a4bf085f2126f0c5ed26492a044b03f49bd894c9801bf018ca08af3495005826
- SHA256 a4bf085f2126f0c5ed26492a044b03f49bd894c9801bf018ca08af3495005826
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
event.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
event.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
Behavioral task
behavioral3
Sample
所得税の確定申告に係る納税通知書3.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target a4bf085f2126f0c5ed26492a044b03f49bd894c9801bf018ca08af3495005826
- Size 120KB
- Sample260916-j2k1javxew
- SHA256 a4bf085f2126f0c5ed26492a044b03f49bd894c9801bf018ca08af3495005826
- MD5 679064f0956635f77f4358e1ad4538b7
- SHA1 4b8925e1bca1ce2e7af2ba99b066980c16707c84
- SHA512 257905530569c5572db85cd055809126bea6d6efe37576733790cebfa32ee00079437f5a7f903b4b08d90ac7abe0227a377a6f8602f87a34120fb2571a63a8ac
- SSDEEP 3072:IiGjMdupwiulAG20tkwxt5Y0TVmCSQMWuoDQZTktg586o9I:rp+GmwYCVmZRkK5To9I
- TLSH T1ACC3128DEB5B6154CC0EB51084C6AEFE0BCE2190C8A1626CC1C7D7E85E9EC635EF1963
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/event.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/event.dll
File Explorer
-
a4bf085f2126f0c5ed26492a044b03f49bd894c9801bf018ca08af3495005826.zip 120KB
-
event.dll.dll 52KB
-
所得税の確定申告に係る納税通知書3.exe.exe 250KB
event.dll
- IMPHASH 9b9eb3439b5c23e496208f46a6c7a96d
- SHA256 3302bd70c6117a0c16f0eb0aedef2ff0a2d02729e235cd8b6db7096d7bcb3406
- MD5 ae41d87d6322a44e0b4afc1f3931ff5c
- SHA1 992e88baf4ca093da0d9c0fe0fe07a4da6683ba2
- SHA512 a9257383bbf1bb58c286e1c79da637156979f33693b443040465c5497f154a10e461b67f0205e6ccdccc96cb62531879548567c0b2fd43c22e9cf1ab52626717
- SSDEEP 1536:behFdZT5cuB2uMbpYttdjKYzTuVC72MF:bEF7T5cY25NYt+MF
- TLSH T1143329429A8228E9C425C17542166723E9B2B858977079EF07F4CF2A7EA1FD0373C7D6
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CompareStringA
CreateEventA
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
GetACP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetEnvironmentVariableA
GetFileAttributesA
GetFileAttributesW
GetLastError
GetModuleFileNameA
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetTickCount64
InitializeCriticalSection
IsProcessorFeaturePresent
LeaveCriticalSection
MultiByteToWideChar
QueryPerformanceCounter
RemoveVectoredExceptionHandler
SetEnvironmentVariableA
SetEvent
SetLastError
SetThreadPriority
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte
lstrcatA
lstrcpyA
lstrlenW
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
api-ms-win-crt-private-l1-1-0
__intrinsic_setjmpex
longjmp
memcpy
strchr
strrchr
wcsrchr
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
strncpy
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
calloc
free
DoSettingsDialog
InstallEventHook
Name
.text
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
684B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
144B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
所得税の確定申告に係る納税通知書3.exe
- IMPHASH d2c7f1b09ad06bb84f38f71b7be8f299
- SHA256 abcb44b459e9f101106251bb9b4b7a07163554af450d0e61636417d12499cf2f
- MD5 aeb22262cc2114f611c92eb062b34da3
- SHA1 0bacc5bfbfeac8bade04d085e995d8c7f31c5f7c
- SHA512 46fe4d42aacdc0ad9a3da270238ea982bed1af30478e5cdddce7fea8e04d49d0eb6db1c6275bc4eae5677c4b0bd371864eb1191ff6d4af9dbf507771469c9215
- SSDEEP 6144:fK3jQoHr3VF2mjkaRGP4PkhijsKgW3UMKYMKBbZixsN:fKEoJF2mjkabsKgW3/m8
- TLSH T13044A11237F810D5F1B69679AAB58512E7B2BC662B25C7CF1260016E9F73BD0AC34732
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1d:27:43:2a:6a:6f:ed:4e:36:56:14:16:8c:f6:d1:b5:59:1d:74:fc:d2:e5:4d:4e:17:b2:f8:c8:59:cd:b4:4a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0c:b9:64:e3:35:9c:ec:f4:ae:00:01:00:00:02:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
87680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
AccEvent.pdb
advapi32
OpenProcessToken
GetTokenInformation
EventRegister
EventUnregister
EventWriteTransfer
RegOpenKeyW
RegCreateKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
kernel32
InitOnceBeginInitialize
InitOnceComplete
SetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateEventW
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcessId
CreateThread
GetCurrentThreadId
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
GetModuleFileNameA
FormatMessageW
WideCharToMultiByte
InitializeCriticalSectionEx
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
GetModuleHandleW
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
LocalAlloc
LocalFree
GetCommandLineW
CreateFileW
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
lstrlenW
GetLastError
OutputDebugStringW
DebugBreak
WriteFile
IsDebuggerPresent
lstrcmpiW
MulDiv
GetProcAddress
GetModuleHandleExW
CloseHandle
FreeLibrary
GetCurrentProcess
HeapSetInformation
ResetEvent
gdi32
DeleteObject
GetStockObject
CreateRectRgn
CombineRgn
LineTo
SelectObject
SetBkColor
SetTextColor
MoveToEx
CreateSolidBrush
GetTextMetricsW
GetDeviceCaps
CreateFontW
user32
GetDlgItem
PostMessageW
RegisterWindowMessageW
SystemParametersInfoW
LoadCursorW
IsRectEmpty
SetRectEmpty
MessageBoxW
GetWindowRect
SetWindowTextW
GetDC
UpdateWindow
DeleteMenu
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadMenuW
SetWindowPlacement
TranslateAcceleratorW
LoadAcceleratorsW
SetFocus
IsIconic
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetDesktopWindow
RegisterClassW
GetSystemMetrics
DrawTextW
SetWindowRgn
InvalidateRect
MapWindowPoints
FillRect
GetWindowLongPtrW
SetWindowLongPtrW
GetCursorPos
PostThreadMessageW
PeekMessageW
ReleaseDC
RegisterClassExW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
SetDlgItemTextW
EndDialog
DialogBoxParamW
wsprintfW
EnableWindow
LoadIconW
GetClientRect
msvcrt
free
malloc
wcsstr
_CxxThrowException
__CxxFrameHandler3
memset
memcpy
_purecall
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
memcmp
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
_vsnwprintf
memcpy_s
memmove_s
oleacc
GetStateTextW
GetRoleTextW
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoInitialize
oleaut32
VariantInit
SafeArrayGetVartype
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetDim
SysAllocString
SysStringLen
SysFreeString
SafeArrayGetLBound
shell32
ShellExecuteW
comdlg32
GetSaveFileNameW
comctl32
ord17
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
event
InstallEventHook
DoSettingsDialog
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=26, id=260, version=33145,
count=27, id=257, version=33145,
count=224, id=1, productName=Unmarked objects,
count=24, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,