1.img
- SHA256 89b23dc306893ba1cb0f2ddcbe44948421eb57a657210363c75ee9f610798eef
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
libcef.dll
Resource
win10v2004-20260911-ja
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
libcef.dll
Resource
win11ltsc2024-20260911-ja
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
税金_ペナルティ通知.read .exe
Resource
win10v2004-20260911-ja
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
税金_ペナルティ通知.read .exe
Resource
win11ltsc2024-20260911-ja
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target 1.img
- Size 4.7MB
- Sample261009-p17e2aba82
- SHA256 89b23dc306893ba1cb0f2ddcbe44948421eb57a657210363c75ee9f610798eef
- MD5 9f2d84c3145284488a14115c3b35ddfe
- SHA1 89e5ea6a24834b61b455f24a708abe673b9e943b
- SHA512 d38822345873f418908230e5cac8b83df98fdeb45303d6d15f1d3fd303beab0009e7d551c90346c8fe39755eb5381d4fc3943ba07e2d9b270e007e66db535b79
- SSDEEP 98304:2M1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1L:2M1z1z1z1z1z1z1z1z1z1z1z1z1z1z1L
- TLSH T1A636E10211A214B0D3D1CEB44A27EA86D23D7D3BAF67629F8315E7672B377D9843621C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/libcef.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/libcef.dll
File Explorer
-
1.img.iso 4.7MB
-
out.iso.iso 4.7MB
-
libcef.dll.dll 3.7MB
-
log.bin454KB
-
税金_ペナルティ通知.read .exe.exe 486KB
out.iso
- SHA256 89b23dc306893ba1cb0f2ddcbe44948421eb57a657210363c75ee9f610798eef
- MD5 9f2d84c3145284488a14115c3b35ddfe
- SHA1 89e5ea6a24834b61b455f24a708abe673b9e943b
- SHA512 d38822345873f418908230e5cac8b83df98fdeb45303d6d15f1d3fd303beab0009e7d551c90346c8fe39755eb5381d4fc3943ba07e2d9b270e007e66db535b79
- SSDEEP 98304:2M1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1L:2M1z1z1z1z1z1z1z1z1z1z1z1z1z1z1L
- TLSH T1A636E10211A214B0D3D1CEB44A27EA86D23D7D3BAF67629F8315E7672B377D9843621C
- MD5 SHA1 SHA512 SSDEEP TLSH
libcef.dll
- IMPHASH a4afec995f6267cee35b763a96e27abb
- SHA256 54898b02fac2c7651c44dc24aa1367b8a91a3a562dc7744311db5cca0b1dc3b5
- MD5 1be6ebb740e1f808dc4d5d6f7620913b
- SHA1 e0ca0e1594391512d5a5fb71600c03d662b098ec
- SHA512 a0926aa1b9812790405a7453e1d9bcc0f4d6c072152e3529675687bcca6c4e20a41d8a5a41e31d53e7d7e8ad0169e98650009c1c899531138d7d9739792332fe
- SSDEEP 98304:XM1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1z1R:XM1z1z1z1z1z1z1z1z1z1z1z1z1z1z1R
- TLSH T11506E04211A35931E7C1CEB48E6BBBD6C26DB23FEC6B21298316CA6737673CD906151C
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
11300
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcessHeap
WaitForSingleObject
CreateEventW
Sleep
GetCurrentProcess
ExitProcess
TerminateProcess
CreateProcessW
InitializeProcThreadAttributeList
DeleteProcThreadAttributeList
UpdateProcThreadAttribute
GetTickCount
GetSystemDirectoryW
GetWindowsDirectoryW
HeapFree
VirtualFree
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetProcAddress
LocalAlloc
LocalFree
CopyFileA
CopyFileW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
WriteConsoleW
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
GetLastError
CloseHandle
DebugActiveProcessStop
WaitForDebugEvent
ContinueDebugEvent
IsDebuggerPresent
WriteFile
FindClose
CreateFileW
CreateFileA
HeapReAlloc
VirtualAlloc
CreateDirectoryW
HeapSize
GetConsoleOutputCP
FlushFileBuffers
SetStdHandle
GetStringTypeW
LCMapStringW
FlsFree
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ReadFile
GetModuleHandleExW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetStdHandle
GetFileType
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
FlsAlloc
FlsGetValue
FlsSetValue
user32
wsprintfW
advapi32
CreateWellKnownSid
OpenProcessToken
RegOpenKeyExW
RegEnumValueW
RegCloseKey
GetUserNameW
GetTokenInformation
rpcrt4
RpcBindingSetAuthInfoExW
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
NdrOleFree
NdrAsyncClientCall
RpcAsyncCompleteCall
RpcAsyncInitializeHandle
UuidFromStringW
NdrOleAllocate
RpcStringFreeW
slwga
SLIsGenuineLocal
ntdll
NtCreateFile
cef_api_hash
cef_command_line_create
cef_enable_highdpi_support
cef_execute_process
cef_log
cef_post_task
cef_process_message_create
cef_string_list_alloc
cef_string_list_append
cef_string_list_free
cef_string_list_size
cef_string_list_value
cef_string_map_alloc
cef_string_map_append
cef_string_map_free
cef_string_map_key
cef_string_map_size
cef_string_map_value
cef_string_multimap_alloc
cef_string_multimap_append
cef_string_multimap_free
cef_string_multimap_key
cef_string_multimap_size
cef_string_multimap_value
cef_string_userfree_utf16_free
cef_string_utf16_clear
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf8_clear
cef_string_utf8_to_utf16
cef_v8context_get_current_context
cef_v8value_create_bool
cef_v8value_create_function
cef_v8value_create_int
cef_v8value_create_string
Name
.text
Size
73KB
Virtual Size
72KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
42KB
Virtual Size
41KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3.6MB
Virtual Size
3.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gehcont
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=147, id=261, version=30795,
count=7, id=259, version=30795,
count=11, id=260, version=30795,
count=14, id=260, version=26706,
count=8, id=259, version=26706,
count=34, id=261, version=26706,
count=17, id=257, version=30795,
count=154, id=1, productName=Unmarked objects,
count=2, id=261, version=27054,
count=1, id=256, version=27054,
count=1, id=255, version=27054,
count=1, id=258, version=27054,
log.bin
- SHA256 b5eb6f71169549786b022afd5e23050482b9f0a442c148af282cd5bd6ce8ac79
- MD5 48a0f9510768d4494e9f1eb894a7cb55
- SHA1 ef92b8b49daf834eb517c44046d43acc785b4ab0
- SHA512 72191f62cbcf2169051126854d1068801e467438c1f9977c4d0cb60f0981a8b4dc51f5da8b4d156d39d09776a1ee784fc48a6cd966e396588c907c3943077528
- SSDEEP 12288:hK09BtmA9mzo3MeoZ/B2OIP3N6Tsq133KnS:J96A9mzOgIP3N6/HKnS
- TLSH T18FA4233245C43180CACF99AA729C9F1D6CBB426AEDF39D00B9570BA50C964B8FF4952D
- MD5 SHA1 SHA512 SSDEEP TLSH
税金_ペナルティ通知.read .exe
- IMPHASH c42ad6942cd5fa2d2f0f55982a31e735
- SHA256 8bcf152a92e210dcdff549d4ba6758d0f59db93418d2289be1db9df8a01be69f
- MD5 6a9f578e4c2238c599a30269451e5ed2
- SHA1 0a4417004920d1dc6bb38187c2899ac6899a0314
- SHA512 b29728cf0f3678062c7cc367ec63a0b5667eae06c78b0f0ac57577152613e49b4727c5c047502ff07f5dee82b3ca34c88eff6c78b870546c9e04d5344b087fd3
- SSDEEP 6144:l5kt7s8YVrRLAdls9x+DynmwDknfrfWztohDyOQmUTrp8U:7ktpYVrylM++7DUbitoaOU
- TLSH T15EB4180AA2A814D0E3B9D73C4652C94AE3717D2A0351E6CF91A877665F33BE19D3F318
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
46:a8:49:4b:16:af:e7:14:0a:5d:11:8b:62:20:96:c3:38:ab:18:0a:56:e2:08:d3:2b:c4:2b:3c:9e:32:11:03
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Chains
Jul 29, 2024
SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
SERIALNUMBER=91330000788831167A,CN=NetEase (Hangzhou) Network Co.\, Ltd,O=NetEase (Hangzhou) Network Co.\, Ltd,L=杭州市,ST=浙江省,C=CN,1.3.6.1.4.1.311.60.2.1.2=#0c09e6b599e6b19fe79c81,1.3.6.1.4.1.311.60.2.1.3=#1302434e,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e
Serial Number
02:44:53:70:9c:84:72:5b:99:03:71:85:6b:0e:50:e0
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 27, 2021 - Oct 23, 2024
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
229360
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
libcef
cef_v8value_create_bool
cef_v8value_create_int
cef_string_multimap_append
cef_v8value_create_string
cef_v8value_create_function
cef_string_multimap_value
cef_string_multimap_key
cef_string_multimap_size
cef_string_map_append
cef_string_map_value
cef_string_map_key
cef_string_map_size
cef_string_list_append
cef_string_list_value
cef_string_list_size
cef_enable_highdpi_support
cef_string_multimap_free
cef_string_multimap_alloc
cef_process_message_create
cef_execute_process
cef_post_task
cef_api_hash
cef_command_line_create
cef_string_map_free
cef_string_map_alloc
cef_string_list_free
cef_string_list_alloc
cef_string_userfree_utf16_free
cef_log
cef_v8context_get_current_context
cef_string_utf16_cmp
cef_string_utf16_set
cef_string_utf16_to_utf8
cef_string_utf8_to_utf16
cef_string_utf16_clear
cef_string_utf8_clear
kernel32
WriteConsoleW
GetOEMCP
GetCommandLineA
GetACP
IsValidCodePage
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetProcessHeap
FlushFileBuffers
CreateFileW
FindNextFileW
FindFirstFileExW
FindClose
SetFilePointerEx
GetConsoleOutputCP
GetConsoleMode
LCMapStringW
HeapReAlloc
GetFileType
HeapFree
HeapAlloc
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
WriteFile
GetStdHandle
LoadLibraryExW
GetCommandLineW
GetModuleHandleW
GetProcAddress
GetLastError
SetLastError
HeapSize
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
CreateEventW
CloseHandle
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
GetSystemTimeAsFileTime
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
MultiByteToWideChar
DecodePointer
EncodePointer
InitializeCriticalSectionEx
WideCharToMultiByte
QueryPerformanceCounter
Name
.text
Size
294KB
Virtual Size
294KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
101KB
Virtual Size
101KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
19KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
348B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
49KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
6KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=11, id=259, version=30795,
count=173, id=261, version=30795,
count=19, id=260, version=30795,
count=17, id=260, version=31328,
count=10, id=259, version=31328,
count=86, id=261, version=31328,
count=16, id=257, version=30795,
count=3, productName=Unmarked objects (old),
count=431, id=1, productName=Unmarked objects,
count=233, id=261, version=31342,
count=1, id=255, version=31342,
count=1, id=258, version=31342,