Tax_Documents_PDF.zip
- SHA256 a3157ccfa27fd3ae9f4161678fd7d8da518fa968736a1306b95b41c1ad832b88
Password
123
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Tax_Document/Tax_document.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax_Document/Tax_document.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
Tax_Document/g2m.dll
Resource
win7-20240508-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
Tax_Document/g2m.dll
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target Tax_Documents_PDF.zip
- Size 685KB
- Sample240510-ymrbbshf42
- SHA256 a3157ccfa27fd3ae9f4161678fd7d8da518fa968736a1306b95b41c1ad832b88
- MD5 58a893fe1b399dbc726711b6de14b342
- SHA1 f8f0a1a01644907172a0303dda34ffa151843f6f
- SHA512 e1e023a71ca092e375f2e07f1bd18d6aab3a9b37440b1c8e8063da91fd36fff792e619dc6af1dd50e935b7a089319da88b5e9b10df0b9ac2572ce186d1688713
- SSDEEP 12288:Z9je7rUta/zwsMKOkD7HydKeE5JwhzjKw/g+jLlrIglrMZkFPOHGVcuu5Ag4KbQF:zUkE7H7eGV+gQlzhlsGOuDKbQYQHoQ
- MD5 SHA1 SHA512 SSDEEP
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/Tax_Document/g2m.dll
File Explorer
-
Tax_Documents_PDF.zip.zip 685KB
-
Tax_Document/Tax_document.exe.exe 39KB
-
Tax_Document/data.bin471KB
-
Tax_Document/g2m.dll.dll 603KB
Tax_Document/Tax_document.exe
- IMPHASH 6eb9cccf95968b8becec4c870f1101db
- SHA256 796ea1d27ed5825e300c3c9505a87b2445886623235f3e41258de90ba1604cd5
- MD5 f1b14f71252de9ac763dbfbfbfc8c2dc
- SHA1 dcc2dcb26c1649887f1d5ae557a000b5fe34bb98
- SHA512 636a32fb8a88a542783aa57fe047b6bca47b2bd23b41b3902671c4e9036c6dbb97576be27fd2395a988653e6b63714277873e077519b4a06cdc5f63d3c4224e0
- SSDEEP 768:YRQnUhG5bZDOTpkdD82YbQkRFokFWIILPUh:FWObZDOTpk5T6zqAh
- MD5 SHA1 SHA512 SSDEEP
Password
123
PE Signature issue
Digest
a9:67:63:96:99:c5:5b:7e:88:69:58:46:cb:9b:f7:d1:bb:bf:20:aa
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Chains
Nov 14, 2012
Subject
CN=Symantec Time Stamping Services Signer - G3,O=Symantec Corporation,C=US
Serial Number
79:a2:a5:85:f9:d1:15:42:13:d9:b8:3e:f6:b6:8d:ed
Issuer
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
May 1, 2012 - Dec 31, 2012
Subject
CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US
Serial Number
47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4
Issuer
CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Dec 4, 2003 - Dec 3, 2013
Subject
CN=Citrix Online,OU=Operations+OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Citrix Online,L=Fort Lauderdale,ST=Florida,C=US
Serial Number
5c:5f:2b:a5:c9:99:4b:e5:ef:25:4f:fe:51:12:88:e1
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 30, 2012 - May 1, 2014
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
5
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\p4builds\Products\GoToMeeting\v5.4_builds\output\G2M_Exe.pdb
g2m
g2mcomm_winmain
kernel32
GetModuleHandleW
GetCommandLineW
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetStartupInfoW
ExitProcess
user32
MessageBoxA
Name
.text
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=7, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=1, productName=Unmarked objects,
count=1, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Tax_Document/data.bin
- SHA256 f51dcb2f267b1c5f5e6f94447c03d78321f1cbc0a031f514ba39026d2121244b
- MD5 0c85e7a1421f5a1858c024367b1051ba
- SHA1 3d1fac4bbbeb503f07c62b7309095bce4708e83d
- SHA512 f0d76b4ad794948994d3523847d3688f974b29da3860e18be3b74cac5272021bdf9481fcd5b4817a8c98bcbd5148e0f2515f167f959dc2e6a8019e77d4775cd7
- SSDEEP 12288:VcjjCq5ifb3PuIxDJc4Yy6geq2NCRQGNBi5t:Vcyq5ifb3W2JTppQGo
- MD5 SHA1 SHA512 SSDEEP
Tax_Document/g2m.dll
- IMPHASH b4794b2ac17b0bcd96013e45977c1f71
- SHA256 ec500d3d904773c6bde2729be40fe8773a9c92f70c5b218551223377072a54e7
- MD5 b856542b973c583e6f4809961d5050d9
- SHA1 89f05af444076c022c21ce62499ac5e34a414e9d
- SHA512 15bf94d70a4a752328c8836a7c969034ba91e940937b9c9294578897338609984d5a9cdc8deaeceb841f69ba270c536e0fc093b645a87f2a83ef79e802620388
- SSDEEP 12288:swyPp3TItEKRC3YtYq0H+J6nEYpaM7Fd5ktc2/ZLvJ6AsupuDc:swggE2C3YtYq0eJgEYpaMnF2LvJ9pK
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Password
123
Minor OS version
0
Major OS version
6
Entry point
330755
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
your_package_name.pdb
kernel32
TlsGetValue
TlsSetValue
VirtualQuery
VirtualFree
VirtualProtect
GetNativeSystemInfo
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapSize
GetModuleHandleA
FreeEnvironmentStringsW
GetLastError
SetThreadStackGuarantee
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
Sleep
QueryPerformanceCounter
VirtualAlloc
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
ReleaseMutex
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetStringTypeW
GetCommandLineW
FlushFileBuffers
SetFileInformationByHandle
SetFilePointerEx
SetStdHandle
GetConsoleOutputCP
WriteFile
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetStdHandle
GetCurrentProcessId
SetHandleInformation
CloseHandle
TerminateProcess
GetProcAddress
HeapFree
LCMapStringW
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
lstrlenW
CreateMutexA
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
ReadFile
GetModuleHandleExW
GetConsoleMode
GetFileType
LoadLibraryExW
FreeLibrary
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
GetFullPathNameW
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
EncodePointer
InterlockedFlushSList
RaiseException
RtlUnwind
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
DecodePointer
ws2_32
listen
WSAStartup
getaddrinfo
WSASocketW
WSAGetLastError
closesocket
freeaddrinfo
bind
WSACleanup
api-ms-win-core-synch-l1-2-0
WaitOnAddress
WakeByAddressAll
WakeByAddressSingle
ntdll
RtlNtStatusToDosError
NtReadFile
NtWriteFile
DllMain
g2mchat_winmain
g2mcomm_winmain
g2mfeedback_winmain
g2mhost_winmain
g2minstaller_winmain
g2minsthigh_winmain
g2mlauncher_winmain
g2mmatchmaking_winmain
g2mmaterials_winmain
g2mpolling_winmain
g2mqanda_winmain
g2mrecorder_winmain
g2msessioncontrol_winmain
g2mstart_winmain
g2mtesting_winmain
g2mtranscoder_winmain
g2mui_winmain
g2muninstall_winmain
g2mvideoconference_winmain
g2mview_winmain
Name
.text
Size
403KB
Virtual Size
403KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
89KB
Virtual Size
89KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
91KB
Virtual Size
93KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=139, id=261, version=30795,
count=20, id=260, version=30795,
count=31, id=261, version=33218,
count=16, id=260, version=33218,
count=20, id=259, version=33218,
count=4, id=257, version=30795,
count=187, id=1, productName=Unmarked objects,
count=3, id=260, version=33523,
count=84, productName=Unmarked objects (old),
count=1, id=256, version=33523,
count=1, id=258, version=33523,