taxep[.]dll | Triage™

General

Target
taxep.dll
Size 1.6MB
Sample220603-mpdbpsaceq
SHA256 538d9548d4b197611a07d436feb27beff04e6cd53fba88b1cfdee626eff89db2
MD5 96311317eb4a91f0919637a0ff9d8798
SHA1 6ab7f83e5823b0610d9febc184e55ade564bd9ce
SHA512 71108c7417dcdde59ed89d8cc39d9f4ebc73d9ecc30c81b154ad6b516d1cf5ab8e754a03e0fc56f78577879f6bcfc159e977c030a0584f0bcaf6bf5a1ee5814b
SSDEEP 24576:9W9vu3nsrG115A02jrgdBQR9iCz4I5GmKA8chQv0VH5V:sVYnsO2kQmvIT8WQ8VZV
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

taxep.dll

.dll 1.6MB

taxep.dll

IMPHASH 8f19232df0e53b49535c9ed7cc5e9bfa
SHA256 538d9548d4b197611a07d436feb27beff04e6cd53fba88b1cfdee626eff89db2
MD5 96311317eb4a91f0919637a0ff9d8798
SHA1 6ab7f83e5823b0610d9febc184e55ade564bd9ce
SHA512 71108c7417dcdde59ed89d8cc39d9f4ebc73d9ecc30c81b154ad6b516d1cf5ab8e754a03e0fc56f78577879f6bcfc159e977c030a0584f0bcaf6bf5a1ee5814b
SSDEEP 24576:9W9vu3nsrG115A02jrgdBQR9iCz4I5GmKA8chQv0VH5V:sVYnsO2kQmvIT8WQ8VZV
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

40492

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileA FindFirstFileA FindNextFileA GetFileInformationByHandle GetFileType LockFile CloseHandle GetLastError HeapCreate HeapAlloc GetProcessHeap ExitProcess GetCurrentThreadId GetWindowsDirectoryA GetModuleFileNameA GetModuleHandleA SwitchToFiber DeleteFiber CreateFiber WaitForMultipleObjects CreateActCtxA ActivateActCtx QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle GetModuleHandleExW WriteConsoleW GetCurrentProcess TerminateProcess MultiByteToWideChar WideCharToMultiByte HeapFree WriteFile LCMapStringW FindClose FindFirstFileExA IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize HeapReAlloc SetStdHandle SetFilePointerEx CreateFileW RaiseException

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

733KB

Virtual Size

732KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

836KB

Virtual Size

840KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

taxep.dll

kernel32