17062026_1632_Tax_Notice.exe.iso
- SHA256 2b9b4c92b74d7487dc30305a4c6b537614727795c98a4db24f3cb2704ee3147e
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Tax_Notice.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax_Notice.exe
Resource
win11-20260513-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral3
Sample
nvdaHelperRemote.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
nvdaHelperRemote.dll
Resource
win11-20260513-en
windows11-21h2-x64
0 signatures
150 seconds
General
- Target 17062026_1632_Tax_Notice.exe.iso
- Size 328KB
- Sample260617-t7bddsax9n
- SHA256 2b9b4c92b74d7487dc30305a4c6b537614727795c98a4db24f3cb2704ee3147e
- MD5 f2ffd44853d367d3b409e9a4f3cd44a7
- SHA1 379f3c340de55e56e3b0c4b7bd61f1e8f66e424a
- SHA512 6044cfb66a225ce2873387955949fed727d4fb565a383329feb9e172a3a61641c4bc00337c4751f7ead6a4b247c23a08003bed2efc5833d2fa6efdf4ed6896fe
- SSDEEP 6144:Mv8uowGbW4hhoOCjKMpgouuTQTR4nl3yAsd:qo/dIxpgoukoR4nhy
- TLSH T1E164CFAB77E524E9E6728274C4514A07A777B87207619FAF336C425A0F532C18F3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/nvdaHelperRemote.dll
File Explorer
-
17062026_1632_Tax_Notice.exe.iso.iso 328KB
-
out.iso.iso 328KB
-
Tax_Notice.exe.exe 118KB
-
nvdaHelperRemote.dll.dll 147KB
out.iso
- SHA256 2b9b4c92b74d7487dc30305a4c6b537614727795c98a4db24f3cb2704ee3147e
- MD5 f2ffd44853d367d3b409e9a4f3cd44a7
- SHA1 379f3c340de55e56e3b0c4b7bd61f1e8f66e424a
- SHA512 6044cfb66a225ce2873387955949fed727d4fb565a383329feb9e172a3a61641c4bc00337c4751f7ead6a4b247c23a08003bed2efc5833d2fa6efdf4ed6896fe
- SSDEEP 6144:Mv8uowGbW4hhoOCjKMpgouuTQTR4nl3yAsd:qo/dIxpgoukoR4nhy
- TLSH T1E164CFAB77E524E9E6728274C4514A07A777B87207619FAF336C425A0F532C18F3DB22
- MD5 SHA1 SHA512 SSDEEP TLSH
Tax_Notice.exe
- IMPHASH c440fed27cd89389c64033011969935a
- SHA256 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8
- MD5 1605971fa40b7f784311cecea47a251e
- SHA1 9fd5870678ae20ffe9cc8c26068e75935f27957d
- SHA512 39b5009020a2330d46a746ded44081c8ce0b08a608520ccdc3745f4b98020a537afd2872fed848c1d12321f3e90312297e436693db5017801726a14e115078de
- SSDEEP 3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj
- TLSH T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0a:40:4b:7f:87:cb:f9:1e:f1:2d:82:01:5a:b4:29:08:1f:99:f9:be:7c:0c:65:eb:40:25:b9:e6:1a:39:38:fc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NV Access Limited,O=NV Access Limited,L=Camp Mountain,ST=Queensland,C=AU
Chains
Nov 23, 2025
CN=NV Access Limited,O=NV Access Limited,L=Camp Mountain,ST=Queensland,C=AU
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2020 - Mar 18, 2045
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=NV Access Limited,O=NV Access Limited,L=Camp Mountain,ST=Queensland,C=AU
Serial Number
43:cf:89:89:22:c4:ef:98:53:54:ba:dc
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 7, 2024 - Jun 8, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
3
Major OS version
6
Entry point
4792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\nvda\nvda\build\x86_64\remoteLoader\nvdaHelperRemoteLoader.exe.pdb
nvdahelperremote
injection_initialize
injection_terminate
kernel32
FlsSetValue
WriteConsoleW
CreateFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
RtlUnwind
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapSize
HeapReAlloc
SetFilePointerEx
CloseHandle
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=40, id=261, version=35207,
count=2, id=257, version=33145,
count=3, id=257, version=35219,
count=94, id=1, productName=Unmarked objects,
count=1, id=265, version=35219,
count=1, id=255, version=35219,
count=1, id=258, version=35219,
nvdaHelperRemote.dll
- IMPHASH 409b96f74ac820aed0b8ab69562c2d9c
- SHA256 1dfe9be049f6bcad3caa8504dae4aad5e7e66d6e5ed8388478c7adb3de8d791a
- MD5 a7b3e94a5fcd20c960c42426b7c9a0c9
- SHA1 096b1f15b8884bc396a5daaef50a90b4c5bb4fcd
- SHA512 4c1c26923626259f5754b4c89f10f982c307e2ef5aa720f599bdfa53310d28f863503e8ea43ad7bc13e176f4d8ae881f2d8ecedcd8cda7505ff82df7b99143a6
- SSDEEP 3072:O/v8N/AXowG3B8OXFUlOW4jN9ZsWomRaPTPjbdtGM5sNgz:av8uowGbW4hhoOCjKM5
- TLSH T1E4E301FC7AFA0DA7CB31A331E8228E07666538279787ED7F1531562603534828B3476B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
8564
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
shell32
SHGetFolderPathW
ShellExecuteExW
advapi32
RegSetValueExW
RegQueryValueExW
OpenProcessToken
GetTokenInformation
RegOpenKeyExW
RegCreateKeyExW
RegCloseKey
user32
wsprintfW
SetProcessDPIAware
kernel32
RtlVirtualUnwind
GetProcAddress
RtlLookupFunctionEntry
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
GetEnvironmentVariableW
SetEnvironmentVariableW
CreateDirectoryW
DeleteFileW
GetDiskFreeSpaceExW
SetFileAttributesW
IsDebuggerPresent
CheckRemoteDebuggerPresent
CloseHandle
GetLastError
WaitForSingleObject
CreateMutexW
Sleep
GetCurrentProcess
ExitProcess
CreateThread
GetCurrentThread
CreateProcessW
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
VirtualAlloc
VirtualProtect
VirtualFree
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
RtlCaptureContext
LoadLibraryW
CopyFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
vcruntime140
memset
__C_specific_handler
__std_type_info_destroy_list
memcpy
api-ms-win-crt-string-l1-1-0
_wcsicmp
wcslen
api-ms-win-crt-runtime-l1-1-0
_initterm
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_initterm_e
_execute_onexit_table
_cexit
eglBindTexImage
eglClientWaitSyncKHR
eglCopyBuffers
eglCopyMetalSharedEventANGLE
eglCreateContext
eglCreateDeviceANGLE
eglCreateImage
eglCreateImageKHR
eglCreateNativeClientBufferANDROID
eglCreatePbufferFromClientBuffer
eglCreatePbufferSurface
eglCreatePixmapSurface
eglCreatePlatformPixmapSurface
eglCreatePlatformPixmapSurfaceEXT
eglCreatePlatformWindowSurface
eglCreatePlatformWindowSurfaceEXT
eglCreateStreamKHR
eglCreateStreamProducerD3DTextureANGLE
eglCreateSync
eglCreateSyncKHR
eglCreateWindowSurface
eglDebugMessageControlKHR
eglDestroyContext
eglDestroyImage
eglDestroyImageKHR
eglDestroyStreamKHR
eglDestroySurface
eglDestroySync
eglDestroySyncKHR
eglDupNativeFenceFDANDROID
eglExportVkImageANGLE
eglForceGPUSwitchANGLE
eglGetCompositorTimingANDROID
eglGetCompositorTimingSupportedANDROID
eglGetConfigAttrib
eglGetConfigs
eglGetCurrentContext
eglGetCurrentDisplay
eglGetCurrentSurface
eglGetDisplay
eglGetError
eglGetFrameTimestampSupportedANDROID
eglGetFrameTimestampsANDROID
eglGetMscRateANGLE
eglGetNativeClientBufferANDROID
eglGetNextFrameIdANDROID
eglGetPlatformDisplay
eglGetPlatformDisplayEXT
eglGetProcAddress
eglGetSyncAttrib
eglGetSyncAttribKHR
eglGetSyncValuesCHROMIUM
eglHandleGPUSwitchANGLE
eglInitialize
eglLabelObjectKHR
eglLockSurfaceKHR
eglLockVulkanQueueANGLE
eglMakeCurrent
eglPostSubBufferNV
eglPrepareSwapBuffersANGLE
eglPresentationTimeANDROID
eglProgramCacheGetAttribANGLE
eglProgramCachePopulateANGLE
eglProgramCacheQueryANGLE
eglProgramCacheResizeANGLE
eglQueryAPI
eglQueryContext
eglQueryDebugKHR
eglQueryDeviceAttribEXT
eglQueryDeviceStringEXT
eglQueryDisplayAttribANGLE
eglQueryDisplayAttribEXT
eglQueryDmaBufFormatsEXT
eglQueryDmaBufModifiersEXT
eglQueryStreamKHR
eglQueryStreamu64KHR
eglQueryString
eglQueryStringiANGLE
eglQuerySupportedCompressionRatesEXT
eglQuerySurface
eglQuerySurface64KHR
eglQuerySurfacePointerANGLE
eglReacquireHighPowerGPUANGLE
eglReleaseDeviceANGLE
eglReleaseExternalContextANGLE
eglReleaseHighPowerGPUANGLE
eglReleaseTexImage
eglReleaseThread
eglSetBlobCacheFuncsANDROID
eglSetDamageRegionKHR
eglSetValidationEnabledANGLE
eglSignalSyncKHR
eglStreamAttribKHR
eglStreamConsumerAcquireKHR
eglStreamConsumerGLTextureExternalAttribsNV
eglStreamConsumerGLTextureExternalKHR
eglStreamConsumerReleaseKHR
eglStreamPostD3DTextureANGLE
eglSurfaceAttrib
eglSwapBuffers
eglSwapBuffersWithDamageKHR
eglSwapInterval
eglTerminate
eglUnlockSurfaceKHR
eglUnlockVulkanQueueANGLE
eglWaitClient
eglWaitGL
eglWaitNative
eglWaitSync
eglWaitSyncKHR
eglWaitUntilWorkScheduledANGLE
injection_initialize
injection_terminate
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
112KB
Virtual Size
112KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
600B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ