602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8.zip
- SHA256 9947d5af02cd18954c9627b2a61c6f1f3d9fad829bf7e2353c93b220858705cf
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8.zip
- Size 33.1MB
- Sample260808-vx6bfsef34
- SHA256 9947d5af02cd18954c9627b2a61c6f1f3d9fad829bf7e2353c93b220858705cf
- MD5 0a266c8993118f074f44e8dacca35b05
- SHA1 00d6f040aabaa80980bc51d0b717b1b065d27080
- SHA512 cc8977700f4732300ac3bbe4304a399d6e6a61b1ff6592a740e8b91190846419b551022d94eb775af58ae792bb62772df4fe890c975c7f8f2f3184a900e3016c
- SSDEEP 786432:3bCjhlV23VhktUA3R3UgMyq7934qg60emL8zy32tkJHskDs7Bu:32jhvUhkt9BkgMyG39tmLHXsoQBu
- TLSH T110773382107B57DFEEB1E08B2E707CDC530360A68357D536721E56F6C6AA4DA089F81E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Detect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8 suspicious_telegram_bot - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8
File Explorer
-
602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8.zip.zip 33.1MB
-
602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8.exe 47.0MB
602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8
- IMPHASH 0621b3f5e21aabc1c67fb5e0e939bba8
- SHA256 602532791010fb9b9f640bc7c316c4bcaadc69aa279c488bae07d53e973a7fb8
- MD5 2223c2c2492b15a3e1b3d9b973eff8fb
- SHA1 23ed858035dff5c2f989e01559adbbbc40948239
- SHA512 0dd69c4e2e397308e4809a956046960a38a90af48a1e676f284846a8f5c906571ec4fd6e38b3e028805359bcd38ebc8eb2fd1195cadc885bd93f0451252f7a99
- SSDEEP 786432:vjz9dQ2Qq57ZPBgGSYrCNJJBtkoVfi3bUA/A4dmuKHp+XNO4nW/Zke95cMW+v5Ja:ldQQ7ZPBgGSYrCNJJBtkoNmb7/A4dmu5
- TLSH T18BB70255F168A1BDC026D176F20B219BF2E2B4155B38B7DB0DEC46552F2B7E80BBD220
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
6
Entry point
48791952
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
ws2_32
closesocket
advapi32
OpenProcessToken
ole32
CoTaskMemAlloc
shell32
SHGetFolderPathW
shlwapi
PathFindFileNameW
user32
TranslateMessage
version
VerQueryValueW
crypt32
CertFindCertificateInStore
kernel32
RtlUnwindEx
comdlg32
GetSaveFileNameW
urlmon
URLDownloadToFileW
wininet
DeleteUrlCacheEntryW
dwmapi
DwmExtendFrameIntoClientArea
iphlpapi
FreeMibTable
Name
.text
Size
7.1MB
Virtual Size
7.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.6MB
Virtual Size
2.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
480KB
Virtual Size
552KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
294KB
Virtual Size
296KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.vb
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.w290p
Size
18.0MB
Virtual Size
18.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.l2j
Size
18.5MB
Virtual Size
18.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=9, id=259, version=30795,
count=196, id=261, version=30795,
count=19, id=260, version=35207,
count=12, id=259, version=35207,
count=104, id=261, version=35207,
count=21, id=260, version=30795,
count=2, id=257, version=30154,
count=366, id=1, productName=Unmarked objects,
count=29, id=257, version=30795,
count=17, id=261, version=35225,
count=48, productName=Unmarked objects (old),
count=941, id=260, version=35225,
count=1, id=261, version=35222,
count=1, id=255, version=35222,
count=1, id=151,
count=1, id=258, version=35222,