Abbb
DllGetClassObject
DllRegisterServer
PluginInit
Static task
static1
Behavioral task
behavioral1
Sample
IRS_Form_12-01-9/Scan.lnk
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
IRS_Form_12-01-9/Scan.lnk
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
IRS_Form_12-01-9/wiglid/foeZv.cmd
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
IRS_Form_12-01-9/wiglid/foeZv.cmd
Resource
win10v2004-20220812-en
Behavioral task
behavioral5
Sample
IRS_Form_12-01-9/wiglid/laborsaving.dll
Resource
win7-20220812-en
Behavioral task
behavioral6
Sample
IRS_Form_12-01-9/wiglid/laborsaving.dll
Resource
win10v2004-20221111-en
Target
IRS_Form_12-01-9.zip
Size
61KB
MD5
6ef51e05926f07aa3cca6eb1d35516c3
SHA1
84d1ff0610df09fe0904c884510b8cbad9d5651e
SHA256
738cc370a87bc239568ff5f047abea91bdef59d20df8f518dba7fe4e845cd3f5
SHA512
aa03ca261c6d528868116d4589243521fecfb0e1ed9a98256305c05956baf63eeab342c303399a5ae9c40eec8b7b4671b4e3663eb3193626d51257220093bcb6
SSDEEP
1536:taYNv6dTkUQZo5Yb0Jv2qTsJV3UJeHX6i0J/PfjyC:cYlEhQZo5Y4Jv2qTe5XgdfD
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
DeleteCriticalSection
EnterCriticalSection
FreeConsole
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetLastError
GetModuleHandleA
GetProcAddress
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
lstrlenA
__dllonexit
__iob_func
_amsg_exit
_initterm
_lock
_onexit
_unlock
_wtoi
abort
calloc
free
fwrite
malloc
memcpy
signal
strcmp
strlen
strncmp
vfprintf
CreateWindowExA
DefWindowProcA
DispatchMessageA
GetMessageA
LoadCursorA
LoadIconA
MessageBoxA
PostQuitMessage
RegisterClassExA
ShowWindow
TranslateMessage
CoLoadLibrary
SysAllocStringLen
SysFreeString
Abbb
DllGetClassObject
DllRegisterServer
PluginInit
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ