ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e.zip
- SHA256 9df679fc12fefbbdbc8e6e79de10b2c0b7cc6ad17a5dfd1692e0a585683616a4
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e.zip
- Size 252KB
- Sample260621-ppdctaes4s
- SHA256 9df679fc12fefbbdbc8e6e79de10b2c0b7cc6ad17a5dfd1692e0a585683616a4
- MD5 90d862a41a1b4e7699dd294f418b78f9
- SHA1 59d7df4a750db8847e5627495813d754597dd4ee
- SHA512 27bb6478986af8fa5c2ae2b71aca4f73868fbdc66d1da07b2e89332be0c67575a40e022ecf92f44fb67f7d43c7c0e78ec75dabf9d80141ca2eb664f3cf0b12e8
- SSDEEP 6144:PUsqmT7xOgZrinRs2oZxPFa/OFwAXW8N8c21uuaedCz9/jzFp:PUsxT5ri2Rx9OUmP1uz9bz/
- TLSH T1AF442399698EC720004637F825489E641BCD9D96907AEE3DE72166FFD328D80A54C3BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e
File Explorer
-
ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e.zip.zip 252KB
-
ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e.exe 530KB
ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e
- IMPHASH 8c4736f0b9595e7517aa9885e320d64e
- SHA256 ee8e20086e096597e168947a4310a5348778bc7ecc6de7412923e0f7cc65348e
- MD5 1a2ca5e29155452d1aa807b53528d4d8
- SHA1 f9f3dfe0d2a9f48e91d53ae991e8f45c97951e74
- SHA512 af93dfbd938f0a7fb1168ad3241fcd957d91e68dbc17a65b35ad8785f4f1cb4853819ffa87f2d214e621a6b59db7efce0d1a020af14b18e44d2f50ae4b09493a
- SSDEEP 6144:AWB+XRl6mZIBz8UlErtLzZjT7CHclZJQ7+g2N083MzDGy0bnrRra6pzLykAuj1G:hB+2kYGrbjFlZJORq4yyyrt31WqG
- TLSH T1F3C47D56962403FCE067D2F8CA534903F7B5B84A13A1A9EF03A09AB22F176D55E3F711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
253512
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
FindFirstFileA
FindNextFileA
GetFileInformationByHandle
GetFileSize
ReadFile
SetFilePointer
FindClose
CloseHandle
FileTimeToSystemTime
SetEndOfFile
WriteConsoleW
CreateFileW
HeapSize
CreateFileA
GetTickCount64
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
MultiByteToWideChar
WriteFile
LoadLibraryA
GetProcAddress
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
HeapReAlloc
CreatePipe
GetFileAttributesExW
GetExitCodeProcess
WaitForSingleObject
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
SetStdHandle
GetModuleHandleA
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
CompareStringEx
GetCPInfo
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
GetLastError
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
DuplicateHandle
GetCurrentProcess
CreateProcessW
IsProcessorFeaturePresent
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapFree
HeapAlloc
GetFileType
VirtualProtect
LoadLibraryExW
CompareStringW
LCMapStringW
RtlUnwind
user32
ReleaseDC
GetDC
gdi32
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
BitBlt
SelectObject
winhttp
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpQueryDataAvailable
WinHttpSetOption
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
ole32
CLSIDFromString
gdiplus
GdipAlloc
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipSaveImageToFile
GdipCloneImage
version
GetFileVersionInfoSizeA
winmm
timeGetTime
dnsapi
DnsQuery_A
Name
.text
Size
398KB
Virtual Size
397KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
76KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
992B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=188, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35403,
count=16, id=260, version=35403,
count=87, id=261, version=35403,
count=19, id=257, version=33145,
count=149, id=1, productName=Unmarked objects,
count=10, id=261, version=35724,
count=1, id=259, version=35724,
count=1, id=255, version=35724,
count=1, id=258, version=35724,