Telegram[.]exe

Resubmissions

26/07/2024, 01:21

240726-bqpwcaxcpm 5

26/07/2024, 01:19

240726-bp1lfsxclj 5

Sharing

Copy URL

Twitter E-mail

General

Target

Telegram.exe
Size

11.0MB
MD5

076c638ed34047d3daccf92a28a21317
SHA1

ea54b8204eedbd0c8e404a8a4b09fbc5f4ac48d7
SHA256

f28e8d11de9e05fef8b3eb69d517e368914bd5c91c9a6254f5e344dd956677a3
SHA512

c5a1b5cd5985ed4f98c81b2f2f12aded173db90159d4f7c071b1063c665c626f6b04ebdcc358d9a8f438ebe14a469d1aaee9338abc40d43ae2868cb0ded85377
SSDEEP

196608:YpW37VP9jTjaLqJ1XheBNtYFiWXWkybxzpmq2WnrWqkkb1qwJY2aOT:gWrx9zwuPMtiX2t1ZjlY3OT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Telegram.exe

Files

Telegram.exe
.exe windows:6 windows x64 arch:x64

432b537c6c5bd3ddaffbf9d80d7a2532

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReadProcessMemory
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

UnregisterClassW

gdi32

CreateRoundRectRgn

advapi32

RegCloseKey

imm32

ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

WSAGetLastError

ntdll

RtlAdjustPrivilege

Sections

.text
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_BSSg_la
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 10.6MB - Virtual size: 10.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

Files

432b537c6c5bd3ddaffbf9d80d7a2532

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

imm32

d3dcompiler_47

d3d11

ws2_32

ntdll

Sections

.text Size: - Virtual size: 1.5MB

_BSSg_la Size: - Virtual size: 8B

.rdata Size: - Virtual size: 466KB

.data Size: - Virtual size: 1.2MB

.pdata Size: - Virtual size: 60KB

.data1 Size: - Virtual size: 19KB

.trace Size: - Virtual size: 9KB

_RDATA Size: - Virtual size: 4KB

Size: - Virtual size: 5.7MB

Size: 3KB - Virtual size: 3KB

Size: 10.6MB - Virtual size: 10.6MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.5MB

_BSSg_la
Size: - Virtual size: 8B

.rdata
Size: - Virtual size: 466KB

.data
Size: - Virtual size: 1.2MB

.pdata
Size: - Virtual size: 60KB

.data1
Size: - Virtual size: 19KB

.trace
Size: - Virtual size: 9KB

_RDATA
Size: - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B