29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.zip
- SHA256 15002c24b7ffa26f826b347bdc20fc702b64863c6f7a92903a0da8e48c39ccf5
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.zip
- Size 1.3MB
- Sample260720-sy293sgw2x
- SHA256 15002c24b7ffa26f826b347bdc20fc702b64863c6f7a92903a0da8e48c39ccf5
- MD5 9b78be64554cb4d933f7fe22ccd9dbab
- SHA1 3832145e2406428630b91d88b1b8c409fe85e115
- SHA512 6195721f021fa2cf98a1ff4055283fae26dd3296b13c1726fbae1d6f376e5f5c9639e85a4858b9147dc39bf46145ac1c5cf69c56bd2d3626e950c7d98ca69d72
- SSDEEP 24576:r0rxRmVCk05cau4lTXazk8XgrpvtI3nYIStta2oAA3ywYhb2dIc:graVCkocW9zJQ3YISttaACsta
- TLSH T16E5533ABCF506C4983DF9552442F06E4A96E13A3A4C58C8DC545EA33B6EF1CEF10C62E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a
File Explorer
-
29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.zip.zip 1.3MB
-
29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a.exe 1.5MB
29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a
- IMPHASH 5d54686eb8d6133657508d5c3bce9d83
- SHA256 29abb3d155ce00a6d7b0cd1fb1f61b91473b33f10de8d9f3d8432daccead841a
- MD5 37ef6f74708643a7ca2ae36e767b4b0f
- SHA1 e70f6c9c8810256e5423dfe3819c251383e921be
- SHA512 74507d7f71d9d135993efe4cdf8338c689fb403efac724fba00269c48cbc13e1ca6e8ec4ce851a3ca4ad6d919bca7759f5fc5d98a90fc886464a0a3949c039c2
- SSDEEP 49152:878YkxNeCAYmLq7647KYgMOX8jhuH7RR:/YQNefYm+7pK5MOX8j0b
- TLSH T1A075010B96A401FDE1EBD174CD535906EBB2FC0A4B71A69F03E449921F376A09E3E712
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
1381120
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
winhttp
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpOpen
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable
WinHttpReadData
WinHttpReceiveResponse
WinHttpSendRequest
iphlpapi
GetAdaptersInfo
kernel32
WriteConsoleW
HeapSize
SetStdHandle
GetProcessHeap
SetEnvironmentVariableW
SetEndOfFile
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
FreeEnvironmentStringsW
DecodePointer
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetStdHandle
Sleep
CloseHandle
WideCharToMultiByte
SetConsoleOutputCP
GetComputerNameA
ExpandEnvironmentStringsW
WaitForSingleObject
ReadFile
SetFilePointer
CreateFileW
GetLastError
CreateProcessW
WriteFile
CreateNamedPipeW
PeekNamedPipe
GetTickCount64
GetCurrentProcessId
GetTickCount
ConnectNamedPipe
GetModuleHandleW
GetModuleFileNameW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GetFinalPathNameByHandleW
SetFileInformationByHandle
AreFileApisANSI
GetProcAddress
GetFileInformationByHandleEx
MultiByteToWideChar
LocalFree
FormatMessageA
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
RtlUnwind
GetStringTypeW
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileSizeEx
SetFilePointerEx
GetFileType
HeapAlloc
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
VirtualProtect
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadConsoleW
Name
.text
Size
1.5MB
Virtual Size
1.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=177, id=261, version=33145,
count=17, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=86, id=261, version=35207,
count=9, id=257, version=33145,
count=149, id=1, productName=Unmarked objects,
count=1, id=259, version=35226,
count=11, id=265, version=35226,
count=1, id=258, version=35226,