25333491325.zip
- SHA256 b28c86f908176c2f06a616243dfc12524cd219dd0898c1ea3be758ef2592de3c
Password
infected
Static task
static1
3 signatures
Behavioral task
behavioral1
Sample
Tax_Assessment.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax_Assessment.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
libsvcs.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
libsvcs.dll
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
14 signatures
150 seconds
General
- Target 25333491325.zip
- Size 125KB
- Sample260702-pg7lpah15s
- SHA256 b28c86f908176c2f06a616243dfc12524cd219dd0898c1ea3be758ef2592de3c
- MD5 0f2a367dc645e5e09b335f126c1dbc61
- SHA1 ceff80f095e85b07fedcd3fbc314b29415f297bc
- SHA512 3b84fc2f281599f1fb5a96d7ca0be9a0c0ecfb594df18c0bced088def8b819bcf7f417e03c9b97f2bf44765f262040c3933d40903f53ffdb6525a5f02ac9c87f
- SSDEEP 3072:1Se48FIyYQLqVjefBqVro+nu8G8lJtxY1TNRJB:1STMIyYQ4afB8m0t61T7T
- TLSH T173C312A9B352A5B2D0C49FA0E2056A3D151EF7933340B4BCD60AC211DEECB1900FFAE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack003/Tax_Assessment.exe - ConfuserEx .NET packer 2 IoCs
Detects ConfuserEx .NET packer.
resource yara_rule static1/unpack003/Tax_Assessment.exe ConfuserEx static1/unpack003/libsvcs.dll ConfuserEx - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack003/libsvcs.dll
File Explorer
-
25333491325.zip.zip 125KB
-
372d7d8ca222e03afa5970848cf88efa6a3bc5146d20398601285fc7eaea6735.zip 125KB
-
Tax_Assessment.img.iso 366KB
-
Tax_Assessment.exe.exe 95KB
-
libsvcs.dll.dll 208KB
372d7d8ca222e03afa5970848cf88efa6a3bc5146d20398601285fc7eaea6735
- SHA256 372d7d8ca222e03afa5970848cf88efa6a3bc5146d20398601285fc7eaea6735
- MD5 3adcf5fca3f4fe23a9b73951e20d43bc
- SHA1 8c13699a85f1ffc2f26645fb7730d5a4e7f4fbb4
- SHA512 b183bab130e88960615db2ced213b9bb4b474262f81e1168540e6ba13a21251ef9528e486c785939462abb4a72e10e1c5223b989408fc652d2756e98a94d2028
- SSDEEP 3072:wYGEOChDyzt0ziC494DTVhAUozzZUnB1Rugv4zSo4NdorG:prheZ+iCTTnAUozz2B1RTQzS1N+G
- TLSH T1DEC3123BE5E899D4322AECA5371D926E5B2DC570E733C035DF590485BA821E0F1686AC
- MD5 SHA1 SHA512 SSDEEP TLSH
Tax_Assessment.img
- SHA256 f5dc1016679f54f2be22da0ff6642046f7a943410c188514b96c28d8a3b95e12
- MD5 ba036fbf209b2dbdfec3fd3dee9b1798
- SHA1 14f737a9157f19851d439835a6a954175e0082c5
- SHA512 5b4131cce932d61dae61e0d93b2196b394111d8aa2ad72e03455d8b61cd32d962e09ee2ce751e02007e4fabcd088240a9ea176619c1baefe0d76b6adb1f0ae8b
- SSDEEP 6144:sKM8MHDtPmPvJd03Ef/RRG0bh06xjKxA38S7DibCdYe6yCQhy:sQMHDtPmpd00Rd06xjKxA38S7DibCdY1
- TLSH T11284889C761071DFC857CB768AA81C64EA506C6A531B8203EC7B35A9DA3D5B7CF1C0B2
- MD5 SHA1 SHA512 SSDEEP TLSH
Tax_Assessment.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 4b5405d9acd00dd9225ffcec840a1752951be801d20ee1cab4ebde9ccd96916a
- MD5 ac08e8f463e0fa4a431b74fd5d7f01a1
- SHA1 721dae8c5e4d71e1f83f6b9e64dcb1b111e6889b
- SHA512 9764826b3f6c6d33a0681a9792ff9ae393a010190d9887b45c91ef0098aacad9e9f8f8e5b7d5e6466e481bd136a898fbf2ae254dadb4b6a4f68aa0d8c897f7f5
- SSDEEP 768:lY5bPbPBRYiK2uk8X8IgAufBjUBEnGHDtPm0sDpvM1PkK9zHK:lYtXM8hGHDtPmhpvsPzzHK
- TLSH T1FDA31F89762032CFC457CB7289685CA4EA546CAB571B9243EC33769CD93D6B6CF0C0B6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
PE Signature issue
Digest
5a:51:8f:39:91:44:57:24:1e:96:b6:0a:17:cd:c0:db:aa:23:cb:f2:28:02:9e:78:90:a1:79:d6:c7:66:3a:1e
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 8, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:a7:04:3e:e4:22:c8:34:fa:fc:00:00:00:00:04:a7
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=nShield TSS ESN:6F1A-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:01:fc:18:a0:af:cc:69:5a:87:3a:00:01:00:00:01:fc
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 25, 2024 - Oct 22, 2025
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
58046
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
mscoree
_CorExeMain
Name
.text
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
libsvcs.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3fe29bf7e2c391d5405f8c6947cc42a6ec356fcf8455ce705dc23a156f5b450a
- MD5 c0796f2ee614e1711d5355ee42dcbf62
- SHA1 8c3b7bdb3c17109617db9941306f67bdfb26fcdd
- SHA512 303ccabf64c355313e9939adfcc6154e26e1bf4c248ad24e9ea031fea698dc6cb794fba2e88a518f90b5ccf2eb40beee772f5cd91f750a53966026c5dd0403d3
- SSDEEP 6144:Vd03Ef/RRG0bh06xjKxA38S7DibCdYe6yCQhy:Vd00Rd06xjKxA38S7DibCdYe6yCQhy
- TLSH T14124EE9C7660B2DFC85BC976CEA81C64EA60747B931B9203A05715EDAE0D997CF180F3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
ConfuserEx .NET packer
Detects ConfuserEx .NET packer.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
219502
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
206KB
Virtual Size
206KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
944B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ