColor@2@@Z
?setValue@Animation@rlottie@@AAEXUFloat_Type@2@W4Property@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QAV?$function@$$A6AMABUFrameInfo@rlottie@@@Z@6@@Z
?setValue@Animation@rlottie@@AAEXUFloat_Type@2@W4Property@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@M@Z
?setValue@Animation@rlottie@@AAEXUPoint_Type@2@W4Property@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QAV?$function@$$A6A?AUPoint@rlottie@@ABUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AAEXUPoint_Type@2@W4Property@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UPoint@2@@Z
?setValue@Animation@rlottie@@AAEXUSize_Type@2@W4Property@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QAV?$function@$$A6A?AUSize@rlottie@@ABUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AAEXUSize_Type@2@W4Property@2@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@USize@2@@Z
?size@Animation@rlottie@@QBEXAAI0@Z
?totalFrame@Animation@rlottie@@QBEIXZ
?width@Surface@rlottie@@QBEIXZ
_ANGLEGetDisplayPlatform@20
_ANGLEResetDisplayPlatform@4
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ