Static task
static1
Behavioral task
behavioral1
Sample
IncomeTax_Receipt.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
IncomeTax_Receipt.exe
Resource
win10v2004-20230221-en
General
-
Target
2e85e8ca83b1a0ebef29e757b45ce483.bin
-
Size
579KB
-
MD5
2e85e8ca83b1a0ebef29e757b45ce483
-
SHA1
6e48cc6fb90bd60f21c2950427266d97d2d2b766
-
SHA256
53313420a4dd38857ccc5e6ac5e264b83b1b3ea285ad30d32aec5e9409d56f96
-
SHA512
a2a987b85ecc44824fc7b362ebe3a0f60d06797fa2d7f6d58217c801e8465b2f536e8606e5b739a18752723a68b94f82611c41e64673eeb74b35f4909c83078d
-
SSDEEP
12288:FW467ytKzkWRaFU8VCQs/slA4AA9jmz/uhAVyMS48CknLAHGP7:F/YCpIatCslNmz/U1MS48Ckncmj
Malware Config
Signatures
Files
-
2e85e8ca83b1a0ebef29e757b45ce483.bin.zip
Password: infected
-
IncomeTax_Receipt.exe.exe windows x86
Password: infected
3203ac73c4535d979af200fc5e459e21
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvbvm60
ord582
ord690
ord583
ord696
ord698
MethCallEngine
ord516
ord518
ord626
ord519
ord666
ord667
ord591
ord593
ord594
ord595
ord596
ord303
ord598
ord520
ord309
ord631
ord525
ord632
ord526
EVENT_SINK_AddRef
ord528
ord529
DllFunctionCall
ord563
ord670
ord564
EVENT_SINK_Release
ord600
ord601
EVENT_SINK_QueryInterface
__vbaExceptHandler
ord711
ord712
ord713
ord714
ord607
ord608
ord716
ord717
ProcCallEngine
ord644
ord537
ord645
ord570
ord648
ord573
ord681
ord576
ord685
ord100
ord689
ord616
ord617
ord618
ord619
ord581
Sections
.text Size: 500KB - Virtual size: 496KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 264KB - Virtual size: 263KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ