3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d.zip
- SHA256 6f97d67f0cc39d3d2a971b6c15ea6d7253af5302be95cda669a06dd99fb7107f
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d.zip
- Size 287KB
- Sample260807-pcsa7svdph
- SHA256 6f97d67f0cc39d3d2a971b6c15ea6d7253af5302be95cda669a06dd99fb7107f
- MD5 75692eeb3effc71c6311313d2df0d45b
- SHA1 1579085d6fdbc88980fb450087b76bb941d05a70
- SHA512 eb22f1319553b6fb1042d65ace7b7bfc0c6307a7e83e70613190df339067713dd225240f1862286b1867a1ba531ec5828ca1fbd27616e5bf0310c613768e9c15
- SSDEEP 6144:VSfcQtW5sTtCsSLAptazc5IJMys5G2bC/cXqFo+PVpNsk08OLMpa:VSfgexpSUpYzceJRyLW/cXqFosNLvOJ
- TLSH T1A55423E241F4A16D226891D2F691EC82C811537DFB5F67407E4254BA0BB09EB6BDE30F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d
File Explorer
-
3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d.zip.zip 287KB
-
3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d.exe 628KB
3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d
- IMPHASH 21d3e0c535f8f12bb16334eb363165a7
- SHA256 3963fc8fe8c6f5cd44c093705d0ef9d2adbed0a68e02a108a3f19c9656b7e00d
- MD5 6bfe962c232173c3763ec547868b96cb
- SHA1 c07a26a91bac9aa21d1f11b6fb2907e1d8788d12
- SHA512 33a88c137b08550b750be7f6c3d1a1e4f815e258aab8bc6693f3d34839c1c4bbd511f9c935c9c1f5dea7fd43f1e9a1eca5895b175bfaf321271f18d7842158e5
- SSDEEP 6144:IN7n63HpIOyo2Vy6MMSAoqiFaQNKglICXuWefy0ZDdNsOfivVzJcSX6MkVFOu/Nl:IcaI6KYQ4qIDRjVFzL36Wppgb/2Yu
- TLSH T173D46D32E654107CE1B3D2B89E565802E6F2788A4334BDDF03D159A21F177E89BBEB11
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
302624
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
winhttp
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
WinHttpCloseHandle
WinHttpSendRequest
WinHttpSetTimeouts
WinHttpConnect
WinHttpQueryDataAvailable
gdiplus
GdiplusShutdown
GdipGetImageEncoders
GdipCloneImage
GdipAlloc
GdipDrawImageRectI
GdipCreateBitmapFromHBITMAP
GdipDisposeImage
GdipSetInterpolationMode
GdipGetImagePixelFormat
GdipFree
GdipGetImageGraphicsContext
GdipGetImageEncodersSize
GdipDeleteGraphics
GdipSaveImageToStream
GdipCreateBitmapFromScan0
GdiplusStartup
crypt32
CertCloseStore
CertDuplicateCertificateContext
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertFreeCertificateContext
CertCreateSelfSignCertificate
CertDeleteCertificateFromStore
CryptEncodeObject
CertSetCertificateContextProperty
CertGetNameStringW
CertSetEnhancedKeyUsage
CertOpenStore
CertGetCertificateContextProperty
CertStrToNameW
CertFindCertificateInStore
cryptui
CryptUIWizDigitalSign
wintrust
WinVerifyTrust
kernel32
GetConsoleMode
ReadConsoleW
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetCommandLineA
GetCommandLineW
GetConsoleOutputCP
FlushFileBuffers
TerminateProcess
CreateMutexW
OpenProcess
CreateToolhelp32Snapshot
Sleep
GetLastError
Process32NextW
Process32FirstW
CloseHandle
GetCurrentProcessId
QueryFullProcessImageNameW
GetTickCount64
GetSystemInfo
GetComputerNameW
GlobalMemoryStatusEx
GetProcessHeap
GetLogicalDrives
SetHandleInformation
GetCurrentProcess
GetModuleFileNameW
CreatePipe
GetEnvironmentVariableW
PeekNamedPipe
WaitForSingleObject
FreeEnvironmentStringsW
FileTimeToSystemTime
GetDiskFreeSpaceExW
GlobalAlloc
DeleteFileW
GlobalFree
GetProcAddress
GlobalLock
CreateProcessW
GetModuleHandleW
GetSystemTimeAsFileTime
GetEnvironmentStringsW
GlobalUnlock
GetDriveTypeW
MoveFileExW
CopyFileW
GetSystemTime
MultiByteToWideChar
GetLocalTime
WideCharToMultiByte
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
WriteFile
GetStdHandle
IsProcessorFeaturePresent
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
FreeLibrary
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
SetEndOfFile
RtlUnwind
VirtualProtect
LoadLibraryExW
LCMapStringW
GetLocaleInfoW
IsValidLocale
ExitThread
CreateThread
GetFileType
GetUserDefaultLCID
ReadFile
SetFilePointerEx
GetFileSizeEx
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
WaitForSingleObjectEx
GetExitCodeThread
WakeConditionVariable
WakeAllConditionVariable
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
SetFileInformationByHandle
GetTempPathW
CreateFile2
AreFileApisANSI
DeviceIoControl
CopyFile2
CreateHardLinkW
GetFileInformationByHandleEx
CreateSymbolicLinkW
LocalFree
FormatMessageA
GetLocaleInfoEx
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
SetUnhandledExceptionFilter
GetStartupInfoW
InitializeSListHead
RtlLookupFunctionEntry
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
EnumSystemLocalesW
user32
GetDC
MessageBoxW
EnumDisplayMonitors
GetSystemMetrics
OpenClipboard
GetMonitorInfoW
CloseClipboard
EmptyClipboard
GetClipboardData
GetClipboardSequenceNumber
SetClipboardData
ReleaseDC
gdi32
DeleteObject
DeleteDC
CreateCompatibleDC
BitBlt
CreateCompatibleBitmap
SelectObject
advapi32
GetTokenInformation
RegDeleteValueW
RegOpenKeyExW
CryptAcquireContextW
OpenProcessToken
GetUserNameW
RegCloseKey
RegSetValueExW
shell32
ShellExecuteW
ole32
CreateStreamOnHGlobal
iphlpapi
GetAdaptersAddresses
ws2_32
inet_ntop
Name
.text
Size
452KB
Virtual Size
452KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
120KB
Virtual Size
120KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33145,
count=18, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=95, id=261, version=35721,
count=27, id=257, version=33145,
count=238, id=1, productName=Unmarked objects,
count=7, id=265, version=36252,
count=1, id=255, version=36252,
count=1, id=151,
count=1, id=258, version=36252,