4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.zip
- SHA256 c0bac1178496ece327d7d39c3d2405a14a5b9644045d9fc1801017aa784c5a29
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.zip
- Size 282KB
- Sample260807-pc7e5avdrg
- SHA256 c0bac1178496ece327d7d39c3d2405a14a5b9644045d9fc1801017aa784c5a29
- MD5 94fde8abced64e081b14d9e27239b3c2
- SHA1 7551280c60cdd0d68f7b8f9b6de1f760209dcf06
- SHA512 a6b9b99b55e75525b777b1a0c49d5cdb17cfcc57bef4b1238ba3201a65f956a0ce0e18c8fef321738c584c07592b53f5ba615090e88946d7a608372141047556
- SSDEEP 6144:J1A1D/8AGbA1ENpPhjg2vt3PD4jTyo0lYQ+H:HAZbGbOENpPhcgIXH
- TLSH T1975423E36FA9A0EF16EB515FCC59E025265FD1F648004BE707A3576B263C9866B2C00F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700 suspicious_telegram_bot - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700
File Explorer
-
4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.zip.zip 282KB
-
4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700.exe 601KB
4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700
- IMPHASH 21d3e0c535f8f12bb16334eb363165a7
- SHA256 4b7512c182d68ff5a9416cfe628ad095c5f8517cf91305d9a0b2d6a05d083700
- MD5 0ab08f591b8f186beb7f61c08e6af657
- SHA1 7f12087996b0fd5cc096845197a49698f4f71639
- SHA512 129e7e6211b9a55c955f4a1a549966806224c0bf3be09a7b50ba4e02c22bf915ff36c6ad39440189a13e4b98486e77e22215da964f4d7f9991b7f03098dafc77
- SSDEEP 6144:aN7n63HpIOyo2Vy6MMSAoqiFaQNKglICXuWefy0ZDdNsOfivVzJcSX6MkVFOu/NX:acaI6KYQ4qIDRjVFzL36WppgKkBQ
- TLSH T182D45D26A65400FCE1B3D2F99E565802E672784A0334AEDF03D159A31F177E89F7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
PE Signature issue
Digest
e0:7d:b1:87:f7:ce:af:e1:ec:1e:6e:4b:05:7f:5a:ca:56:50:d6:13
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=blackninjas
Chains
Aug 6, 2026
CN=blackninjas
Subject
CN=blackninjas
Serial Number
10:aa:35:1a:5b:3f:3f:80:45:84:32:66:a5:71:da:31
Issuer
CN=blackninjas
Timespan
Aug 6, 2026 - Aug 6, 2029
Minor OS version
0
Major OS version
6
Entry point
302624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\richi\source\repos\blackninjas\x64\Release\blackninjas.pdb
winhttp
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable
gdiplus
GdiplusShutdown
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipFree
GdipGetImageGraphicsContext
GdipGetImageEncodersSize
GdipDeleteGraphics
GdipSaveImageToStream
GdipCreateBitmapFromScan0
GdiplusStartup
crypt32
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCreateSelfSignCertificate
CertDeleteCertificateFromStore
CryptEncodeObject
CertSetCertificateContextProperty
CertGetNameStringW
CertSetEnhancedKeyUsage
CertOpenStore
CertGetCertificateContextProperty
CertStrToNameW
CertFindCertificateInStore
cryptui
CryptUIWizDigitalSign
wintrust
WinVerifyTrust
kernel32
GetConsoleMode
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetCommandLineA
GetCommandLineW
GetConsoleOutputCP
FlushFileBuffers
TerminateProcess
CreateMutexW
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
Process32FirstW
CloseHandle
GetCurrentProcessId
QueryFullProcessImageNameW
GetTickCount64
GetSystemInfo
GetComputerNameW
GlobalMemoryStatusEx
GetProcessHeap
GetLogicalDrives
SetHandleInformation
GetCurrentProcess
GetModuleFileNameW
CreatePipe
GetEnvironmentVariableW
PeekNamedPipe
WaitForSingleObject
FreeEnvironmentStringsW
FileTimeToSystemTime
GetDiskFreeSpaceExW
GlobalAlloc
DeleteFileW
GlobalFree
GetProcAddress
GlobalLock
CreateProcessW
GetModuleHandleW
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GlobalUnlock
GetDriveTypeW
MoveFileExW
CopyFileW
GetSystemTime
MultiByteToWideChar
GetLocalTime
WideCharToMultiByte
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
WriteFile
GetStdHandle
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
SetEndOfFile
RtlUnwind
VirtualProtect
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
ExitThread
CreateThread
GetFileType
GetUserDefaultLCID
ReadFile
SetFilePointerEx
GetFileSizeEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
WaitForSingleObjectEx
GetExitCodeThread
WakeConditionVariable
WakeAllConditionVariable
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
GetTempPathW
CreateFile2
AreFileApisANSI
DeviceIoControl
CopyFile2
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
LocalFree
FormatMessageA
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnumSystemLocalesW
user32
GetDC
MessageBoxW
EnumDisplayMonitors
GetSystemMetrics
OpenClipboard
GetMonitorInfoW
CloseClipboard
EmptyClipboard
GetClipboardData
GetClipboardSequenceNumber
SetClipboardData
ReleaseDC
gdi32
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
SelectObject
advapi32
GetTokenInformation
RegDeleteValueW
RegOpenKeyExW
CryptAcquireContextW
OpenProcessToken
GetUserNameW
RegCloseKey
RegSetValueExW
shell32
ShellExecuteW
ole32
CreateStreamOnHGlobal
iphlpapi
GetAdaptersAddresses
ws2_32
inet_ntop
Name
.text
Size
451KB
Virtual Size
451KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33145,
count=18, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=95, id=261, version=35721,
count=27, id=257, version=33145,
count=238, id=1, productName=Unmarked objects,
count=7, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,