e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f.zip
- SHA256 c24beed892162bdc5638ecc1806ba074e1b123681c8867e0f3ccd2f2a79708ce
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f.zip
- Size 750KB
- Sample260624-pgd95sb14k
- SHA256 c24beed892162bdc5638ecc1806ba074e1b123681c8867e0f3ccd2f2a79708ce
- MD5 16cb59d986bb1c1deee53c7889e46f39
- SHA1 404f5f90575b84680c362f6cb9acf17146d120fe
- SHA512 7981b66c63974a4aca703b5ec9c75f06e3ad720c9927d37432e90831a10b7c5b05b0491b663674311e12c75743e5fce1960be6c3eed2a775b22dfe1d7d99c59d
- SSDEEP 12288:SZus2aFVLw1Xf1WBqJTd1vZicX7Nr5Ghs1ce1jbDHIZmTq6TR5A:SZ78Xf1WIJ51vn7Nr5QRe1nT/q6Ni
- TLSH T149F423B8C0124BDB6FC2C9391B549BF8621768CBBFFF2250AB3A5CC714DA6952E1514C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f
File Explorer
-
e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f.zip.zip 750KB
-
e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f.exe 969KB
e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f
- IMPHASH 67794d112116960a34d1b184c62a4d98
- SHA256 e7afcb8033a402d11ba4b52290eaa40f5465edbcf592eaa2fe5ede97e47ac91f
- MD5 1103fc3fda5d450e7657f69e7332e467
- SHA1 39baa6e92d6c75879bf0453d9fce999c7437bbc4
- SHA512 9c18dc82b866f22c5ebbce95777a7cb59dc8abde4d31043447efb5546898174f6c7ae6880e25301dd1ba9ab2b42d09813f8146ad487859706fb54255b786c3fe
- SSDEEP 12288:/tXASd/HYOiyssQMPYWbP2IzW4iEGU7r34Axm2uIxG5ea90QeK+sgijOA/Ui3y80:VXA4rQoRbeIzW4iEZ31m2Rx2+siA/s8
- TLSH T13825F155F797226AD7374F3885A2D342EFB278560B75C7CF6B902AE52D232D00D29B02
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
87352
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernelbase
FlsAlloc
FlsSetValue
InitializeCriticalSectionEx
LCMapStringEx
advapi32
RegCloseKey
GetUserNameA
RegCreateKeyExW
RegDeleteTreeW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
GetUserNameW
gdi32
GetStockObject
CreateCompatibleDC
SelectObject
CreateCompatibleBitmap
BitBlt
DeleteDC
DeleteObject
iphlpapi
GetAdaptersInfo
kernel32
LCMapStringW
CompareStringW
VirtualProtect
InitializeCriticalSectionEx
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
CreateProcessW
GetExitCodeProcess
WaitForSingleObject
GetFileType
HeapAlloc
HeapFree
GetModuleHandleExW
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
SetLastError
GetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetProcessHeap
SetStdHandle
GetStringTypeW
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
WriteConsoleW
GetStdHandle
SizeofResource
GetVolumeInformationW
FindNextFileW
GetCurrentProcess
WriteFile
TerminateProcess
RemoveDirectoryW
GetModuleFileNameW
FindClose
CreateFileW
GetFileAttributesW
GetSystemDirectoryW
CreateToolhelp32Snapshot
Sleep
GetFileAttributesExW
Process32NextW
GetCurrentThread
LockResource
GlobalAlloc
DeleteFileW
Process32FirstW
CloseHandle
CreateThread
LoadResource
FindResourceW
GetProcAddress
GlobalLock
FatalExit
GetCurrentProcessId
GetModuleHandleW
WideCharToMultiByte
GetSystemTime
QueryPerformanceCounter
GetTickCount
GlobalUnlock
IsDebuggerPresent
GetComputerNameA
CheckRemoteDebuggerPresent
GlobalFree
shell32
ShellExecuteW
SHGetFolderPathW
user32
DefWindowProcW
MessageBoxW
GetMessageW
EnumDisplayMonitors
InvalidateRect
UpdateWindow
PostQuitMessage
GetClientRect
SetWindowsHookExW
LoadCursorW
BeginPaint
SetWindowLongPtrW
CreateWindowExW
CallNextHookEx
GetSystemMetrics
GetWindowLongPtrW
RegisterClassExW
ShowWindow
GetAsyncKeyState
DispatchMessageW
SetTimer
GetMonitorInfoW
UnhookWindowsHookEx
SetLayeredWindowAttributes
TranslateMessage
EndPaint
wininet
InternetCloseHandle
InternetConnectA
InternetOpenUrlA
InternetCrackUrlA
HttpOpenRequestA
InternetOpenA
HttpSendRequestA
gdiplus
GdipDrawLineI
GdipSetPathGradientSurroundColorsWithCount
GdipLoadImageFromStream
GdiplusStartup
GdiplusShutdown
GdipCreateStringFormat
GdipDeleteFontFamily
GdipGetImageHeight
GdipAddPathArcI
GdipCreateFontFamilyFromName
GdipCloneImage
GdipAddPathEllipseI
GdipDeleteBrush
GdipAlloc
GdipDrawImageRectI
GdipDeletePath
GdipSetPathGradientCenterColor
GdipCreatePathGradientFromPath
GdipDisposeImage
GdipSetSmoothingMode
GdipCreateLineBrush
GdipCreatePath
GdipSetStringFormatLineAlign
GdipCreateFont
GdipSetLinePresetBlend
GdipSetInterpolationMode
GdipCreateSolidFill
GdipFillPath
GdipClosePathFigure
GdipGetGenericFontFamilySansSerif
GdipFree
GdipDrawPath
GdipDrawString
GdipCreateFromHDC
GdipFillEllipseI
GdipSetTextRenderingHint
GdipCloneBrush
GdipGetPathGradientPointCount
GdipFillRectangleI
GdipCreatePen2
GdipDeleteGraphics
GdipDeleteStringFormat
GdipDeleteFont
GdipGetImageWidth
GdipDeletePen
GdipCreatePen1
GdipNewPrivateFontCollection
GdipSetStringFormatAlign
GdipDeletePrivateFontCollection
GdipPrivateAddMemoryFont
combase
CreateStreamOnHGlobal
Name
.text
Size
192KB
Virtual Size
192KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
16KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
8KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
724KB
Virtual Size
724KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
13KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=153, id=261, version=33140,
count=12, id=260, version=33140,
count=8, id=259, version=33140,
count=10, id=259, version=35207,
count=19, id=260, version=35207,
count=48, id=261, version=35207,
count=19, id=257, version=33140,
count=245, id=1, productName=Unmarked objects,
count=1, id=265, version=35217,
count=1, id=255, version=35217,
count=1, id=258, version=35217,