7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a
- SHA256 7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a
Behavioral task
behavioral1
Sample
Tax_Notice_23665.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax_Notice_23665.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
nvdahelperremote.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral4
Sample
nvdahelperremote.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a
- Size 242KB
- Sample260910-leqcva1dmf
- SHA256 7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a
- MD5 f585ede33ccee3198f199a182504f8e0
- SHA1 ed076a6c691f79008b6d2f77c1c0b4c8242f3c90
- SHA512 c64f93c4ff97cfbf6f7cc33e575de54809253de332bf4c6468f3c153fb9584d5d3c1236279929feaacddc8e875b48f37f7add3466e11fd9f2f8f833df863426a
- SSDEEP 6144:uZu4qO4YPS781UQ3cNkHD8tM7R1SQFLXmDmJKm0uMeXUiGxPtfURnUJ:usgPk81l3hHItM9EQlmKU1hmUJ
- TLSH T1D43423CC82BB61C657E327B1E4634FC68F60667310BBB7ADC045B445AA21B584DF0AE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
packclient
C2
-
154.36.188.201:443
Signatures
- Family: PackClient
PackClient is a Windows loader written in C.
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/nvdahelperremote.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/nvdahelperremote.dll
File Explorer
-
7108ff29916d064216aa2ece7fb395f1e3a73d12d19895bffc0bd46806cbf85a.zip 242KB
-
Tax_Notice_23665.img.iso 626KB
-
Tax_Notice_23665.exe.exe 118KB
-
nvdahelperremote.dll.dll 444KB
Tax_Notice_23665.img
- SHA256 38ec1f5e23f65b10ae3027beabfa0bf7f9fb686355a9e33c7e7e44e6a998e04c
- MD5 fd2f94d01651c3e2ed816248193db6e8
- SHA1 2ded1a0d67b754dca0bd3704051ed0d32a797283
- SHA512 0707f8f860d28930b4f710d0f0452c7d538a89273ba5e8c5c12dbce982f8f836cd3cc0e94b5cb015620773d5a63d358be23dca5066271a0c8bec1555abcefac3
- SSDEEP 12288:FNMAH1W3lF4/h4oAFd9W9LJYgoukoR4nhy:FNx1mwh4oAFd9QvoB
- TLSH T118D4BE59F7D132F2E23221B8A1D48A4647D1FDE2D2E497BB7AAD1C0D4FD25410CB6A32
- MD5 SHA1 SHA512 SSDEEP TLSH
Tax_Notice_23665.exe
- IMPHASH c440fed27cd89389c64033011969935a
- SHA256 93dd8b7b393289f88493596faa4ae70054d9eb4fe47f2dd334f0c6bb5262f2a8
- MD5 1605971fa40b7f784311cecea47a251e
- SHA1 9fd5870678ae20ffe9cc8c26068e75935f27957d
- SHA512 39b5009020a2330d46a746ded44081c8ce0b08a608520ccdc3745f4b98020a537afd2872fed848c1d12321f3e90312297e436693db5017801726a14e115078de
- SSDEEP 3072:dfYomTuROFcA8eTRuznTVTX3xOcODofsdp9:dgouuTQTR4nl3yAsdj
- TLSH T126C36C5B63E530E9E1B78678C4914A59E776BC7107609FEF03A0425A2F272D18D3EF21
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
0a:40:4b:7f:87:cb:f9:1e:f1:2d:82:01:5a:b4:29:08:1f:99:f9:be:7c:0c:65:eb:40:25:b9:e6:1a:39:38:fc
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=NV Access Limited,O=NV Access Limited,L=Camp Mountain,ST=Queensland,C=AU
Chains
Nov 23, 2025
CN=NV Access Limited,O=NV Access Limited,L=Camp Mountain,ST=Queensland,C=AU
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Subject
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Serial Number
76:53:fe:ac:75:46:48:93:f5:e5:d7:4a:48:3a:4e:f8
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Mar 18, 2020 - Mar 18, 2045
Subject
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Serial Number
77:bd:0e:03:a1:b7:08:f8:54:ab:06:72:10:d9:04:47
Issuer
CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 28, 2020 - Jul 28, 2030
Subject
CN=NV Access Limited,O=NV Access Limited,L=Camp Mountain,ST=Queensland,C=AU
Serial Number
43:cf:89:89:22:c4:ef:98:53:54:ba:dc
Issuer
CN=GlobalSign GCC R45 CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 7, 2024 - Jun 8, 2027
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
3
Major OS version
6
Entry point
4792
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\nvda\nvda\build\x86_64\remoteLoader\nvdaHelperRemoteLoader.exe.pdb
nvdahelperremote
injection_initialize
injection_terminate
kernel32
FlsSetValue
WriteConsoleW
CreateFileW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
RtlUnwind
FlsFree
InitializeCriticalSectionEx
VirtualProtect
LCMapStringW
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetStringTypeW
GetProcessHeap
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapSize
HeapReAlloc
SetFilePointerEx
CloseHandle
Name
.text
Size
56KB
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
39KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
640B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=144, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35207,
count=16, id=260, version=35207,
count=40, id=261, version=35207,
count=2, id=257, version=33145,
count=3, id=257, version=35219,
count=94, id=1, productName=Unmarked objects,
count=1, id=265, version=35219,
count=1, id=255, version=35219,
count=1, id=258, version=35219,
nvdahelperremote.dll
- IMPHASH 8e43949447765f68cf2f6965fde24be6
- SHA256 7295090c2cb63ebc43f932451971c41f9d015d2741e97ae3d9855f5ae87cff94
- MD5 1f23d7cc6d6354c0e7b24eaa0652d96d
- SHA1 7ecde045e2d31a63312d7cd9c482e0d4aa74c7fc
- SHA512 6b9d778105e37d59f965ddd62f7c168534aad6c3055f5ae432fde12026cd9cb1464dba0abecf8fe6bc3d18fa5c37e0f5f871d39192802266e2cb7fde00a51131
- SSDEEP 6144:mrD9MHURHn18ScLDmy7OG1rQi5zeM4/hzcoAsYd9WAnnnOD9LJo:mNMAH1W3lF4/h4oAFd9W9LJo
- TLSH T137A4AE58EBD177F3E23220B872D8CA8A07C4DED7D1D491B3ADA62C1D4AD591208F2977
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
10980
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
shell32
ShellExecuteExW
advapi32
RegSetValueExW
OpenProcessToken
GetTokenInformation
RegCloseKey
RegCreateKeyExW
user32
GetSystemMetrics
GetCursorPos
wsprintfW
kernel32
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetEnvironmentVariableW
SetEnvironmentVariableA
CreateDirectoryW
CreateFileW
DeleteFileW
GetFileAttributesW
GetFileSize
SetFileAttributesW
IsDebuggerPresent
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
Sleep
GetCurrentProcess
TerminateProcess
ResumeThread
CreateProcessW
GetThreadContext
SetThreadContext
GlobalMemoryStatusEx
GetSystemInfo
GetTickCount
GetWindowsDirectoryW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsWow64Process
Wow64GetThreadContext
Wow64SetThreadContext
DisableThreadLibraryCalls
GetModuleFileNameW
IsProcessorFeaturePresent
GetModuleHandleW
GetProcAddress
lstrcmpiW
lstrcatW
lstrlenW
CopyFileW
FreeConsole
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
vcruntime140
wcsstr
__C_specific_handler
memcpy
memset
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_cexit
_execute_onexit_table
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm_e
_initterm
injection_initialize
injection_terminate
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
7KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
540B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
40B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=3, id=259, version=35207,
count=7, id=260, version=35207,
count=10, id=261, version=35207,
count=9, id=257, version=33145,
count=83, id=1, productName=Unmarked objects,
count=1, id=260, version=35225,
count=1, id=256, version=35225,
count=1, id=258, version=35225,