Extended Key Usages
ExtKeyUsageCodeSigning
Key Usages
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
Static task
static1
Target
Telegram.exe
Size
153.8MB
MD5
2754021c593a43950ef846724b89494e
SHA1
be9dce8b7492a922d0e03c45e82d1215c5de7e53
SHA256
2e2c35dd1999ff405fe292a933fb29a147d9e00a008852bbe209002f908e1567
SHA512
acd37998fed2df2e10e6efd04e970f31242087f131fc0d3f0569b146ddbc260f4fc22418beae363d4e01bd2a9501d6a49bf9d629f1603fbaceea3052da81919d
SSDEEP
786432:kF74yLaEqKSeBZzwjmw2rKn9BYglfyLrWMFNI1oIfDthYKTpEzz68ltfahDvTfh:kF5aoSwMjerQCOyLlrEoIfDttFTDvDh
Embeds OpenSSL, may be used to circumvent TLS interception.
resource | yara_rule |
---|---|
sample | embeds_openssl |
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageCodeSigning
KeyUsageDigitalSignature
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageContentCommitment
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
ExtKeyUsageTimeStamping
KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
C:\Telegram\tx64\out\Release\Telegram.pdb
CopyFileW
GetLastError
DeleteFileW
QueryPerformanceFrequency
QueryPerformanceCounter
CreateFileW
WriteFile
CloseHandle
LocalFree
GetCommandLineW
RaiseException
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
DecodePointer
EncodePointer
GetCurrentProcessId
InitOnceExecuteOnce
RemoveDirectoryW
GetModuleFileNameW
GetEnvironmentVariableW
GetCurrentProcess
WinExec
GetModuleHandleW
GetFileInformationByHandle
FindFirstFileExW
GetFileAttributesW
FindNextFileW
FindClose
LoadLibraryW
GetModuleHandleExW
GetProcAddress
CreateEventW
WaitForMultipleObjects
CreateThread
SetThreadPriority
SetEvent
WaitForSingleObject
ResetEvent
InterlockedFlushSList
FreeLibrary
InterlockedPushEntrySList
InitializeSListHead
ReleaseSemaphore
CreateSemaphoreW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
VerSetConditionMask
VerifyVersionInfoW
GetLocaleInfoW
GetUserDefaultUILanguage
GetTickCount
GetTickCount64
MoveFileExW
FlushFileBuffers
FindFirstFileW
LockFile
UnlockFile
PowerCreateRequest
PowerSetRequest
PowerClearRequest
GetSystemPowerStatus
FormatMessageW
LocalAlloc
MultiByteToWideChar
WideCharToMultiByte
GetVersionExA
GetCurrentThreadId
FormatMessageA
CreateEventExW
WaitForMultipleObjectsEx
GetCurrentThread
WaitForSingleObjectEx
IsDebuggerPresent
DebugBreak
CreateSemaphoreA
ReadFile
SetFilePointerEx
Sleep
OpenThread
TlsAlloc
TlsGetValue
TlsSetValue
GetStdHandle
OutputDebugStringA
SetLastError
QueueUserAPC
CreateEventA
GetThreadId
GetModuleHandleA
OpenProcess
QueryFullProcessImageNameW
ExpandEnvironmentStringsW
GetVersionExW
GetNativeSystemInfo
ProcessIdToSessionId
WTSGetActiveConsoleSessionId
LoadLibraryExW
lstrcpyW
lstrlenW
lstrcpynW
TryEnterCriticalSection
GetCurrentDirectoryW
InitializeCriticalSectionEx
WakeConditionVariable
SleepConditionVariableCS
InitializeConditionVariable
WakeAllConditionVariable
GetFullPathNameW
MoveFileExA
InitOnceBeginInitialize
InitOnceComplete
InitializeSRWLock
SleepConditionVariableSRW
GetSystemDirectoryW
LoadLibraryExA
ReleaseMutex
GetConsoleMode
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetProcessAffinityMask
CreateMutexA
LoadLibraryA
OutputDebugStringW
GetProcessHeap
HeapFree
RtlCaptureContext
SetUnhandledExceptionFilter
TerminateThread
ResumeThread
GetProcessId
VirtualQueryEx
DuplicateHandle
SetNamedPipeHandleState
TransactNamedPipe
WaitNamedPipeW
SignalObjectAndWait
GetThreadGroupAffinity
SetEnvironmentVariableW
GetSystemInfo
VirtualProtect
SetCurrentDirectoryW
GetFileAttributesExW
GetTempPathA
GetTempFileNameA
GetModuleHandleExA
TlsFree
GetOEMCP
RtlVirtualUnwind
VirtualAlloc
VirtualFree
SwitchToFiber
DeleteFiber
CreateFiberEx
GetSystemTime
SystemTimeToFileTime
GetSystemDirectoryA
GetExitCodeThread
GetFileType
GetACP
ConvertFiberToThread
ConvertThreadToFiberEx
SetConsoleMode
ReadConsoleA
ReadConsoleW
ConnectNamedPipe
CreateNamedPipeW
GetOverlappedResult
DisconnectNamedPipe
GlobalFree
SetHandleInformation
GetVolumeInformationW
GetLongPathNameW
GetDriveTypeW
GetConsoleWindow
CompareStringEx
GetLocalTime
TerminateProcess
IsProcessorFeaturePresent
SwitchToThread
GetThreadPriority
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetExitCodeProcess
CreateProcessW
UnregisterWaitEx
RegisterWaitForSingleObject
ReadFileEx
PeekNamedPipe
CancelIoEx
SleepEx
WriteFileEx
GetDateFormatW
GetTimeFormatW
GetCurrencyFormatW
GetUserDefaultLCID
GetUserPreferredUILanguages
GetStartupInfoW
CreateDirectoryW
GetLogicalDrives
SetFileTime
GetTempPathW
GetVolumePathNamesForVolumeNameW
SetErrorMode
DeviceIoControl
MoveFileW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
GetFileInformationByHandleEx
SetEndOfFile
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
GetTimeZoneInformation
GetGeoInfoW
GetUserGeoID
CompareStringW
LCMapStringW
CreateMutexW
CheckRemoteDebuggerPresent
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalSize
GetUserDefaultLangID
SetFileAttributesW
AreFileApisANSI
GetLocaleInfoEx
TryAcquireSRWLockExclusive
RtlPcToFileHeader
GetStringTypeW
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
LCMapStringEx
CreateSemaphoreExW
FlushProcessWriteBuffers
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
GetCPInfo
RtlLookupFunctionEntry
UnhandledExceptionFilter
InterlockedPopEntrySList
QueryDepthSList
GetCurrentProcessorNumberEx
GetLogicalProcessorInformationEx
GetNumaHighestNodeNumber
SetThreadGroupAffinity
GetThreadTimes
FreeLibraryAndExitThread
RtlUnwindEx
RtlUnwind
InitializeCriticalSectionAndSpinCount
SetConsoleCtrlHandler
ExitThread
SetStdHandle
ExitProcess
SystemTimeToTzSpecificLocalTime
GetConsoleOutputCP
GetCommandLineA
GetFileSizeEx
HeapAlloc
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
IsValidLocale
EnumSystemLocalesW
HeapReAlloc
HeapSize
HeapQueryInformation
IsValidCodePage
VirtualQuery
??0Animation@rlottie@@AEAA@XZ
??0PlatformMethods@angle@@QEAA@XZ
??0Surface@rlottie@@QEAA@PEAI_K11@Z
??0Surface@rlottie@@QEAA@XZ
??1Animation@rlottie@@QEAA@XZ
??4PlatformMethods@angle@@QEAAAEAU01@$$QEAU01@@Z
??4PlatformMethods@angle@@QEAAAEAU01@AEBU01@@Z
??4Surface@rlottie@@QEAAAEAV01@$$QEAV01@@Z
??4Surface@rlottie@@QEAAAEAV01@AEBV01@@Z
?buffer@Surface@rlottie@@QEBAPEAIXZ
?bytesPerLine@Surface@rlottie@@QEBA_KXZ
?configureModelCacheSize@@YAX_K@Z
?drawRegionHeight@Surface@rlottie@@QEBA_KXZ
?drawRegionPosX@Surface@rlottie@@QEBA_KXZ
?drawRegionPosY@Surface@rlottie@@QEBA_KXZ
?drawRegionWidth@Surface@rlottie@@QEBA_KXZ
?duration@Animation@rlottie@@QEBANXZ
?frameAtPos@Animation@rlottie@@QEAA_KN@Z
?frameRate@Animation@rlottie@@QEBANXZ
?height@Surface@rlottie@@QEBA_KXZ
?layers@Animation@rlottie@@QEBAAEBV?$vector@V?$tuple@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HH@std@@V?$allocator@V?$tuple@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HH@std@@@2@@std@@XZ
?loadFromData@Animation@rlottie@@SA?AV?$unique_ptr@VAnimation@rlottie@@U?$default_delete@VAnimation@rlottie@@@std@@@std@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@AEBV54@1_NAEBV?$vector@U?$pair@II@std@@V?$allocator@U?$pair@II@std@@@2@@4@W4FitzModifier@2@@Z
?loadFromFile@Animation@rlottie@@SA?AV?$unique_ptr@VAnimation@rlottie@@U?$default_delete@VAnimation@rlottie@@@std@@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@_N@Z
?render@Animation@rlottie@@QEAA?AV?$future@VSurface@rlottie@@@std@@_KVSurface@2@_N@Z
?renderSync@Animation@rlottie@@QEAAX_KVSurface@2@_N@Z
?renderTree@Animation@rlottie@@QEBAPEBULOTLayerNode@@_K00@Z
?setDrawRegion@Surface@rlottie@@QEAAX_K000@Z
?setValue@Animation@rlottie@@AEAAXUColor_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QEAV?$function@$$A6A?AUColor@rlottie@@AEBUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AEAAXUColor_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UColor@2@@Z
?setValue@Animation@rlottie@@AEAAXUFloat_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QEAV?$function@$$A6AMAEBUFrameInfo@rlottie@@@Z@6@@Z
?setValue@Animation@rlottie@@AEAAXUFloat_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@M@Z
?setValue@Animation@rlottie@@AEAAXUPoint_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QEAV?$function@$$A6A?AUPoint@rlottie@@AEBUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AEAAXUPoint_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@UPoint@2@@Z
?setValue@Animation@rlottie@@AEAAXUSize_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@$$QEAV?$function@$$A6A?AUSize@rlottie@@AEBUFrameInfo@2@@Z@6@@Z
?setValue@Animation@rlottie@@AEAAXUSize_Type@2@W4Property@2@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@USize@2@@Z
?size@Animation@rlottie@@QEBAXAEA_K0@Z
?totalFrame@Animation@rlottie@@QEBA_KXZ
?width@Surface@rlottie@@QEBA_KXZ
ANGLEGetDisplayPlatform
ANGLEResetDisplayPlatform
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ