3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e[.]zip

Resubmissions

30/07/2026, 09:34

260730-lj1dlsfa8710

30/07/2026, 09:23

260730-lcylfayvht10

Sharing

Copy URL Twitter E-mail

General

Target
3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e.zip
Size 4.2MB
Sample260730-lj1dlsfa87
SHA256 9669269b9b9870d1603f89520b3e1aa01645bb705dae1c7a6871ffe8742e1432
MD5 b51ddb5cb40be8c4a2ee18bbe3cc139f
SHA1 f782be060f7c3f20ba3ad5bb6508a990d1f5ce17
SHA512 22578aed942e8ae4d3dc344c982ae67e456ee8a6def756629890d165030d59df8ad19d6f4fc77a3e8dbe5f5d5feb225919b5160794377c82b30b68e41b8f503a
SSDEEP 98304:yIUrKikLoMheOzP0ugHQ4nlanl5bjHXMOy2yg5S2/DKQlWC4pLnLyD:yIUr7kmN1Q2S533y2yK/DKQlWAD
TLSH
T12016333249AE85B0F3FB40BF6C8873100939A9B95BA3ACF9D0754E5E8131DADC5DA513
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
unpack003/Tax-Number52563.exe

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack003/BugSplat64.dll

File Explorer

3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e.zip

.zip 4.2MB
3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e.zip

.zip 4.6MB
Tax-Number52563.img

.iso 324.4MB
BugSplat64.dll

.dll 323.5MB
Tax-Number52563.exe

.exe 324KB

3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e.zip

SHA256 9669269b9b9870d1603f89520b3e1aa01645bb705dae1c7a6871ffe8742e1432
MD5 b51ddb5cb40be8c4a2ee18bbe3cc139f
SHA1 f782be060f7c3f20ba3ad5bb6508a990d1f5ce17
SHA512 22578aed942e8ae4d3dc344c982ae67e456ee8a6def756629890d165030d59df8ad19d6f4fc77a3e8dbe5f5d5feb225919b5160794377c82b30b68e41b8f503a
SSDEEP 98304:yIUrKikLoMheOzP0ugHQ4nlanl5bjHXMOy2yg5S2/DKQlWC4pLnLyD:yIUr7kmN1Q2S533y2yK/DKQlWAD
TLSH
T12016333249AE85B0F3FB40BF6C8873100939A9B95BA3ACF9D0754E5E8131DADC5DA513
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

BugSplat64.dll

IMPHASH 6ebf5b7632506f2cfa75dd687cf09739
SHA256 8e6b931599f2b6a6b3de024e6dcd42992fbf4aad7ec9838d91a1b49fdb57788f
MD5 b0ef12c82220537385cd2e6a846af14f
SHA1 abfa362b04be036d77142a0498926f4e2ccf38a5
SHA512 4c34b057585867fe8d399d9f408ca66cd222ce9656668174702993a6f05ab026d43b0343f52fc8a137fd59aec5f29d176da353c7169bf1703e47dd7a5f178b01
SSDEEP 786432:mTgVDqF7/BdDTGO3ZSWtTEsxWmmM8H66X706:msRqh/fDTDQ/mmMK66j
TLSH
T121F89C9673C4BADA8745DD1B6704F3314D9399338EBB90C6AD97170A86B99730F38AC0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

394172

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

EncodePointer FlsFree GetCurrentProcessId MultiByteToWideChar GetStdHandle RaiseFailFastException FileTimeToSystemTime SystemTimeToFileTime GetSystemTime GetTickCount64 GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx GetLastError QueryPerformanceFrequency SetLastError GetFullPathNameW GetLongPathNameW GetCPInfo WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress CreateDirectoryW CreateFileW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetModuleFileNameW LoadLibraryExW SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext VirtualAlloc VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime VirtualQuery ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx InitializeSListHead

ole32

CoWaitForMultipleHandles CoInitializeEx CoCreateGuid CoUninitialize CoGetApartmentType

api-ms-win-crt-heap-l1-1-0

calloc _callnewh malloc free

api-ms-win-crt-string-l1-1-0

strlen strcpy_s _stricmp strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv abort terminate _cexit _initialize_onexit_table _register_onexit_function _crt_atexit _initterm _initterm_e _seh_filter_dll _execute_onexit_table

0EPvEqKx92Y7pwDQ1DpF4oi8 10Ug9TWNVmGeWIR 1ZmR5iQQ 1jkqOgYUUpLwqNM 32aXQbwq6cobGrxPSiHYAj 3Uo8TAxTRlB1Gb 3ZQz3Ez 3ykX8tiKixOV3f7hZntJnufif8nMYtr 5STNCBOQWy3QGadVHaWPmQOAHu 69pm0QkMKRvkHXegaLzyqsN9 6z7EALYl 7Tg8dxjDM 8p3nrKN33OdGQPUkRY0QiC71hXo9gx 8qMKRMX22 9KqII6loTfZDTU0VzfSq 9YLsyZkwOUsOkV7UtoYu6L ??0BugSplatImp@@QEAA@XZ ??0MiniDmpSender@@QEAA@AEBV0@@Z ??0MiniDmpSender@@QEAA@PEB_W000K@Z ??1MiniDmpSender@@UEAA@XZ ??4BugSplatImp@@QEAAAEAV0@$$QEAV0@@Z ??4BugSplatImp@@QEAAAEAV0@AEBV0@@Z ??4MiniDmpSender@@QEAAAEAV0@AEBV0@@Z ??_7MiniDmpSender@@6B@ ?CreateMiniDump@BugSplatImp@@QEAAHPEAUHINSTANCE__@@KPEAXKPEAU_EXCEPTION_POINTERS@@W4_BS_MINIDUMP_TYPE@MiniDmpSender@@PEB_WPEA_WK@Z ?GetReducedGuid@BugSplatImp@@QEAAXPEA_WK@Z ?ReduceGuidString@BugSplatImp@@QEAAXPEA_WK@Z ?ResumeSuspendedThreads@BugSplatImp@@QEAAXXZ ?SuspendAllThreadsInProcess@BugSplatImp@@QEAAXPEAX@Z ?SuspendThreadsInCurrentProcess@BugSplatImp@@QEAAXXZ ?createReport@MiniDmpSender@@QEAAXPEAU_EXCEPTION_POINTERS@@@Z ?createReport@MiniDmpSender@@QEAAXPEB_W@Z ?createReportAndExit@MiniDmpSender@@QEAAXXZ ?disableNetworkAccess@MiniDmpSender@@QEAA_N_N@Z ?enableExceptionFilter@MiniDmpSender@@QEAA_N_N@Z ?getFlags@MiniDmpSender@@QEBAKXZ ?getMiniDumpType@MiniDmpSender@@QEBA?AW4_BS_MINIDUMP_TYPE@1@XZ ?getMinidumpPath@MiniDmpSender@@QEAAXPEA_W_K@Z ?imp@MiniDmpSender@@QEAAPEAXXZ ?isExceptionFilterEnabled@MiniDmpSender@@QEBA_NXZ ?isNetworkAccessDisabled@MiniDmpSender@@QEBA_NXZ ?removeAdditionalFile@MiniDmpSender@@QEAA_NPEB_W@Z ?resetAppIdentifier@MiniDmpSender@@QEAAXPEB_W@Z ?resetVersionString@MiniDmpSender@@QEAAXPEB_W@Z ?sendAdditionalFile@MiniDmpSender@@QEAAXPEB_W@Z ?setCallback@MiniDmpSender@@QEAAXP6A_NIPEAX0@Z@Z ?setDefaultUserDescription@MiniDmpSender@@QEAAXPEB_W@Z ?setDefaultUserEmail@MiniDmpSender@@QEAAXPEB_W@Z ?setDefaultUserName@MiniDmpSender@@QEAAXPEB_W@Z ?setFlags@MiniDmpSender@@QEAA_NK@Z ?setGuardByteBufferSize@MiniDmpSender@@QEAAHH@Z ?setLogFilePath@MiniDmpSender@@QEAAXPEB_W@Z ?setMiniDumpType@MiniDmpSender@@QEAAXW4_BS_MINIDUMP_TYPE@1@@Z ?setResourceDllPath@MiniDmpSender@@QEAAXPEB_W@Z ?setUserZipPath@MiniDmpSender@@QEAAXPEB_W@Z ?unhandledExceptionHandler@MiniDmpSender@@QEAAJPEAU_EXCEPTION_POINTERS@@@Z AM02r1Wy Av7fPgTrid6fMLGEyBIvrELJzGu9Tj Cgdj9l01BF CtFFv7Hm6w CyfunmEl895HfZDLtIA D2O1Gw9mfFctCO3RhQIViFAE0CV6qo FSrWVAtcRXxbdqA7XnoG FiMihQd HrghYPhQIaHuxU7dIQlrUTRrlwRTdr IfPKHh1uXHXH4LNFHHmCPOftKhlLTecN IwAiyIzuCNpi0vgIIBCO8xI JQ3cZ2p1RXD5Wy7 JRsjJs9V5QZIubiPQ JYrztwU6CEehzxMpV9GXR6Dr5F JrCBgb81XRiqDaypkjpX3Sw JuOARY8Vr Kfmpt2ucqxoDV2M1UVxKbAC KpQKmOQPC KzthWTOcvHgKIuBK7VeI7 LQiIfHMSu0KDiTd4qSfczDEeLhp LXRWl7Xt0ElfdHFw NaaJykUQR6qKkbF OeMcejLlQVkX PSXvg8IH2KSRp9GRoEVpFMImAxlGN8 PjjWqoWBHfl7CrKEoe83 QaFdzZRP115HMNMwRILw RXIZZxWz9c00U2FPcE8sFiVueW4s RwvM1udkcN21YhW9qT2tPbZ9F4MgkQe0 SI5I2XijcD3cx8OZz9dZxf6ucfK TPtwngGrCMb0n TqDrdZARxzbVzAbsfu TyN8u9gKKdEp4p UrOxGsCoQLdM UvMR42eN9CbCXe79VmD V7lPiMfwasdXtY7ZuN Vf7NnwqiCwYvUIwZC Wzzd1P7C XCwx3qQ6094GBDghq5H XO1PtqpteAW4yukvwmCoGR79WFBQt2J XxmFGZnDLCMcmJl2iz7fvukblhOf YJxFLUx1zcw6Cv7k3FKdYZ YSDMvOODi2jkCt YtwgWbKLsklEeV8 aTT2x5M6yMY7X1cl8s bINH1uoduZmPiXs4xFFDpoW c70ECODO idhlppBizmIFTZiJaFg48DLUTb17z2 jgflAajJfiPUaZ2SpUa62qYkAI37GxdN jpHXy8z kQPh79PogArOxjrsgh80KXk l8qoGJC9woyDUuor4Y7kx lRSshkF nQhi6uGtWkemd ohfJBJg8h ovjgiiODTTLaBaWRDN1qAQ85XGFuMNJ q6Nk6ya qwQsJ2FxBLTDfCU2JUndcA0HyD sLgA1PJ2QP6NM sRcQmRwxbxuzyjY thY9pO6d0C5k2BDr0fJm4k4wvCXPeXfU tkhx2FxFjaFP8PXGmUkR u29yMLlWej1XxSU u64t24YsD4Q uomeT48GfIVA7Ink6wcxQiO v43yJMmh9oJgq4 xYJdJnWWB0Jrg xyV3DaZIHi yCXbuV2EKxJxEc

Name

.text

Size

401KB

Virtual Size

400KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

355KB

Virtual Size

354KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

170KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

252KB

Virtual Size

251KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6.5MB

Virtual Size

6.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Tax-Number52563.exe

IMPHASH c6969aafb7744e2456439ee86554819a
SHA256 1ffc8bde92758bc0d2ddcc5a6bb78c73b6409429e52d62191f25afa8ebfad84a
MD5 60138b3f2791742dd65bdf29376055e8
SHA1 f6ade6bbdd1828add500aa82505567cf9f21efaf
SHA512 5f331c57b6fbbdd8ab819cddfab1a9859da07b59de849ba34b556598b9d9647938bc7d8fc82bf3e7e35521be355bb316d80665b4cf75b9f71800d50b574055e2
SSDEEP 3072:RxOb8VXWstpmWU/ya8UGEPzxP8EpwHUlHcTCuyuO/sOX52G99X6yoY46lhMAQG1Z:RxjtWGEPNP8Epw0lmEn0OplohRCyxzy
TLSH
T18A643946735408E8F76783398811D585E6727C390AB0E62FD3647A366E332939D3BB1E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.

Password

infected

Digest

c7:9b:b0:40:7f:17:c7:17:39:2e:5a:ba:a8:76:5f:bd:ab:e5:72:ac

Digest Algorithm

sha1

PE Digests Matches

Trusted

Signing Certificate

CN=BugSplat,O=BugSplat,L=Henniker,ST=New Hampshire,C=US

Chains

Aug 5, 2020

CN=BugSplat,O=BugSplat,L=Henniker,ST=New Hampshire,C=US

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Serial Number

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 21, 2012 - Dec 30, 2020

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Serial Number

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 18, 2012 - Dec 29, 2020

Subject

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Serial Number

Issuer

CN=Go Daddy Root Certificate Authority - G2,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 3, 2011 - May 3, 2031

Subject

CN=BugSplat,O=BugSplat,L=Henniker,ST=New Hampshire,C=US

Serial Number

f8:49:5e:22:4e:fa:55:d4

Issuer

CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O=GoDaddy.com\, Inc.,L=Scottsdale,ST=Arizona,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 24, 2020 - May 21, 2023

Minor OS version

Major OS version

Entry point

47816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\www\src\BugSplat\bin64\BugSplatHD64.pdb

kernel32

GetFileInformationByHandle CreateFileMappingW MapViewOfFile OpenProcess CloseHandle GetLastError Sleep GetCurrentThread TerminateProcess GetTempPathW WritePrivateProfileStringW CreateFileW CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteConsoleW HeapSize ReadConsoleW GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW UnmapViewOfFile GetACP MultiByteToWideChar GetModuleFileNameW SetCurrentDirectoryW GetCurrentDirectoryW GetFullPathNameW GetFileAttributesW FreeLibrary CreateProcessW LoadLibraryW GetCommandLineW GetCommandLineA GetOEMCP WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException LoadLibraryExW DeleteFileW GetStdHandle WriteFile ExitProcess GetModuleHandleExW HeapFree HeapAlloc GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage RtlUnwind

user32

GetWindow GetWindowThreadProcessId GetTopWindow MessageBoxW SendMessageTimeoutW LoadStringW

advapi32

OpenThreadToken LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateSelf

bugsplat64

??1MiniDmpSender@@UEAA@XZ ??0BugSplatImp@@QEAA@XZ ?SuspendAllThreadsInProcess@BugSplatImp@@QEAAXPEAX@Z ?CreateMiniDump@BugSplatImp@@QEAAHPEAUHINSTANCE__@@KPEAXKPEAU_EXCEPTION_POINTERS@@W4_BS_MINIDUMP_TYPE@MiniDmpSender@@PEB_WPEA_WK@Z ??0MiniDmpSender@@QEAA@PEB_W000K@Z

shlwapi

PathAppendW PathFileExistsW

3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e.zip

3c181f642e24c28602a87be7f195e2f3d1ffa30b37e20f5121d99f88b22ab80e.zip

Tax-Number52563.img

BugSplat64.dll

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic

Tax-Number52563.exe

kernel32

user32

advapi32

bugsplat64

shlwapi

generic