5005be9940b3ebb29ad2b16d0a2eb2292da921b78a72a614d347ba2048ae78ef
- SHA256 5005be9940b3ebb29ad2b16d0a2eb2292da921b78a72a614d347ba2048ae78ef
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
115年度預定稅務查核企業名單.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
event.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral3
Sample
event.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
13 signatures
150 seconds
General
- Target 5005be9940b3ebb29ad2b16d0a2eb2292da921b78a72a614d347ba2048ae78ef
- Size 130KB
- Sample260930-j4lpvaysev
- SHA256 5005be9940b3ebb29ad2b16d0a2eb2292da921b78a72a614d347ba2048ae78ef
- MD5 4cad8b988171a0d346d1b2e61c0275af
- SHA1 48c1b7dc94fe0f9f50956dc4c9d475cb1acb904b
- SHA512 b63ae5830efa7614d99c8e2d35a131465d38fba0d3d05939c637d7f4755a05b03142ef3a99f4c27a8e45a8c810ec6350843afb741726fbb64d42f49cea218133
- SSDEEP 3072:Qmp8+N49ljdiw7fqTe4SWkj3nt4BbRGv81UFDcFa:rGFi+fHTubEka
- TLSH T114D312F898924787EB62659A3F8AB9EF3B36C5B044910C7B1B147359DFB44DB112078C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/event.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/event.dll
File Explorer
-
5005be9940b3ebb29ad2b16d0a2eb2292da921b78a72a614d347ba2048ae78ef.zip 130KB
-
115年度預定稅務查核企業名單.exe.exe 250KB
-
event.dll.dll 101KB
115年度預定稅務查核企業名單.exe
- IMPHASH d2c7f1b09ad06bb84f38f71b7be8f299
- SHA256 abcb44b459e9f101106251bb9b4b7a07163554af450d0e61636417d12499cf2f
- MD5 aeb22262cc2114f611c92eb062b34da3
- SHA1 0bacc5bfbfeac8bade04d085e995d8c7f31c5f7c
- SHA512 46fe4d42aacdc0ad9a3da270238ea982bed1af30478e5cdddce7fea8e04d49d0eb6db1c6275bc4eae5677c4b0bd371864eb1191ff6d4af9dbf507771469c9215
- SSDEEP 6144:fK3jQoHr3VF2mjkaRGP4PkhijsKgW3UMKYMKBbZixsN:fKEoJF2mjkabsKgW3/m8
- TLSH T13044A11237F810D5F1B69679AAB58512E7B2BC662B25C7CF1260016E9F73BD0AC34732
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
1d:27:43:2a:6a:6f:ed:4e:36:56:14:16:8c:f6:d1:b5:59:1d:74:fc:d2:e5:4d:4e:17:b2:f8:c8:59:cd:b4:4a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jan 27, 2026
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Serial Number
33:00:00:00:1c:48:9f:81:df:a1:b0:b7:77:00:00:00:00:00:1c
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 8, 2024 - Jun 23, 2035
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:87:bc:82:6e:85:a1:ae:53:a8:00:00:00:00:00:87
Issuer
CN=Microsoft Windows Code Signing PCA 2024,O=Microsoft Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
May 8, 2025 - May 6, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:A935-03E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0c:b9:64:e3:35:9c:ec:f4:ae:00:01:00:00:02:0c
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
10
Entry point
87680
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
AccEvent.pdb
advapi32
OpenProcessToken
GetTokenInformation
EventRegister
EventUnregister
EventWriteTransfer
RegOpenKeyW
RegCreateKeyW
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegOpenKeyExW
RegQueryValueExW
kernel32
InitOnceBeginInitialize
InitOnceComplete
SetEvent
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
CreateEventW
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcessId
CreateThread
GetCurrentThreadId
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
GetModuleFileNameA
FormatMessageW
WideCharToMultiByte
InitializeCriticalSectionEx
GetModuleFileNameW
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
DeleteCriticalSection
GetModuleHandleW
AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
LocalAlloc
LocalFree
GetCommandLineW
CreateFileW
GetProcessHeap
HeapFree
HeapAlloc
SetLastError
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount
lstrlenW
GetLastError
OutputDebugStringW
DebugBreak
WriteFile
IsDebuggerPresent
lstrcmpiW
MulDiv
GetProcAddress
GetModuleHandleExW
CloseHandle
FreeLibrary
GetCurrentProcess
HeapSetInformation
ResetEvent
gdi32
DeleteObject
GetStockObject
CreateRectRgn
CombineRgn
LineTo
SelectObject
SetBkColor
SetTextColor
MoveToEx
CreateSolidBrush
GetTextMetricsW
GetDeviceCaps
CreateFontW
user32
GetDlgItem
PostMessageW
RegisterWindowMessageW
SystemParametersInfoW
LoadCursorW
IsRectEmpty
SetRectEmpty
MessageBoxW
GetWindowRect
SetWindowTextW
GetDC
UpdateWindow
DeleteMenu
ModifyMenuW
EnableMenuItem
CheckMenuItem
LoadMenuW
SetWindowPlacement
TranslateAcceleratorW
LoadAcceleratorsW
SetFocus
IsIconic
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExW
GetDesktopWindow
RegisterClassW
GetSystemMetrics
DrawTextW
SetWindowRgn
InvalidateRect
MapWindowPoints
FillRect
GetWindowLongPtrW
SetWindowLongPtrW
GetCursorPos
PostThreadMessageW
PeekMessageW
ReleaseDC
RegisterClassExW
PostQuitMessage
DefWindowProcW
SendMessageW
DispatchMessageW
TranslateMessage
GetMessageW
LoadStringW
SetDlgItemTextW
EndDialog
DialogBoxParamW
wsprintfW
EnableWindow
LoadIconW
GetClientRect
msvcrt
free
malloc
wcsstr
_CxxThrowException
__CxxFrameHandler3
memset
memcpy
_purecall
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_acmdln
__C_specific_handler
_initterm
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
_callnewh
memcmp
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
_vsnwprintf
memcpy_s
memmove_s
oleacc
GetStateTextW
GetRoleTextW
ole32
CoInitializeEx
CoCreateInstance
CoUninitialize
CoGetInterfaceAndReleaseStream
CoTaskMemFree
CoMarshalInterThreadInterfaceInStream
CoInitialize
oleaut32
VariantInit
SafeArrayGetVartype
SafeArrayUnaccessData
SafeArrayAccessData
VariantClear
SafeArrayDestroy
SafeArrayGetUBound
SafeArrayGetDim
SysAllocString
SysStringLen
SysFreeString
SafeArrayGetLBound
shell32
ShellExecuteW
comdlg32
GetSaveFileNameW
comctl32
ord17
version
GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW
event
InstallEventHook
DoSettingsDialog
Name
.text
Size
112KB
Virtual Size
111KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
fothk
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
72KB
Virtual Size
69KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
28KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
8KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
8KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=5, id=259, version=33145,
count=26, id=260, version=33145,
count=27, id=257, version=33145,
count=224, id=1, productName=Unmarked objects,
count=24, id=261, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
event.dll
- IMPHASH 39b0bd9748acd71fb72fec4f3cd30e6f
- SHA256 369fdbd5cb5b0b64537c4cada9e6f3bff936d73f638cbe6bbd2d4db9f882b053
- MD5 141b1552293f66024dc18feac7933d6e
- SHA1 2f9a957d696f56436adfb1d321c1115fe0f87009
- SHA512 83e4b3859c48929d45543130a69668cd46f042cff4367f21a977548821d362b44aa8692986b4d0ab179c84365deecbbfcbbafaa9be9b6c058495c23cfaad4b34
- SSDEEP 3072:2geqWBi+HscwIiCRnTKfsdDmf8FSrXihYLSV9eXYByYP21sD8ohWP8JqDmrC:2amKUVmf8FSrXihYLSV9eXYByYP21sD2
- TLSH T15FA324456574BCB8C526803D9207632253B23C4DC33266A7AAE5DE243F97FA06B3D7E1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateThread
DeleteCriticalSection
DisableThreadLibraryCalls
DuplicateHandle
EnterCriticalSection
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetExitCodeProcess
GetFileAttributesA
GetLastError
GetModuleFileNameA
GetModuleHandleA
GetProcAddress
InitializeCriticalSection
LeaveCriticalSection
MultiByteToWideChar
RemoveVectoredExceptionHandler
SetThreadPriority
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
lstrcatA
lstrcpyA
advapi32
RegCloseKey
RegOpenKeyExA
RegQueryInfoKeyA
api-ms-win-crt-private-l1-1-0
__intrinsic_setjmpex
longjmp
memcpy
strrchr
api-ms-win-crt-runtime-l1-1-0
_execute_onexit_table
_exit
_initialize_onexit_table
_initterm
_initterm_e
_register_onexit_function
abort
api-ms-win-crt-string-l1-1-0
memset
strlen
strncmp
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
__stdio_common_vfprintf
api-ms-win-crt-heap-l1-1-0
calloc
free
DoSettingsDialog
InstallEventHook
Name
.text
Size
74KB
Virtual Size
74KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
22KB
Virtual Size
21KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
732B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
160B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=260, version=34307,
count=1, id=262, version=34307,
count=8, id=270, version=34307,
count=1, id=259, version=34307,
count=8, id=1, productName=Unmarked objects,
count=1, id=257, version=34307,
count=1, id=271, version=34307,