b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.zip
- SHA256 ba0bd947b1762f6b7c8f10c514e6ce4010cf8dd931edba20854e19e565c8fd69
Password
infected
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.zip
- Size 4.1MB
- Sample261113-vxkprad17x
- SHA256 ba0bd947b1762f6b7c8f10c514e6ce4010cf8dd931edba20854e19e565c8fd69
- MD5 82d3da6288b4fe6a973543d3631801fb
- SHA1 7a5a2990ee23f962271895225edaae9e64719806
- SHA512 868a416ba938fefa7f2ecec7271735616905463f8116a94e2b5d660e5f05d7e385415fb62c3086b6e4d7659c90332e8632858af5f76674acc647656e8f781967
- SSDEEP 98304:5+MBpPhqOS9CAUnqcjx+HiEY1euG75SvlHB/8jf22:5tPgX9zcF+HZ39S5Bb2
- TLSH T1C41633783491B2D01D167DD80DE6A542C2383B28268CBF9383796747BB37244F7BE699
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Custom signatureDetect suspicious telegram bot 1 IoCs
Detect suspicious telegram bot.
resource yara_rule static1/unpack001/b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b suspicious_telegram_bot - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b
File Explorer
-
b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.zip.zip 4.1MB
-
b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b.exe 8.9MB
b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b
- IMPHASH d42595b695fc008ef2c56aabd8efd68e
- SHA256 b482c203b499d6585afb557fce20617202b54fe335c6eb3bf9ecff12888bfe9b
- MD5 2d85768b2ee8bcd304ce9a5725f3bcf9
- SHA1 4ccbec3e26c0a19a74cf9a956e4f403179ed6d27
- SHA512 f1fea8df52806299134313a9f776feb3855c3dbb20956261bd87ea90a4f64d4aa6830bb00b894c25a3894499a3db9ff825d9981ee814e087ea2ea14d3e32af94
- SSDEEP 98304:pzAVQj4XrjtVSan/MjAIIEomk6E5H0cpk+YgQggAeKbiUUe22SOyEM4sdu0BEj:pF8XtVSaUjzrop5HHN0Cj
- TLSH T122966B07ECA145E9C0E9D27486629263BB717C491B3123D32FA0F7282F76BD06EB9754
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detect suspicious telegram bot
Detect suspicious telegram bot.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
PE Signature issue
Digest
7d:a9:84:20:dc:cc:6c:44:a4:32:6c:00:43:38:90:ff:fb:e1:c8:ae:d3:b4:ab:66:9b:c1:c2:b3:d7:68:46:42
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=ArteCraft,O=ArteCraft,C=US
Chains
Nov 13, 2026
CN=ArteCraft,O=ArteCraft,C=US
Subject
CN=ArteCraft,O=ArteCraft,C=US
Serial Number
43:29:f9:4c:7e:42:5b:96:46:60:96:32:48:e2:9b:49
Issuer
CN=ArteCraft,O=ArteCraft,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Nov 7, 2026 - Nov 7, 2036
Minor OS version
1
Major OS version
6
Entry point
510560
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
WriteFile
WriteConsoleW
WerSetFlags
WerGetFlags
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
TlsAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
RtlVirtualUnwind
RtlLookupFunctionEntry
ResumeThread
RaiseFailFastException
PostQueuedCompletionStatus
LoadLibraryW
LoadLibraryExW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetErrorMode
GetEnvironmentStringsW
GetCurrentThreadId
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateEventA
CloseHandle
AddVectoredExceptionHandler
AddVectoredContinueHandler
Name
.text
Size
3.3MB
Virtual Size
3.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4.7MB
Virtual Size
4.7MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
498KB
Virtual Size
843KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
80KB
Virtual Size
79KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
512B
Virtual Size
180B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
69KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
272KB
Virtual Size
272KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ