04082026_1532_04082026_tax returns.zip
- SHA256 7a330c11f130d4c459ba733f0fc2a7adafa5093d4a7f41d7b87a92e498d5390f
Password
infected
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
tax returns.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral2
Sample
tax returns.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
300 seconds
Behavioral task
behavioral3
Sample
taxreturns.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
taxreturns.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
300 seconds
General
- Target 04082026_1532_04082026_tax returns.zip
- Size 34KB
- Sample260804-sypc8ach92
- SHA256 7a330c11f130d4c459ba733f0fc2a7adafa5093d4a7f41d7b87a92e498d5390f
- MD5 0971d7c083a91f3a02fa9dc572e9a05a
- SHA1 0cb62f8e5616f322d607ae7d370719e2c9fc1a70
- SHA512 27537c1180e98c241967338c545d1026085bb10c15006ba74aa1cce7fc47f1f80d265cef4e1454f28ce2a2e855912bd1d4700b00fe4043a71bf717e430d1ba36
- SSDEEP 768:vm7wA6MQd3dmlPtmYhgfb75Z82ohP+w9L2Kf+OJNdQDZFv5T:vg6vOtNuz75Z1cnLJf9XQV95T
- TLSH T1B3F2F186FA4C2A1FCF58E13CD14C0A2567C1115A68B1D2E632786646A1DFC3C1CB47DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/taxreturns.dll
File Explorer
-
04082026_1532_04082026_tax returns.zip.zip 34KB
-
tax returns.img.iso 136KB
-
tax returns.exe.exe 63KB
-
tax returns.exe.config366B
-
taxreturns.dll.dll 8KB
tax returns.img
- SHA256 098944076200e38a2c97dd2cde6041e766fa8506d80a6c5ff9fbc90b2cdbf82b
- MD5 3a092bdaa2079ff14c7acb4c72afc6e9
- SHA1 0744bbc054decadabfe7f0c7069109cf4c81782d
- SHA512 a5c7e98177ae7ea3f83a71847f48f119642d162a508c305cf6d54be21926be5014126828051abefc9032b1faffc36d6af87cd37bacc32a592ebcda6a9b5ba61c
- SSDEEP 1536:0c6KzEsd5qPj6C1vf5HWsvfjvKftzSSKpZRzFS0J:0c6Kz9L2j6CdRHWsmdUpL80J
- TLSH T184D33B4177A8521BCAFF4A7624E156005B77FA877432D78F3D8C71AA0B6338116217BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
tax returns.exe
- SHA256 3d929643ad39e97ddf3a68fa344abc759b4d0671402c6e995194fc3b1480d0f0
- MD5 3444d9086e0d0a9476da9f6003f2439e
- SHA1 e037156359347cf87c3e59830f0d48097067f919
- SHA512 61fe5c33ae8b168fe7808c5f5ba67c4ac77c53ef5b4a98a1f86d919db69007cfe599a695f247018b5f49b51f9239abe1ef2a2cfc1a1a88ac90dd78a6d8d965de
- SSDEEP 1536:Nc6KzEsd5qPj6C1vf5HWsvfjvKftzSSKpZRzQ:Nc6Kz9L2j6CdRHWsmdUpLc
- TLSH T174535C4173B8531BCBFF567634D116015BB5EA9B7422D78B2E88B1BA08533C12621BBF
- MD5 SHA1 SHA512 SSDEEP TLSH
Password
infected
Digest
9c:fe:d7:a3:9f:bc:c1:53:63:50:8c:6a:b6:03:d6:13:96:f7:57:f1:58:d9:8e:19:1a:0e:cc:5b:ee:e7:39:33
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 4, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:1d:4d:19:c8:4e:d7:0f:57:48:00:00:00:00:02:1d
Issuer
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 16, 2026 - Apr 15, 2027
Subject
CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 8, 2024 - Mar 22, 2036
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:8603-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:25:80:c7:37:c6:cd:aa:77:49:00:01:00:00:02:25
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Feb 19, 2026 - May 17, 2027
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_APPCONTAINER
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\dbs\el\ddvsm\out\Intermediate\Xaml\uwpsurface.csproj_0C50153C_ret\objr\amd64\UwpSurface.pdb
Name
.text
Size
51KB
Virtual Size
51KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
tax returns.exe.config
- SHA256 5b248fe0cd74dcdd9fc21633e67646b3c0568e794f79a7e3f9f13e9dfa3648c2
- MD5 2f07625abc72f98bd0257ae44da2392b
- SHA1 690ff5a55edfbc95780a19786a530d3b8631ed2e
- SHA512 4365198a5d5636fad3411e0f24ac074a498cd5302de539fdf9be5e65f4fa26e2b695bdcb96a9c4d04954a2221f9facd301781aba32e6771926daf394b96e5743
- TLSH T11EE0D851ADC59D5ED624165F78A06060957EC37302CC048CF82E296F4B27406A637256
- MD5 SHA1 SHA512 TLSH
taxreturns.dll
- SHA256 56e2c9b6b1bee0250613a170e861b5de6ea1bc523985408c557b5b939a607345
- MD5 c1ad913ef1ae815cbfbb8ee33dae9d81
- SHA1 b85a44af8ac2e23595f1ed6e21b2842d499da699
- SHA512 738621cd7616ec4e9ddd54b8cf70ba4889eb7ba8161211429cd161adb527afa0c2355539a3a65053676d14ad5fd7975e0e9b07b0c49805388fb3d56429d46023
- SSDEEP 192:x4nDsb5w9IaWqTXVIghi+1Fl7jP4LsLV0p3:h3Xw6gU+1Fl7DfLV0p3
- TLSH T10A02F81A6BD8433ED9EB4E77BCA352500672FB455A13EF5E08C8805B9DB37044B92B26
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
infected
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\X\Documents\visual studio 2010\Projects\WindowsFormsApplication1\WindowsFormsApplication1\obj\x64\Release\taxreturns.pdb
Name
.text
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
940B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ