GST_Non_Filing_Notice_06RRTJE7550U3Z4_Sep2026_23092026.zip
- SHA256 9f583b4169cd9cefa34b05e800fc0283291943e53cca03c5f004a649e9fda5b5
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
GSTR-3B_Overdue_Notice_S47_06AAAGC2597F2ZI_23092026.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
tedutil.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
tedutil.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target GST_Non_Filing_Notice_06RRTJE7550U3Z4_Sep2026_23092026.zip
- Size 118KB
- Sample260923-sr5rmathje
- SHA256 9f583b4169cd9cefa34b05e800fc0283291943e53cca03c5f004a649e9fda5b5
- MD5 ee323ed4b2cbf43bd26c85ef44b0434d
- SHA1 d4e3be50ce0e2e7e8cd83fc210155813d07c0981
- SHA512 442f569d54a6d54d4b6c5bbb55311f9c28b8a604db2146a9146d2f58e7c6c945fe6641b01e17e4708501982ff83cc746d2f7ecd423254d8040f3816523ecaabd
- SSDEEP 3072:FaZEpWASft5BwcnDqKc9G8zbXL26UU21LfcXX5iD:00WASBDqdLzbLG1AXXi
- TLSH T11AC312609E16597CF8D41CF161E47AF22332689A087B3ED4FB7C58982118A6FD35E36C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/tedutil.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/tedutil.dll
File Explorer
-
GST_Non_Filing_Notice_06RRTJE7550U3Z4_Sep2026_23092026.zip.zip 118KB
-
GSTR-3B_Overdue_Notice_S47_06AAAGC2597F2ZI_23092026.exe.exe 222KB
-
tedutil.dll.dll 102KB
GSTR-3B_Overdue_Notice_S47_06AAAGC2597F2ZI_23092026.exe
- IMPHASH fcd89eebe7a883ae62c53452b4abddf8
- SHA256 1688fe4698c45680851f5d90aff71fffdccb19c1b283a8c10cbc729c8efca7d8
- MD5 0b631263c1d1584a0e8fc21bf3ee3093
- SHA1 2ca980a55e99bcae8927e65a13b22e927b9f8620
- SHA512 4059af60b446ff26ca1b7a70ce0a0567a323d3c037faf9d0f849bb1dcf30dea95813abc46435e0308f6c0cbe5098c1f82d87f114217eb6cdd33d17b14fdf98f9
- SSDEEP 3072:5jZ8yFFYIzNBapJw/pV2JdqLVZjHAhQ+IgNo36J3BJicSyt:bEESJdqJZjHCO36ZRt
- TLSH T14A24F95272E440D0E3A963398522DA99EAB17C26976193CF8350767A1F33BD39C3B31D
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
11:4f:b5:d4:7a:3f:27:88:10:da:86:17:aa:78:3e:77:b5:91:bf:5e:96:15:26:d0:e2:bf:dc:ed:f3:dd:31:f4
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:86:e7:71:94:b9:4d:ff:09:fb:00:00:00:00:00:86
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:3303-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0f:57:9a:47:14:40:e6:46:e6:00:01:00:00:02:0f
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
104000
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
TopoEdit.pdb
kernel32
SetEvent
ResetEvent
WaitForSingleObject
CreateEventW
CreateThread
GetCurrentThreadId
FindResourceExW
FreeLibrary
LeaveCriticalSection
LoadLibraryExW
LoadResource
LockResource
SizeofResource
LocalFree
FormatMessageW
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
DelayLoadFailureHook
EnterCriticalSection
HeapSetInformation
SetLastError
GetLastError
RaiseException
CloseHandle
GetFileTime
GetModuleFileNameW
CreateFileW
ResolveDelayLoadedAPI
gdi32
MoveToEx
SelectObject
LineTo
CreateSolidBrush
CreatePen
DeleteObject
CreateFontIndirectW
Rectangle
user32
UpdateWindow
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
GetClientRect
GetWindowRect
MessageBoxW
GetWindowLongPtrW
SetWindowLongPtrW
LoadCursorW
DestroyAcceleratorTable
GetParent
GetFocus
SetCapture
EnableMenuItem
BeginPaint
EndPaint
GetSysColor
FillRect
SetClassLongPtrW
LockWindowUpdate
LoadAcceleratorsW
KillTimer
LoadStringW
SetTimer
GetActiveWindow
LoadMenuW
SendDlgItemMessageW
SetDlgItemTextW
GetDlgItem
EndDialog
ReleaseCapture
TranslateAcceleratorW
DialogBoxParamW
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetClassInfoExW
RegisterClassExW
CallWindowProcW
PostQuitMessage
DefWindowProcW
PostMessageW
SendMessageW
DispatchMessageW
LoadIconW
TranslateMessage
GetMessageW
api-ms-win-crt-string-l1-1-0
memset
wcscmp
api-ms-win-crt-runtime-l1-1-0
_initterm
_initterm_e
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-private-l1-1-0
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_new_mode
_o__wcsicmp
_o__wtoi
_o__wtol
_o_calloc
_o_exit
_o_free
_o_malloc
_o_terminate
_o_wcscpy_s
_o_wcstoul
_o_wmemcpy_s
__C_specific_handler
__current_exception
__current_exception_context
memmove
memcpy
_o__cexit
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___p__commode
_o___stdio_common_vswprintf
wcschr
_o__set_fmode
tedutil
TEDGetAttributeType
TEDCreateMediaTypeViewer
TEDCreateDataLoader
TEDCreateTopoViewer
TEDMTStringFromGUID
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeCategory
api-ms-win-core-com-l1-1-0
PropVariantClear
CoInitializeEx
CoCreateInstance
IIDFromString
StringFromGUID2
CoTaskMemFree
CoUninitialize
api-ms-win-core-synch-l1-1-0
DeleteCriticalSection
InitializeCriticalSection
api-ms-win-core-heap-l1-1-0
HeapReAlloc
HeapAlloc
HeapFree
GetProcessHeap
HeapSize
HeapDestroy
api-ms-win-core-memory-l1-1-0
VirtualFree
VirtualAlloc
api-ms-win-core-processthreads-l1-1-0
GetCurrentProcess
GetStartupInfoW
TerminateProcess
GetCurrentProcessId
api-ms-win-core-libraryloader-l1-2-0
GetProcAddress
LoadLibraryExA
GetModuleHandleW
api-ms-win-core-util-l1-1-0
EncodePointer
DecodePointer
api-ms-win-core-processthreads-l1-1-1
IsProcessorFeaturePresent
FlushInstructionCache
api-ms-win-core-interlocked-l1-1-0
InterlockedPopEntrySList
InterlockedPushEntrySList
InitializeSListHead
api-ms-win-core-profile-l1-1-0
QueryPerformanceCounter
api-ms-win-core-sysinfo-l1-1-0
GetSystemTimeAsFileTime
api-ms-win-core-rtlsupport-l1-1-0
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
api-ms-win-core-debug-l1-1-0
IsDebuggerPresent
api-ms-win-core-errorhandling-l1-1-0
SetUnhandledExceptionFilter
UnhandledExceptionFilter
mf
MFCreateTopology
MFCreateMediaSession
MFEnumDeviceSources
MFTranscodeGetAudioOutputAvailableTypes
MFCreateTranscodeTopology
MFCreateTranscodeProfile
MFCreateTopoLoader
MFCreateVideoRendererActivate
MFCreateAudioRendererActivate
MFRequireProtectedEnvironment
MFGetService
MFCreateTopologyNode
MFCreatePMPMediaSession
mfplat
MFCreateSourceResolver
MFTEnumEx
MFCreateMediaType
MFCreateAttributes
MFStartup
MFShutdown
MFInvokeCallback
MFCreateAsyncResult
wmvcore
WMCreateReader
Name
.text
Size
104KB
Virtual Size
102KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
24KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.didat
Size
4KB
Virtual Size
80B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
52KB
Virtual Size
49KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
664B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=50, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=15, id=257, version=33145,
count=1253, id=1, productName=Unmarked objects,
count=5, id=265, version=33145,
count=39, id=261, version=33145,
count=1, id=253, version=33145,
count=15, id=260, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
tedutil.dll
- IMPHASH 39b0bd9748acd71fb72fec4f3cd30e6f
- SHA256 83cfa06e84360705a2fdfa332a8324e37dd9be45f23e37fa4a4a557f46e078f2
- MD5 24d21f9c82d4c8525fe473d125afa223
- SHA1 88ed135a0b687f9b2c90d54f7ca33e5cde3e9e4e
- SHA512 8e0a8644a3ad21195bd40785161f662692b899a3fd229e08e7dc653b4b8fcd2b2164b562e9b445e89c9d0079b03ca6a6e5115604317f5374cb0b1658fdf18f6e
- SSDEEP 3072:Qqmc7LsppHxb1WhINEBkofoLmT5Onk6lsPGBIejgFm8MChYXfMFiroBRl/XmFMff:Qqmc7LcoALC5Onk6lsPGBIejgFm8MChE
- TLSH T139A357456575BCB8C526803E9207632293B23C4DC3316667BAE9DD243F97F606B2E7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetExitCodeProcess
GetFileAttributesA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
RemoveVectoredExceptionHandler
SetThreadPriority
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
lstrcatA
lstrcpyA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
api-ms-win-crt-private-l1-1-0
__intrinsic_setjmpex
longjmp
memcpy
strrchr
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
calloc
free
DllCanUnloadNow
DllGetClassObject
DllRegisterServer
DllUnregisterServer
TEDCreateDataLoader
TEDCreateDataSaver
TEDCreateMediaTypeViewer
TEDCreateTopoViewer
TEDCreateTopoViewerWindow
TEDGetAttributeCategory
TEDGetAttributeGUID
TEDGetAttributeListLength
TEDGetAttributeName
TEDGetAttributeType
TEDGetAttributeTypeFromGUID
TEDGetMTKnownAttributes
TEDGetMTKnownGUIDStrings
TEDMTStringFromGUID
Name
.text
Size
75KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
22KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
924B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
864B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=3, id=257, version=34760,
count=1, id=262, version=34760,
count=10, id=270, version=34760,
count=1, id=260, version=34760,
count=25, id=1, productName=Unmarked objects,
count=5, id=271, version=34760,
count=1, id=259, version=34760,