Notice from Tax Department.zip
- SHA256 af05c0b7aefa3554b15792bab2ed7460b011d62ae64841541ebc24a33dd103d6
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Notice from Tax Department.zip
Resource
win10v2004-20260513-ja
windows10-2004-x64
23 signatures
600 seconds
Behavioral task
behavioral2
Sample
Notice from Tax Department.zip
Resource
win11ltsc2024-20260710-ja
windows11-ltsc_2024-x64
22 signatures
600 seconds
Behavioral task
behavioral3
Sample
Notice from Tax Department.exe
Resource
win10v2004-20260513-ja
windows10-2004-x64
26 signatures
600 seconds
Behavioral task
behavioral4
Sample
netutils.dll
Resource
win10v2004-20260513-ja
windows10-2004-x64
4 signatures
600 seconds
Behavioral task
behavioral5
Sample
netutils.dll
Resource
win11ltsc2024-20260709-ja
windows11-ltsc_2024-x64
4 signatures
600 seconds
General
- Target Notice from Tax Department.zip
- Size 770KB
- Sample260715-khdyjsbs41
- SHA256 af05c0b7aefa3554b15792bab2ed7460b011d62ae64841541ebc24a33dd103d6
- MD5 38dfb8f27ed78234ed82350d80ea2599
- SHA1 01d3b735168582614844b6bd2392de079eb4e94c
- SHA512 9f91d712177412e1683a571d80809be8e4f1dfa10166dde69a9bc839da3d6a51c917ace4044710f2f8dfb93851f4e26f538784fd5eb38f45afd1dce7020b5412
- SSDEEP 12288:4cTHHERNTheXe5urVD/MW8C8KdKV3AwYS12ojrL5XusLkcyqyi7axon:4cbHEJU778CdKNYS1v+xFXi7axG
- TLSH T13FF4332CF7F8AAC2F2619C7705D4B4041B02339EDDD68291242F67779C21667F1256BE
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/netutils.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/netutils.dll
File Explorer
-
Notice from Tax Department.zip.zip 770KB
-
Notice from Tax Department.img.iso 1.0MB
-
Notice from Tax Department.exe.exe 98KB
-
netutils.dll.dll 901KB
Notice from Tax Department.img
- SHA256 3b69050c148e6309a1e0b0f21c54cc3ee99da3c542e8f6d00fb3a93d6c7dcb21
- MD5 9164b5b600300dd0c1ad86fd471309eb
- SHA1 91baeb590055cdc0cf894f38d484ce464089636b
- SHA512 75a4e4cd4ac7f11e2ea17e2399b73af03ba877d59b56bdda900d0269b95d46b7a7005cca64b9b8b143dacec0d86895bcbf51733669bd3b1926814a3726233cdf
- SSDEEP 24576:3CRTNnaeQCfDJJuUKSJCSXUGQn4/u41ib43:onrJuxSJ/XUrw3
- TLSH T1A435E01CD66D0869DA730EBC803948D6963AB4E2278341EB37FC84E78B933D4547EE95
- MD5 SHA1 SHA512 SSDEEP TLSH
Notice from Tax Department.exe
- IMPHASH 3e94ccb6e60fc118db0d61a5306c8825
- SHA256 26c642331d6c1fb00a5be9895c636c7e4db7912a4d2920e896ee1ccf3a2a40e5
- MD5 7f39ef3ca59c27cd5c2ef318c2560a5b
- SHA1 ca589e4bba6e5afc7647db76ae0a74d925454e92
- SHA512 440bb37866485526400023eaf32cb549d0111df748f20de4f07fe3d4a0c61435f7543e10fd20dccfda177c158220b2f7b8c19a377038d78ab093f775a8c70c6d
- SSDEEP 3072:TYOGW9bZsPU804u2xXibswbelywU2vBh06:cWF+p0yibO0wU2f
- TLSH T179A3294997E834D4F5FA9B34457592147B30F9652B219BEF09A080790F22BD08F3EF6A
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
30:2b:08:20:54:b9:14:8f:d6:c8:37:c8:a2:2f:74:26:1e:81:3f:98:71:d2:f2:fc:92:00:1b:3f:49:bd:bb:e1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Oct 24, 2025
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:05:19:da:dd:aa:8b:dc:44:b2:92:00:00:00:00:05:19
Issuer
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 19, 2025 - Jun 17, 2026
Subject
CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:07:76:56:00:00:00:00:00:08
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Oct 19, 2011 - Oct 19, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:F002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:05:3c:75:6c:82:44:87:cd:fe:00:01:00:00:02:05
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
5024
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
easinvoker.pdb
advapi32
RegGetValueW
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
GetTokenInformation
MakeAbsoluteSD
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
OpenProcessToken
EventRegister
EventUnregister
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetModuleHandleExA
ResolveDelayLoadedAPI
DelayLoadFailureHook
GetSystemWindowsDirectoryW
LocalFree
CloseHandle
GetCurrentThread
SetEvent
GetLastError
CreateEventW
WaitForSingleObject
GetCurrentProcess
msvcrt
_purecall
__CxxFrameHandler3
free
malloc
_vsnwprintf
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
memcpy
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
memset
_commode
_lock
_unlock
__dllonexit
_onexit
?terminate@@YAXXZ
exit
_wcsicmp
_callnewh
_wtoi
api-ms-win-core-com-l1-1-0
CoRevokeClassObject
CoInitializeSecurity
CoTaskMemAlloc
CoRegisterClassObject
CoInitializeEx
CoUninitialize
CoCreateInstance
CoReleaseServerProcess
CoAddRefServerProcess
CoTaskMemFree
api-ms-win-core-synch-l1-2-0
Sleep
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
api-ms-win-core-libraryloader-l1-2-0
LoadLibraryExW
GetProcAddress
FreeLibrary
GetModuleHandleW
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
api-ms-win-core-sysinfo-l1-1-0
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW
api-ms-win-core-rtlsupport-l1-1-0
RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
api-ms-win-core-heap-l2-1-0
LocalAlloc
api-ms-win-security-base-l1-1-0
PrivilegeCheck
GetSecurityDescriptorDacl
CopySid
CreateWellKnownSid
EqualSid
GetLengthSid
CheckTokenMembership
authz
AuthzInitializeContextFromSid
AuthzAddSidsToContext
AuthzInitializeResourceManager
AuthzAccessCheck
AuthzFreeResourceManager
AuthzFreeContext
samcli
NetUserGetInfo
netutils
NetApiBufferFree
rpcrt4
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingFree
I_RpcMapWin32Status
I_RpcExceptionFilter
RpcBindingCreateW
NdrClientCall3
RpcBindingBind
api-ms-win-core-registry-l1-1-0
RegEnumValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegOpenKeyExW
RegDeleteTreeW
RegCloseKey
api-ms-win-core-file-l1-1-0
CreateFileW
api-ms-win-security-lsapolicy-l1-1-0
LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy
LsaLookupSids
samlib
SamQueryInformationDomain
SamConnect
SamQuerySecurityObject
SamOpenDomain
SamQueryInformationUser
SamCloseHandle
SamFreeMemory
SamOpenUser
ntdll
NtGetCachedSigningLevel
NtQuerySystemInformation
RtlGetDeviceFamilyInfoEnum
NtDuplicateToken
NtOpenProcessToken
NtOpenThreadToken
RtlEqualSid
RtlSubAuthorityCountSid
RtlDeleteResource
RtlInitializeResource
NtClose
RtlReleaseResource
RtlAcquireResourceExclusive
RtlCopySid
RtlLengthSid
RtlGetNtProductType
RtlInitUnicodeString
RtlSubAuthoritySid
RtlInitializeSid
RtlIsMultiSessionSku
NtQueryInformationToken
user32
UpdatePerUserSystemParameters
SystemParametersInfoW
api-ms-win-core-apiquery-l1-1-0
ApiSetQueryApiSetPresence
Name
.text
Size
36KB
Virtual Size
35KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.imrsiv
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
48B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
444B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=40, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=5, id=261, version=33145,
count=11, id=257, version=33145,
count=176, id=1, productName=Unmarked objects,
count=32, id=264, version=33145,
count=23, id=260, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
netutils.dll
- IMPHASH ee6041d13476b06f8c7d1e541d5bd342
- SHA256 e8a4f2026d5aac1b74acbf7033ea0ec626055d3dbf5d645c9f741a75ad17ea37
- MD5 19659624f5327852b451e55d42f10814
- SHA1 fe41e0792240db27a1068884baf31d9f8971a50d
- SHA512 4adf498455d378031d6276a3610a81964554562ec41a668b599f0679201d4b28e3eb73ca9af278b62224d874db17bca45e84a5770a490b64b0209cbb7cf782ef
- SSDEEP 12288:zLAjMiKK1sILWWldMs9ZFdIW7NQCfaSUPinvmPFzLdJ5tMo2uaTcIoUX6mdJY9S4:zCRTNnaeQCfDJJuUKSJCSXUGQn4/uR
- TLSH T1AC15E01CD62D0D2EDA230EFDD07A48D6D12AA5E32AC7402737F589E786D3398508FE95
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4114
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
netutils.pdb
kernel32
GetSystemTimeAsFileTime
QueryPerformanceCounter
CreateEventA
SetEvent
LoadLibraryA
GetProcAddress
GetModuleFileNameA
GetModuleHandleA
VirtualProtect
CreateThread
VirtualAlloc
VirtualFree
GetTempPathA
CreateFileA
GetTickCount
FlushFileBuffers
DeleteFileA
SetFileAttributesA
CreateDirectoryA
CopyFileA
SetEnvironmentVariableA
GetCurrentProcess
GetFileSize
CreateProcessA
WaitForSingleObject
TerminateProcess
GetExitCodeProcess
ReadFile
ExitProcess
GetEnvironmentVariableA
GetDiskFreeSpaceExA
GlobalMemoryStatusEx
GetNativeSystemInfo
CloseHandle
WriteFile
Sleep
advapi32
RegSetValueExA
GetTokenInformation
OpenProcessToken
RegCloseKey
RegOpenKeyExA
RegCreateKeyExA
user32
GetWindowTextA
EnumWindows
NetApiBufferFree
_DllMainCRTStartup
memcpy
memset
Name
.text
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
892KB
Virtual Size
891KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
156B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
108B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ