General

  • Target

    17986577194.zip

  • Size

    116.7MB

  • MD5

    60b1e4fafad3f3471d65fdbc100fc67f

  • SHA1

    a0b43dc499f2de79bc6dc9f585b1fd712117b6dc

  • SHA256

    fd1d8fe0bf1ff9aa729da9502e7cace23548fee1bf4148452f5cdc638db3e887

  • SHA512

    3b80edffcfb63c2a8b9cfd2fb08badecec1d09888abc3d946f456e071153e1b79c39db98a395096ce9bd3f51d04f424917c570cfe67c76e948f68edb4d252603

  • SSDEEP

    3145728:XentX0H+3bzJiyUm1gqZCRDdHfU/4W+p7h3yskrqk:utX0H+3/J9RvZSDdHfU//+pYR

Score
6/10

Malware Config

Signatures

  • Malformed or missing cross-reference table in PDF

    Malformed or missing cross-reference tables are often used to evade detection

  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 17986577194.zip
    .zip

    Password: infected

  • e97b2617bf8dcd56f6121d26fcd62c5fd39cceb6f19f9f527c8031592378ff21
    .zip

    Password: infected

  • 1099Misc.inf
    .pdf
  • Tax Organizer.exe
    .exe windows:5 windows x86 arch:x86

    Password: infected

    e456fbce099e309bfeaff191fcf3b1ee


    Code Sign

    Headers

    Imports

    Sections

  • msimg32.dll
    .dll regsvr32 windows:6 windows x86 arch:x86

    Password: infected

    d65a597bca43126f1d29bb29799bec5e


    Headers

    Imports

    Exports

    Sections