Telegram[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Telegram.exe
Size

11.6MB
MD5

848eef8cec76bfb92b32216a395588c0
SHA1

998df0f02de9475f2749b774f44b37c23f17be15
SHA256

fcbf25519156203cdf39561af11897f89138a41c3c9690ef8c9ad9210a8c71ca
SHA512

c9d3028f314a6109453eeb39dff5ff0d48f6544a91176624698b55c2fe70d6b374abc4cc798c4d111c21c34aa93c2f60e14789c0eee986f50771bdba9d643acf
SSDEEP

196608:YpW37VP9jTjaLqJ1XheBNtYFiWXWkybxzpmq2WnrWqkkb1qwJY8Wt:gWrx9zwuPMtiX2t1ZjlY8Wt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Telegram.exe

Files

Telegram.exe
.exe windows:6 windows x64 arch:x64

432b537c6c5bd3ddaffbf9d80d7a2532

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

ReadProcessMemory
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

UnregisterClassW

gdi32

CreateRoundRectRgn

advapi32

RegCloseKey

imm32

ImmSetCompositionWindow

d3dcompiler_47

D3DCompile

d3d11

D3D11CreateDeviceAndSwapChain

ws2_32

WSAGetLastError

ntdll

RtlAdjustPrivilege

Sections

.text
Size: - Virtual size: 1.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

_BSSg_la
Size: - Virtual size: 8B

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 466KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data1
Size: - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.trace
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Size: - Virtual size: 5.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Size: 10.6MB - Virtual size: 10.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

432b537c6c5bd3ddaffbf9d80d7a2532

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

imm32

d3dcompiler_47

d3d11

ws2_32

ntdll

Sections

.text Size: - Virtual size: 1.5MB

_BSSg_la Size: - Virtual size: 8B

.rdata Size: - Virtual size: 466KB

.data Size: - Virtual size: 1.2MB

.pdata Size: - Virtual size: 60KB

.data1 Size: - Virtual size: 19KB

.trace Size: - Virtual size: 9KB

_RDATA Size: - Virtual size: 4KB

Size: - Virtual size: 5.7MB

Size: 3KB - Virtual size: 3KB

Size: 10.6MB - Virtual size: 10.6MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.5MB

_BSSg_la
Size: - Virtual size: 8B

.rdata
Size: - Virtual size: 466KB

.data
Size: - Virtual size: 1.2MB

.pdata
Size: - Virtual size: 60KB

.data1
Size: - Virtual size: 19KB

.trace
Size: - Virtual size: 9KB

_RDATA
Size: - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B