Notice%20from%20Tax%20Departmen[.]dmg[.]dll[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Notice%20from%20Tax%20Departmen.dmg.dll.exe
Size 257KB
Sample260729-jsjfcaydmg
SHA256 b9ddd7f8aaeb1247eaa881caf75f8749d4b7c4442408c37d9bb57ad9927ee19a
MD5 4d69a7b084a2c4486a703e4c079079aa
SHA1 0ea4745516c343e3e2f85b1c6d354046c7c25a79
SHA512 3ade1ed260dc8f3225d90b42b4252f3624f129487d71e2a7c8d6b9c820141ccf7a15221a3d5e8ba480310a796b47d10f83a0d75ef59c682538a0ade9ebfa853a
SSDEEP 3072:UY7JNH56UcFkfenaB0DBmAV6t81zetG3Inv7Tl48LWr9Ms8Yfk2ErRjV:59VzfenaB0Dkk6OhnfV8YGVh
TLSH
T10A446B5577A40CB9E9B7823CC9938606E7F2BC160760E7DF03A0466A9F2B7D0953E721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Notice%20from%20Tax%20Departmen.dmg.dll.exe

File Explorer

Notice%20from%20Tax%20Departmen.dmg.dll.exe

.dll 257KB

Notice%20from%20Tax%20Departmen.dmg.dll.exe

IMPHASH 1fd1f3e132919f622e30ad7a3ada4bdd
SHA256 b9ddd7f8aaeb1247eaa881caf75f8749d4b7c4442408c37d9bb57ad9927ee19a
MD5 4d69a7b084a2c4486a703e4c079079aa
SHA1 0ea4745516c343e3e2f85b1c6d354046c7c25a79
SHA512 3ade1ed260dc8f3225d90b42b4252f3624f129487d71e2a7c8d6b9c820141ccf7a15221a3d5e8ba480310a796b47d10f83a0d75ef59c682538a0ade9ebfa853a
SSDEEP 3072:UY7JNH56UcFkfenaB0DBmAV6t81zetG3Inv7Tl48LWr9Ms8Yfk2ErRjV:59VzfenaB0Dkk6OhnfV8YGVh
TLSH
T10A446B5577A40CB9E9B7823CC9938606E7F2BC160760E7DF03A0466A9F2B7D0953E721
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

34576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

GetTokenInformation OpenProcessToken RegSetValueExW RegCreateKeyExW RegCloseKey CryptReleaseContext CryptImportKey CryptSetKeyParam CryptDecrypt CryptAcquireContextW CryptDestroyKey

kernel32

CreateDirectoryW HeapFree GetCurrentProcess WriteFile ExpandEnvironmentStringsW VirtualAlloc GetModuleFileNameW WaitForSingleObject CreateFileW GetModuleHandleA DisableThreadLibraryCalls DeleteFileW CloseHandle GetProcAddress ExitProcess GetCurrentProcessId GetProcessHeap CopyFileW FlushInstructionCache GetConsoleWindow HeapAlloc SetEndOfFile WriteConsoleW HeapSize SetStdHandle InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId WideCharToMultiByte EncodePointer DecodePointer QueryPerformanceCounter FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetModuleHandleW MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetModuleHandleExW GetFileSizeEx SetFilePointerEx GetStdHandle GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

user32

ShowWindow

shell32

ShellExecuteExW

Name

.text

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

248B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Notice%20from%20Tax%20Departmen.dmg.dll.exe

advapi32

kernel32

user32

shell32

generic