所得税の確定申告に係る納税通知書4.zip
- SHA256 ba0a76532db536e62034c212536f3e60594cd2248fdedc9ba73b8a2380367f99
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
所得税の確定申告に係る納税通知書4.zip
Resource
win11ltsc2024-20260911-ja
windows11-ltsc_2024-x64
13 signatures
600 seconds
Behavioral task
behavioral2
Sample
event.dll
Resource
win11ltsc2024-20260911-ja
windows11-ltsc_2024-x64
13 signatures
600 seconds
General
- Target 所得税の確定申告に係る納税通知書4.zip
- Size 120KB
- Sample260915-hmt48ashld
- SHA256 ba0a76532db536e62034c212536f3e60594cd2248fdedc9ba73b8a2380367f99
- MD5 f17fa2fa131db632d8a87296f325c1be
- SHA1 190c5e22bb6f6b6632268b9a0941573653b0152a
- SHA512 d253bdc1b8acbadb0670145308b1700e34538912827f7390f8164a86a220f0aea28ee80590fb9188699d32c99d0481c1235fd66887da7c6c0a0b569067f2673b
- SSDEEP 3072:xNGcXjAG20tkwxt5Y0TVmCSQMWuoDQZTktg586o9p:xNGVGmwYCVmZRkK5To9p
- TLSH T1CFC3124DEB476155CE0FB5208895ABFF0ECE2352CCE22139C58792E8AB94D535FF2522
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/event.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/event.dll
File Explorer
-
所得税の確定申告に係る納税通知書4.zip.zip 120KB
-
event.dll.dll 52KB
-
所得税の確定申告に係る納税通知書4.exe.exe 250KB
event.dll
- IMPHASH 727688a2bc1de931706b2464f030fb51
- SHA256 61df4487225b6af0d2bcc6e4332603d82c72d9a058517b208eeb89533ff3f02d
- MD5 f1a1e3a52a55d3dfc6d228f23c9806c5
- SHA1 77ac9052284474288b1392532d66f33c5370a9c7
- SHA512 bc2eb5834e0324e8368626e669378ead1161dbd46febdb4aaa0d006d6bc2aa957d7773e1ce57250f95264215251fb639a0e5a448ea0c4d38291cfcaaede83b2f
- SSDEEP 1536:pK9PQ84hwc64bcecZEklVFhuAnzSbH+lP7x+:pK9PpYTFgecZEklfhugzKH+lPE
- TLSH T19D33F806668668EDD426C53542176B23E5B2B848A77079EF07F0CF257EA0ED1373C6C6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CompareStringA
CreateEventA
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
GetACP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetEnvironmentVariableA
GetFileAttributesA
GetFileAttributesW
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetOEMCP
GetProcAddress
GetTickCount64
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
QueryPerformanceCounter
RemoveVectoredExceptionHandler
SetEnvironmentVariableA
SetEvent
SetLastError
SetThreadPriority
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcatA
lstrcpyA
lstrlenW
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
api-ms-win-crt-private-l1-1-0
__intrinsic_setjmpex
longjmp
memcpy
strchr
strrchr
wcsrchr
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
strncpy
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
calloc
free
DoSettingsDialog
InstallEventHook
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
所得税の確定申告に係る納税通知書4.exe
- IMPHASH d2c7f1b09ad06bb84f38f71b7be8f299
- SHA256 abcb44b459e9f101106251bb9b4b7a07163554af450d0e61636417d12499cf2f
- MD5 aeb22262cc2114f611c92eb062b34da3
- SHA1 0bacc5bfbfeac8bade04d085e995d8c7f31c5f7c
- SHA512 46fe4d42aacdc0ad9a3da270238ea982bed1af30478e5cdddce7fea8e04d49d0eb6db1c6275bc4eae5677c4b0bd371864eb1191ff6d4af9dbf507771469c9215
- SSDEEP 6144:fK3jQoHr3VF2mjkaRGP4PkhijsKgW3UMKYMKBbZixsN:fKEoJF2mjkabsKgW3/m8
- TLSH T13044A11237F810D5F1B69679AAB58512E7B2BC662B25C7CF1260016E9F73BD0AC34732
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1d:27:43:2a:6a:6f:ed:4e:36:56:14:16:8c:f6:d1:b5:59:1d:74:fc:d2:e5:4d:4e:17:b2:f8:c8:59:cd:b4:4a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0c:b9:64:e3:35:9c:ec:f4:ae:00:01:00:00:02:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
87680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
AccEvent.pdb
advapi32
OpenProcessToken
GetTokenInformation
EventRegister
EventUnregister
EventWriteTransfer
RegOpenKeyW
RegCreateKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
kernel32
InitOnceBeginInitialize
InitOnceComplete
SetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateEventW
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcessId
CreateThread
GetCurrentThreadId
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
GetModuleFileNameA
FormatMessageW
WideCharToMultiByte
InitializeCriticalSectionEx
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
GetModuleHandleW
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
LocalAlloc
LocalFree
GetCommandLineW
CreateFileW
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
lstrlenW
GetLastError
OutputDebugStringW
DebugBreak
WriteFile
IsDebuggerPresent
lstrcmpiW
MulDiv
GetProcAddress
GetModuleHandleExW
CloseHandle
FreeLibrary
GetCurrentProcess
HeapSetInformation
ResetEvent
gdi32
DeleteObject
GetStockObject
CreateRectRgn
CombineRgn
LineTo
SelectObject
SetBkColor
SetTextColor
MoveToEx
CreateSolidBrush
GetTextMetricsW
GetDeviceCaps
CreateFontW
user32
GetDlgItem
PostMessageW
RegisterWindowMessageW
SystemParametersInfoW
LoadCursorW
IsRectEmpty
SetRectEmpty
MessageBoxW
GetWindowRect
SetWindowTextW
GetDC
UpdateWindow
DeleteMenu
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadMenuW
SetWindowPlacement
TranslateAcceleratorW
LoadAcceleratorsW
SetFocus
IsIconic
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetDesktopWindow
RegisterClassW
GetSystemMetrics
DrawTextW
SetWindowRgn
InvalidateRect
MapWindowPoints
FillRect
GetWindowLongPtrW
SetWindowLongPtrW
GetCursorPos
PostThreadMessageW
PeekMessageW
ReleaseDC
RegisterClassExW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
SetDlgItemTextW
EndDialog
DialogBoxParamW
wsprintfW
EnableWindow
LoadIconW
GetClientRect
msvcrt
free
malloc
wcsstr
_CxxThrowException
__CxxFrameHandler3
memset
memcpy
_purecall
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
memcmp
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
_vsnwprintf
memcpy_s
memmove_s
oleacc
GetStateTextW
GetRoleTextW
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoInitialize
oleaut32
VariantInit
SafeArrayGetVartype
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetDim
SysAllocString
SysStringLen
SysFreeString
SafeArrayGetLBound
shell32
ShellExecuteW
comdlg32
GetSaveFileNameW
comctl32
ord17
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
event
InstallEventHook
DoSettingsDialog
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=26, id=260, version=33145,
count=27, id=257, version=33145,
count=224, id=1, productName=Unmarked objects,
count=24, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,