New Tax Filing Regulations.iso
- SHA256 832034bf8ace35b74d62eb0b114134778a128cfb1b8af1f2ec67310f01ff4175
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
New Tax Filing Regulations.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
New Tax Filing Regulations.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
Behavioral task
behavioral3
Sample
VSPMsg.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
16 signatures
150 seconds
Behavioral task
behavioral4
Sample
VSPMsg.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
16 signatures
150 seconds
General
- Target New Tax Filing Regulations.iso
- Size 768KB
- Sample261014-pmesvsvwev
- SHA256 832034bf8ace35b74d62eb0b114134778a128cfb1b8af1f2ec67310f01ff4175
- MD5 310fdaa120c224aff19199f823a756bd
- SHA1 8395c90821bbb8bbb4ea13bc08378b5b13af72b3
- SHA512 814b0ac79268ef603f8d30c573f1111b95d6a8e84d6a5c05231f1f1323aa4b94ed9d9f292d4cd9b8b6e9787e097ed76a200ed5cb5416b1168848863ff7ef8f1d
- SSDEEP 12288:sKTr92i/qCDrWz88MsbP0cyWaQ8ck8cLqR9TjxSJrX:BVyuWg8Mk7Qck8cLG9TjxSJ
- TLSH T1DBF4D04AF7A459FAE0AAC138C9538506E7727C8A0761D79F33AC466B2F232E05D3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/VSPMsg.dll
File Explorer
-
New Tax Filing Regulations.iso.iso 768KB
-
out.iso.iso 768KB
-
New Tax Filing Regulations.exe.exe 367KB
-
VSPMsg.dll.dll 348KB
out.iso
- SHA256 832034bf8ace35b74d62eb0b114134778a128cfb1b8af1f2ec67310f01ff4175
- MD5 310fdaa120c224aff19199f823a756bd
- SHA1 8395c90821bbb8bbb4ea13bc08378b5b13af72b3
- SHA512 814b0ac79268ef603f8d30c573f1111b95d6a8e84d6a5c05231f1f1323aa4b94ed9d9f292d4cd9b8b6e9787e097ed76a200ed5cb5416b1168848863ff7ef8f1d
- SSDEEP 12288:sKTr92i/qCDrWz88MsbP0cyWaQ8ck8cLqR9TjxSJrX:BVyuWg8Mk7Qck8cLG9TjxSJ
- TLSH T1DBF4D04AF7A459FAE0AAC138C9538506E7727C8A0761D79F33AC466B2F232E05D3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
New Tax Filing Regulations.exe
- IMPHASH 0fe2dbc3c552fce90abf4316acc494a0
- SHA256 a150614db8802e3700db945c42f7e9c2fb03cfdcbea7854b0b072a2e35a11b77
- MD5 d455b3b0529d73929fb2f2ecd43b4f75
- SHA1 934549d96c0d836579d0ffd0d8c580ecbcd87b65
- SHA512 b490795b2bf54e1edb0d1f7075cf9c58fc7255e0ecef0ebce499ad42945700e2237421196f57880b92f7e3d036ee9b95354c9157d3f3b3a9a7fd65ff7d9c0952
- SSDEEP 6144:UK0CMcoPY19CebAiwu6B36NDrd8zzJ6aFMMkxGbP0cw:UKTr92i/qCDrWz88MsbP0cw
- TLSH T1EC849D46F7A418F5E0A7C139C9628906E7727C9A0770CBCF23A4466B2F272E15D3D762
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
59:cc:05:a4:75:9f:4e:a3:9a:9b:ac:7e:00:6c:ae:e6:6a:5f:da:d9:32:76:0f:e1:03:22:e1:42:bf:40:a5:7d
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Apr 15, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:04:04:6c:74:06:ff:57:2b:27:72:00:00:00:00:04:04
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Sep 12, 2024 - Sep 11, 2025
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Subject
CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:E002-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:02:0b:11:9d:56:29:92:f9:bf:85:00:01:00:00:02:0b
Issuer
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jan 30, 2025 - Apr 22, 2026
Subject
CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15
Issuer
CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Sep 30, 2021 - Sep 30, 2030
Minor OS version
0
Major OS version
6
Entry point
122992
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\dbs\el\ddvsm\out\binaries\amd64ret\bin\amd64\VSPerfCmd.pdb
advapi32
GetAce
GetAclInformation
GetSecurityDescriptorDacl
GetSecurityInfo
RegOpenKeyExA
IsValidSid
RegQueryValueExA
RegCloseKey
GetExplicitEntriesFromAclA
ConvertStringSecurityDescriptorToSecurityDescriptorW
IsValidSecurityDescriptor
GetNamedSecurityInfoW
GetSecurityDescriptorSacl
SetSecurityDescriptorOwner
GetSecurityDescriptorGroup
RegCreateKeyExW
GetSecurityDescriptorOwner
SetSecurityDescriptorSacl
RegSetValueExW
InitializeSecurityDescriptor
MapGenericMask
SetSecurityDescriptorGroup
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
GetTokenInformation
IsTextUnicode
SetSecurityDescriptorDacl
SetEntriesInAclA
GetSidSubAuthorityCount
GetSidSubAuthority
GetSidLengthRequired
SetNamedSecurityInfoW
GetSecurityDescriptorControl
SetSecurityInfo
IsValidAcl
GetSecurityDescriptorLength
LookupAccountSidW
MakeSelfRelativeSD
LookupAccountNameW
MakeAbsoluteSD
GetSidIdentifierAuthority
CreateServiceW
QueryServiceStatus
CloseServiceHandle
QueryServiceConfigA
OpenSCManagerA
DeleteService
ChangeServiceConfigA
ControlService
StartServiceA
OpenServiceW
kernel32
CreateSemaphoreA
OpenSemaphoreA
CreateMutexA
SetNamedPipeHandleState
WaitNamedPipeA
CreateFileA
MapViewOfFileEx
CreateFileMappingW
CreateEventW
GetVersion
DuplicateHandle
ReleaseMutex
CreateMutexW
ExpandEnvironmentStringsW
CreateProcessW
WaitForMultipleObjects
GetUserDefaultUILanguage
FindFirstFileA
GetModuleFileNameA
PeekNamedPipe
CreatePipe
CreateEventA
ResetEvent
SetEvent
MapViewOfFile
SetUnhandledExceptionFilter
HeapSetInformation
GetProcAddress
LocalAlloc
GetTickCount
GetModuleHandleW
GetCurrentProcessId
SwitchToThread
RaiseException
OpenMutexA
Sleep
ProcessIdToSessionId
MultiByteToWideChar
OpenProcess
CreateFileW
WaitForSingleObject
GetLocaleInfoW
GetModuleFileNameW
DeviceIoControl
SetLastError
GetSystemDefaultLCID
OpenEventA
FindResourceW
LoadResource
FindResourceExW
CloseHandle
LockResource
GetModuleHandleA
GetEnvironmentVariableW
SizeofResource
GetProcessHeap
DeleteCriticalSection
LocalFree
HeapDestroy
HeapAlloc
HeapReAlloc
GetVersionExA
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
CompareStringW
TlsAlloc
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetFileType
LCMapStringW
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
WriteConsoleW
FindFirstFileW
InitializeCriticalSection
GetConsoleScreenBufferInfo
WriteConsoleA
FormatMessageW
GetConsoleWindow
FormatMessageA
GetSystemInfo
GetFileAttributesW
LoadLibraryA
QueryPerformanceFrequency
LoadLibraryW
GetDriveTypeW
GetFileSize
VirtualAlloc
VirtualUnlock
UnmapViewOfFile
VirtualLock
CreateFileMappingA
OpenFileMappingA
vspmsg
SetErrorMessageModule
GetErrorMessageModule
user32
IsWindowVisible
ole32
CoUninitialize
CoCreateInstance
CLSIDFromString
CoInitialize
CoInitializeEx
oleaut32
SysAllocStringLen
SysAllocString
SysFreeString
setupapi
SetupDiSetClassRegistryPropertyA
SetupDiGetClassRegistryPropertyA
shlwapi
SHCreateStreamOnFileW
PathAddBackslashW
PathAppendW
PathRemoveFileSpecW
pdh
PdhLookupPerfNameByIndexW
xmllite
CreateXmlReader
Name
.text
Size
250KB
Virtual Size
249KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
83KB
Virtual Size
83KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=262, version=27412,
count=2, id=257, version=34440,
count=2, id=259, version=34440,
count=12, id=260, version=27412,
count=5, id=259, version=27412,
count=157, id=261, version=27412,
count=9, id=259, version=34321,
count=19, id=260, version=34321,
count=52, id=261, version=34321,
count=21, id=257, version=27412,
count=242, id=1, productName=Unmarked objects,
count=55, id=265, version=34440,
count=1, id=255, version=34440,
count=1, id=258, version=34440,
VSPMsg.dll
- IMPHASH 4b310cf5f49fbd68df19bc5f60e2189f
- SHA256 008c571e964f6ca718f5ae483c71ca5c19d9251821156e3f8910af395c6c10f8
- MD5 e9bf2dc3a51626f0deaaade490e895d3
- SHA1 8b1aa946bd16467a8beeb3cc22bd7e134914be66
- SHA512 d895c93601f459d5b2fb7aedf68bfdd48b36dc8836647aa10fd7e4a460cd7e09a8e2a8379daaa47b7f6ec5ad66d08c63776714a12fc0007230fce0bb9474bf9e
- SSDEEP 6144:lFhP4JAitXUoAZusGk8DgLuHbRhPph4X+13GB3z92n1EnJX:nWaQ8ck8cLqR9TjxSJrX
- TLSH T19D74121EDB42E6EFEC985534DD5B52AB962EE8840595703D53EC253FDCB0ABC243CA08
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
4784
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
kernel32
GetProcessHeap
HeapAlloc
HeapFree
GetModuleHandleA
LoadLibraryExW
GetProcAddress
GetLocalTime
GlobalMemoryStatusEx
GetTickCount
LoadLibraryA
FreeLibrary
CreateMutexW
CloseHandle
GetSystemInfo
GetErrorMessageModule
SetErrorMessageModule
Name
.text
Size
21KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.cdata
Size
318KB
Virtual Size
318KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.sdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rodata
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rdata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ