0e2b786e35b68f9511ebbf7bcd8880fa578eb785f4140a1db2aa623bf0efeffd

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date 2026-Sep-17 04:32:31
Detected languages English - United States
Debug artifacts C:\Telegram\tx64\out\Release\Updater.pdb

Plugin Output

Suspicious Strings found in the binary may indicate undesirable behavior: Miscellaneous malware strings:
  • virus
 Contains domain names:
  • desktop.telegram.org
  • https://desktop.telegram.org
  • telegram.org
Info The PE contains common functions which appear in legitimate applications. [!] The program may be hiding some of its imports:
  • LoadLibraryW
  • GetProcAddress
  • LoadLibraryExA
  • LoadLibraryExW
Info The PE is digitally signed. Signer: Telegram FZ-LLC
Issuer: GlobalSign GCC R45 EV CodeSigning CA 2020
Safe VirusTotal score: 0/70 (Scanned on 2026-09-18 05:49:35) All the AVs think this file is safe.

Hashes

MD5 00ed72f1d8e42adb6c57ee7515baa7f6 🔍
SHA1 522dd03bff39e72158c3c1b6caed68345fac7e18 🔍
SHA256 0e2b786e35b68f9511ebbf7bcd8880fa578eb785f4140a1db2aa623bf0efeffd 🔍
SHA3 b4cb30973568afbad59f126565c0e63f2fe18a7fab56b53c33ba1b3192c382da 🔍
SSDeep 3072:Z4UQ/AWf3KDMXrud0ZVzsqN5HobCEsUTbT7vv8r3OQdAfdTx95WD:Z0/AWf6DMXKWZpfIbUe6AfdH5WD 🔍
Imports Hash 72d1e539a00f3a242901b924428d5ac5 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0x108

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 7
TimeDateStamp 2026-Sep-17 04:32:31
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x18600
SizeOfInitializedData 0x13800
SizeOfUninitializedData 0
AddressOfEntryPoint 0x0000000000009C34 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x31000
SizeOfHeaders 0x400
Checksum 0x3d813
Subsystem IMAGE_SUBSYSTEM_WINDOWS_GUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x100000
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 78863735aceccbf46f3e30b7762a11a7 🔍
SHA1 0d7d5114f0724e3eb81fbda517ac2e16eef0e341 🔍
SHA256 8bd2bd28f3b223407b93b17e24c70e31cefc6b252ca636914cb4813b904ba8de 🔍
SHA3 64eecad0c8e2981789d35bfd7a1e90238e2370b65c2b0c4073defdef8dbf2d4b 🔍
VirtualSize 0x1849b
VirtualAddress 0x1000
SizeOfRawData 0x18600
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 6.38755

.rdata

MD5 b08481debc3683e23526e553fa065935 🔍
SHA1 4c5aa8707d95ed3dc1b83e3e8dee334a5dabf8c9 🔍
SHA256 0c93c669cf3a0263cba96812c7e8bd7855cdbd73104d9249fbd5edf48f852008 🔍
SHA3 1902f8058d9079b69b93a4db6ba110f5ee82527cab2669c9cacbbd7ee0abab54 🔍
VirtualSize 0xf36c
VirtualAddress 0x1a000
SizeOfRawData 0xf400
PointerToRawData 0x18a00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.95512

.data

MD5 3d18aabb96e612dadd6896e4b180f7bf 🔍
SHA1 227689eba501cc9a58609bb8b937e02f0f91ee12 🔍
SHA256 74d5cd71285effc6d4327fb1b9bcd01a820c61cb751f68d05082ac02f875223f 🔍
SHA3 911b0055a22967353d203066d2fb64a3e54e1e2c45263b32a6b31d3d79f9dc1e 🔍
VirtualSize 0x1f74
VirtualAddress 0x2a000
SizeOfRawData 0xe00
PointerToRawData 0x27e00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 2.13683

.pdata

MD5 d020bc70b3d7389f4c983a0e758dfad8 🔍
SHA1 dc9970e1fe7fe6319ab033a3e8fc589eb466832f 🔍
SHA256 f77b4d23b6a087f9038aff92214870b23cf29c7e254e84cf2298fed185cf0df9 🔍
SHA3 c0664f4896825a7ced159d3cf7c4dc20d300fee02afd2454bb8d233138884e74 🔍
VirtualSize 0x1668
VirtualAddress 0x2c000
SizeOfRawData 0x1800
PointerToRawData 0x28c00
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.98537

.fptable

MD5 bf619eac0cdf3f68d496ea9344137e8b 🔍
SHA1 5c3eb80066420002bc3dcc7ca4ab6efad7ed4ae5 🔍
SHA256 076a27c79e5ace2a3d47f9dd2e83e4ff6ea8872b3c2218f66c92b89b55f36560 🔍
SHA3 622de1e1568ddef36c4b89b706b05201c13481c3575d0fc804ff8224787fcb59 🔍
VirtualSize 0x100
VirtualAddress 0x2e000
SizeOfRawData 0x200
PointerToRawData 0x2a400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0

.rsrc

MD5 05a4addfcc8a586605b9578111a684e2 🔍
SHA1 cdfe557abb6f7345372d268604ad7315737417a2 🔍
SHA256 92c9ef157461f3ae09b3f8b84e37a5dd7337efbb74c3a0b36295b053b76d7d54 🔍
SHA3 6f770306483c05ab70bfb97b9c4b92ce7e74094ba809b52565b234cd09b4909b 🔍
VirtualSize 0x1e0
VirtualAddress 0x2f000
SizeOfRawData 0x200
PointerToRawData 0x2a600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.71768

.reloc

MD5 0257ec6ae27b10abc8ee83bbddda0910 🔍
SHA1 69b724585c4cbc56c0fc9c8c7fb556d2aa5f6ff1 🔍
SHA256 1239c364670a501fc822c8f9820d4a0478f52cd725592a6d26ba789334e4d4b2 🔍
SHA3 63b9bcb92648a3c00c67122123ad57b91c47b679047c419d971597615c692040 🔍
VirtualSize 0x6d4
VirtualAddress 0x30000
SizeOfRawData 0x800
PointerToRawData 0x2a800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 5.05134

Imports

KERNEL32.dll CreateDirectoryW
ReadFile
FindFirstFileExW
GetCommandLineW
GetFullPathNameW
FindNextFileW
GetCurrentProcess
WriteFile
ExpandEnvironmentStringsW
RemoveDirectoryW
GetModuleFileNameW
GetEnvironmentVariableW
FindClose
CreateFileW
GetCurrentThreadId
Sleep
FormatMessageW
GetLastError
DeleteFileW
CloseHandle
LoadLibraryW
GetLocalTime
GetProcAddress
LocalFree
GetCurrentProcessId
GetModuleHandleW
CopyFileW
SetUnhandledExceptionFilter
FlushFileBuffers
FindFirstFileW
LoadLibraryExA
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
RaiseException
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
HeapAlloc
HeapFree
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetProcessHeap
GetFileType
SetStdHandle
GetStringTypeW
HeapSize
HeapReAlloc
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx
WriteConsoleW
GetSystemInfo
VirtualQuery
USER32.dll (delay-loaded) wsprintfW
MessageBoxW

Delayed Imports

Attributes 0x1
Name USER32.dll
ModuleHandle 0x2ace0
DelayImportAddressTable 0x2aca8
DelayImportNameTable 0x286a8
BoundDelayImportTable 0x287c8
UnloadDelayImportTable 0
TimeStamp 1970-Jan-01 00:00:00

1

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x17d
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.91161
MD5 1e4a89b11eae0fcf8bb5fdd5ec3b6f61 🔍
SHA1 4260284ce14278c397aaf6f389c1609b0ab0ce51 🔍
SHA256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df 🔍
SHA3 4bb9e8b5a714cae82782f3831cc2d45f4bf4a50a755fe584d2d1893129d68353 🔍

Version Info

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Sep-17 04:32:31
Version 0.0
SizeofData 65
AddressOfRawData 0x26480
PointerToRawData 0x24e80
Referenced File C:\Telegram\tx64\out\Release\Updater.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Sep-17 04:32:31
Version 0.0
SizeofData 20
AddressOfRawData 0x264c4
PointerToRawData 0x24ec4

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Sep-17 04:32:31
Version 0.0
SizeofData 1132
AddressOfRawData 0x264d8
PointerToRawData 0x24ed8

TLS Callbacks

StartAddressOfRawData 0x140026990
EndAddressOfRawData 0x140026998
AddressOfIndex 0x14002b2e4
AddressOfCallbacks 0x14001a3c0
SizeOfZeroFill 0
Characteristics IMAGE_SCN_ALIGN_4BYTES
Callbacks (EMPTY)

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0x800
EditList 0
SecurityCookie 0x14002a040

RICH Header

XOR Key 0x2b5ce72
Unmarked objects 0
C++ objects (33145) 142
ASM objects (33145) 8
ASM objects (35207) 10
C objects (35207) 16
C objects (33145) 14
C objects (CVTCIL) (33145) 1
Imports (33145) 3
Total imports 125
C++ objects (35207) 51
C++ objects (LTCG) (35228) 2
Resource objects (35228) 1
Linker (35228) 1

Errors

Leave a comment

No comments yet.