51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.zip
- SHA256 18698885ef3d2b5759324a6111078744402c50478ab376e88ab6ab8e8f739519
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.zip
- Size 440KB
- Sample260627-vcadaact9m
- SHA256 18698885ef3d2b5759324a6111078744402c50478ab376e88ab6ab8e8f739519
- MD5 ccc677b5cc4073ad9a2b9f98e1ef1ee7
- SHA1 5d8eb3737152143efa4479964d87faa0e1d3294b
- SHA512 6ecf1929a48c7b516d143016a1fbd5057c1233da7cef2527871003b715ac28e5bcc6b1a6554d41239b98e144e9685f3c27f4172544f570819881cc4aa1c75c86
- SSDEEP 12288:vE3+8nU9sc6fKgWk31l7/jD/zIQO+9wKaXNnhnCSFD:+nOstCghrjfFwKSNnh7FD
- TLSH T181A4231287ADCA2072B77755AABFAA675294D331355B9E81CB80B03A8341C5DC835FF2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Custom signatureDetect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634
File Explorer
-
51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.zip.zip 440KB
-
51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634.exe 989KB
51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634
- IMPHASH 793c2b917737edea615dd5695cf558b0
- SHA256 51a7c88a013e5651d90d6577360b8ef2c588fea66e20b2ef7d43931c263da634
- MD5 a1fb8a7bf9e843a85afacbaa79e1dd99
- SHA1 94a7ab6bb75e8e7ecfd943fe2608305846fee3db
- SHA512 2a89ae826aaad283600a2a9913628015199f4021ec38ba231b53461479d434a8425200fc6859f79bf7a6663ad087da9e59ecdc1325f5637b2111f80bb95a99db
- SSDEEP 12288:QD6a83ZQMKG6UYCSMxq6yn5BJYLEzhvxwxhDREtcI2wbYhjNjpUIbfMTo/:/D3Z0Gpzq6eJYQZ8bEtih5nt
- TLSH T194256E2E5B5801B8E1B6C1BDCE878D02D771784903B199EF0BD08E525E6B6E45F3AB13
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
515436
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
gethostname
gethostbyname
WSAStartup
WSACleanup
inet_ntoa
advapi32
RegOpenKeyExA
GetUserNameA
RegQueryValueExA
RegCloseKey
shell32
SHGetFolderPathA
SHGetSpecialFolderPathA
user32
GetDC
GetSystemMetrics
GetThreadDesktop
ReleaseDC
OpenClipboard
CloseClipboard
SetClipboardData
GetClipboardData
EmptyClipboard
CreateDesktopA
SetThreadDesktop
CloseDesktop
kernel32
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
CreatePipe
HeapReAlloc
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
GetDiskFreeSpaceExA
IsDebuggerPresent
CloseHandle
GetCurrentProcess
GlobalMemoryStatusEx
GetSystemInfo
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
WinExec
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32First
Process32Next
GetTempPathA
Sleep
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
WaitForSingleObject
TerminateProcess
OpenProcess
GetCurrentDirectoryA
CreateFileA
WriteConsoleW
ReadFile
GetEnvironmentStringsW
LocalFree
FindClose
FindFirstFileA
FindNextFileA
SetErrorMode
GetFileAttributesA
GetCurrentThreadId
CreateProcessA
ReadProcessMemory
Module32First
Module32Next
DeleteFileA
VirtualQueryEx
CreateDirectoryA
GetDriveTypeA
GetLogicalDrives
GetTickCount64
GetComputerNameA
WriteFile
GetExitCodeProcess
GetLocalTime
FlushFileBuffers
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapAlloc
HeapFree
GetStdHandle
GetModuleFileNameW
CreateProcessW
DuplicateHandle
FreeLibraryAndExitThread
ExitThread
CreateThread
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
SetStdHandle
GetLastError
ExitProcess
LoadLibraryExW
SetEndOfFile
GetFileSizeEx
TryAcquireSRWLockExclusive
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
FormatMessageA
GetLocaleInfoEx
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
RtlUnwind
SleepConditionVariableSRW
CreateDirectoryW
CreateFileW
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
SetFileTime
AreFileApisANSI
DeviceIoControl
GetModuleHandleW
CopyFileW
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
MultiByteToWideChar
RtlPcToFileHeader
RaiseException
InitOnceBeginInitialize
InitOnceComplete
WakeAllConditionVariable
FreeLibraryWhenCallbackReturns
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
GetModuleHandleExW
IsProcessorFeaturePresent
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
GetStringTypeW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlUnwindEx
winhttp
WinHttpSetTimeouts
WinHttpOpen
WinHttpCloseHandle
WinHttpCrackUrl
WinHttpQueryHeaders
WinHttpReceiveResponse
WinHttpSendRequest
WinHttpAddRequestHeaders
WinHttpOpenRequest
WinHttpSetOption
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReadData
gdiplus
GdipGetImageEncoders
GdipGetImageEncodersSize
GdipCreateBitmapFromHBITMAP
GdipSaveImageToFile
GdipDisposeImage
GdipCloneImage
GdiplusShutdown
GdiplusStartup
GdipFree
GdipAlloc
gdi32
BitBlt
SelectObject
DeleteObject
DeleteDC
CreateCompatibleDC
CreateCompatibleBitmap
crypt32
CryptStringToBinaryA
CryptUnprotectData
bcrypt
BCryptSetProperty
BCryptDestroyKey
BCryptDecrypt
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey
BCryptCloseAlgorithmProvider
dxgi
CreateDXGIFactory
Name
.text
Size
743KB
Virtual Size
743KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
17KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
32KB
Virtual Size
31KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=197, id=261, version=33145,
count=17, id=260, version=33145,
count=9, id=259, version=33145,
count=18, id=260, version=35207,
count=12, id=259, version=35207,
count=104, id=261, version=35207,
count=265, id=1, productName=Unmarked objects,
count=27, id=257, version=33145,
count=18, id=261, version=35228,
count=1, id=258, version=35228,