General

  • Target

    17141169184.zip

  • Size

    113.8MB

  • MD5

    c9e3ef49337ec7b918cfe0513b11ac4e

  • SHA1

    4460de63f7b3eada72e3381fce1a322dd5ec327e

  • SHA256

    5d52b26cb1a3b7470a9e2c84ae228f4d5502efd3e88bb1e1ce6a79b88470a26e

  • SHA512

    1a2e7824ac9e7db78334b3c5325f3836f203cefac060926c497dc17e4586e3b5a34ae66f2ed49fa79f7de4982b357fb6dc5a62c48c5c4ce110d993444d75d4e1

  • SSDEEP

    1572864:qgil7aO8NDnY+eAyW7PQfIUME2vCICvGVwDJr4gNzCccH6GuPh1IAyb1D5kREyNu:y8NDMAN7PQfIA2vC44Jr4Pa7p+bVWu

Malware Config

Signatures

  • Privateloader family
  • Malformed or missing cross-reference table in PDF

    Malformed or missing cross-reference tables are often used to evade detection

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 17141169184.zip
    .zip

    Password: infected

  • 381e36da71dfda8c0df43888996196cb69d273029bc04ca7549018a3c16714f1
    .zip
  • 1099Misc.inf
    .pdf
  • TAX Organizer.exe
    .exe windows:6 windows x86 arch:x86

    5419c6d0b7a37c6f48c0d961a0d909db


    Code Sign

    Headers

    Imports

    Sections

  • g2m.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    0d4e155ed7c21a6b1640ba64f6bb0aaa


    Headers

    Imports

    Exports

    Sections