2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b.zip
- SHA256 3de34a369d1ffc4936de3f800054a438b70200976f54fbec8fbb078e9893caa5
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b.zip
- Size 101KB
- Sample260804-tabynahp9t
- SHA256 3de34a369d1ffc4936de3f800054a438b70200976f54fbec8fbb078e9893caa5
- MD5 aa9ff068448c924e2b462aca80c07e90
- SHA1 968ae14f3976d6de0f35d0441a87e4dfcaf0928a
- SHA512 4fb9d418878856949e9cfda84bed39ee7291c3d2e16df109b23508a9a315a73a6927420bbc5abf356968534eb10de2827d4ff1d028bbb11ac1747395d6388d56
- SSDEEP 1536:LRQ4AebSy7MjwOIpNW8qo74rbwMLv7g6Yb7pvc/40FKxbglBhhZeFcBqva:L24AIYjdUkLX/DAHpv8FKxb+BoFcBqy
- TLSH T149A312F269558E4B868C41EA7D0F2342103F4F1D6818954B0EFFB235669F446AE0EEF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b
File Explorer
-
2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b.zip.zip 101KB
-
2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b.exe 204KB
2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b
- IMPHASH bea16afc7646ca2d3fcb0e31bd5d989f
- SHA256 2ff2781d5a43a0b512f954f4e434130f69e66c08c624a322eebcb541b281114b
- MD5 2a425262521868a6bfb875748f8a6b37
- SHA1 34e9503ce76ec9514761a3a6554a1f2d8b4e818d
- SHA512 adb03146c5a8f1ad565d1d982c8a39a841c6adabd7fe8bd591407e1c6d7b62994ce38c7a5dc12373ba33f1484d7b9171af63821f9047dcac5e535c8efb7f27a2
- SSDEEP 3072:F2q5qrqrZCXWAp8qsWej2meagpLdqzdMVQvAYCDE+mSKWMQMKG4U3QJv:F2q5qrqr8XWNjWej2me53qhvAvgH36
- TLSH T177147D55BAA504FEE1678138CE530941EA737C8647A0DADF43904BE6DE236E09F3DB12
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
38932
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
RegCreateKeyExA
RegCreateKeyExW
RegSetValueExA
RegSetValueExW
RegCloseKey
shell32
SHGetFolderPathW
wininet
InternetReadFile
InternetCloseHandle
InternetOpenA
InternetOpenUrlA
wlanapi
WlanCloseHandle
WlanFreeMemory
WlanEnumInterfaces
WlanOpenHandle
gdi32
SetTextColor
SetBkMode
SetBkColor
SelectObject
RoundRect
GetStockObject
DeleteObject
CreateSolidBrush
CreatePen
CreateFontW
ws2_32
connect
closesocket
htons
WSACleanup
WSAStartup
inet_addr
select
ioctlsocket
socket
user32
MessageBoxW
GetClientRect
GetWindowTextW
SetWindowTextW
EndPaint
BeginPaint
SetForegroundWindow
GetSystemMetrics
SetWindowPos
FillRect
DestroyWindow
CreateWindowExW
UnregisterClassW
RegisterClassW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
ShowWindow
wsprintfW
LoadCursorA
kernel32
GetProcessHeap
GetStringTypeW
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
HeapSize
HeapReAlloc
WriteConsoleW
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
MultiByteToWideChar
GetCommandLineW
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
HeapAlloc
HeapFree
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
CreateFileA
CreateFileW
FindClose
FindFirstFileW
FindNextFileW
GetFileSize
ReadFile
SetFilePointerEx
WriteFile
CloseHandle
GetTickCount
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleFileNameW
GetModuleHandleW
WinExec
CopyFileW
MoveFileW
GetComputerNameA
WideCharToMultiByte
GetCurrentThreadId
QueryPerformanceCounter
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
GetProcAddress
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
RtlPcToFileHeader
RaiseException
RtlUnwindEx
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
Name
.text
Size
122KB
Virtual Size
122KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
68KB
Virtual Size
67KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=146, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=10, id=259, version=35207,
count=16, id=260, version=35207,
count=59, id=261, version=35207,
count=17, id=257, version=33145,
count=195, id=1, productName=Unmarked objects,
count=1, id=261, version=35227,
count=1, id=258, version=35227,