45285294c3fa37de103e857b348644034b43cebdd5aa52fb281bb25aeb5c82b2

Sharing

Copy URL Twitter E-mail

General

Target

45285294c3fa37de103e857b348644034b43cebdd5aa52fb281bb25aeb5c82b2
Size

560KB
MD5

bfabc9d8636575db371ef24b2cd46c12
SHA1

a18bf2e321ea61c840ccb3cc138d96f228109ef7
SHA256

45285294c3fa37de103e857b348644034b43cebdd5aa52fb281bb25aeb5c82b2
SHA512

137b73430812136c5b72c28b9406d274cd37b35f0440965096c240ea2f93eae2729c578fc687a63fca8cb1c3d91f0f1e1701ee8b8d95566c22bdf8445265b441
SSDEEP

12288:XNC+39omXYffaIq4QUn2KmVEPXQzLteRZcRBmKvWzMYSyi2jdwg2jfpXyx:9nXoCIhPHZAvIRZKxvshyhyx

Score

1^/10

Malware Config

Signatures

Files

45285294c3fa37de103e857b348644034b43cebdd5aa52fb281bb25aeb5c82b2
.zip
Tax.Catch.Factory.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

19/04/2021, 09:20

Not After

18/04/2024, 09:20

Subject

CN=南京擎天全税通信息科技有限公司,O=南京擎天全税通信息科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

ce:02:b9:46:39:fb:8b:20:fc:e0:2b:89:25:43:aa:a4:53:ef:55:ff:a4:fe:89:e3:ec:db:ae:a0:14:b8:d2:b3
Signer

Actual PE Digest

ce:02:b9:46:39:fb:8b:20:fc:e0:2b:89:25:43:aa:a4:53:ef:55:ff:a4:fe:89:e3:ec:db:ae:a0:14:b8:d2:b3

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 334KB - Virtual size: 334KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Tax.Catch.Mapping.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

19/04/2021, 09:20

Not After

18/04/2024, 09:20

Subject

CN=南京擎天全税通信息科技有限公司,O=南京擎天全税通信息科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

46:03:c9:d6:0f:65:c4:42:78:c8:c3:2b:f7:ea:46:07:cb:1f:73:75:43:4b:41:0f:21:48:40:11:99:a7:a7:df
Signer

Actual PE Digest

46:03:c9:d6:0f:65:c4:42:78:c8:c3:2b:f7:ea:46:07:cb:1f:73:75:43:4b:41:0f:21:48:40:11:99:a7:a7:df

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 932B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Tax.Catch.Model.dll
.dll windows:4 windows x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

Issuer

CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Not Before

17/04/2018, 08:20

Not After

18/05/2027, 08:20

Subject

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

Issuer

CN=WoTrus Code Signing CA,O=WoTrus CA Limited,C=CN

Not Before

19/04/2021, 09:20

Not After

18/04/2024, 09:20

Subject

CN=南京擎天全税通信息科技有限公司,O=南京擎天全税通信息科技有限公司,L=南京市,ST=江苏省,C=CN

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

4c:46:a0:eb:36:fb:92:60:08:f4:e7:f3:cd:a3:ac:2f:68:c7:3c:02:18:33:20:01:0d:69:de:ea:3b:07:c6:2a
Signer

Actual PE Digest

4c:46:a0:eb:36:fb:92:60:08:f4:e7:f3:cd:a3:ac:2f:68:c7:3c:02:18:33:20:01:0d:69:de:ea:3b:07:c6:2a

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Sections

.text
Size: 323KB - Virtual size: 322KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 924B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ceCertificate

Extended Key Usages

Key Usages

ce:02:b9:46:39:fb:8b:20:fc:e0:2b:89:25:43:aa:a4:53:ef:55:ff:a4:fe:89:e3:ec:db:ae:a0:14:b8:d2:b3Signer

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 334KB - Virtual size: 334KB

.sdata Size: 512B - Virtual size: 488B

.rsrc Size: 1024B - Virtual size: 932B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ceCertificate

Extended Key Usages

Key Usages

46:03:c9:d6:0f:65:c4:42:78:c8:c3:2b:f7:ea:46:07:cb:1f:73:75:43:4b:41:0f:21:48:40:11:99:a7:a7:dfSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 117KB - Virtual size: 116KB

.sdata Size: 512B - Virtual size: 488B

.rsrc Size: 1024B - Virtual size: 932B

.reloc Size: 512B - Virtual size: 12B

dae02f32a21e03ce65412f6e56942daa

Code Sign

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:afCertificate

Extended Key Usages

Key Usages

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ceCertificate

Extended Key Usages

Key Usages

4c:46:a0:eb:36:fb:92:60:08:f4:e7:f3:cd:a3:ac:2f:68:c7:3c:02:18:33:20:01:0d:69:de:ea:3b:07:c6:2aSigner

Headers

DLL Characteristics

File Characteristics

Imports

mscoree

Sections

.text Size: 323KB - Virtual size: 322KB

.sdata Size: 512B - Virtual size: 488B

.rsrc Size: 1024B - Virtual size: 924B

.reloc Size: 512B - Virtual size: 12B

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

ce:02:b9:46:39:fb:8b:20:fc:e0:2b:89:25:43:aa:a4:53:ef:55:ff:a4:fe:89:e3:ec:db:ae:a0:14:b8:d2:b3
Signer

.text
Size: 334KB - Virtual size: 334KB

.sdata
Size: 512B - Virtual size: 488B

.rsrc
Size: 1024B - Virtual size: 932B

.reloc
Size: 512B - Virtual size: 12B

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

46:03:c9:d6:0f:65:c4:42:78:c8:c3:2b:f7:ea:46:07:cb:1f:73:75:43:4b:41:0f:21:48:40:11:99:a7:a7:df
Signer

.text
Size: 117KB - Virtual size: 116KB

.sdata
Size: 512B - Virtual size: 488B

.rsrc
Size: 1024B - Virtual size: 932B

.reloc
Size: 512B - Virtual size: 12B

6e:a1:d4:94:5f:0e:69:e9:d6:f1:48:2c:58:6a:71:af
Certificate

76:4e:bf:52:5e:08:5f:a2:31:c9:b2:7c:13:6c:4c:ce
Certificate

4c:46:a0:eb:36:fb:92:60:08:f4:e7:f3:cd:a3:ac:2f:68:c7:3c:02:18:33:20:01:0d:69:de:ea:3b:07:c6:2a
Signer

.text
Size: 323KB - Virtual size: 322KB

.sdata
Size: 512B - Virtual size: 488B

.rsrc
Size: 1024B - Virtual size: 924B

.reloc
Size: 512B - Virtual size: 12B