tax-documents_7[.]img

Sharing

Copy URL Twitter E-mail

General

Target
tax-documents_7.img
Size 10.9MB
Sample261029-145ldsfs8x
SHA256 68370cd8b70f90786a0b106cfc001c90a49c8dd407f60e9cd703de5dee4209e5
MD5 2e181539b3e1ec8a5a3e225b95c75202
SHA1 ffe486343b656713cff88120d8d943df56109df7
SHA512 a5d7af5d40a8d94d50ace23721c8f27d62d52be85ae1aae4f49c5ce1e24bf46da12f4ffce112700a1f84c1fd4409d4a7d5e55a04ba98dd6ef198a5763a16e864
SSDEEP 98304:WCE4Rhep0+YM+aADQX4xcELw34Ldlhf9PJNgb5j6HBT+TXqRDPb/FpNSykeEpW22:04Rq0+YM+HMflcDhlPbijY8X+/zkf2
TLSH
T123B69CB5F1A5AC6EDC0A31BD7759A47F0BA5A2D6034902EB23F9C159CA281C44CF7E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

revoked_codesign

Malware Config

Signatures

Revoked Certificate in Chain 1 IoCs

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign

resource
unpack002/event.dll

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack002/accevent.exe

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack002/event.dll

File Explorer

tax-documents_7.img

.iso 10.9MB
out.iso

.iso 10.9MB
accevent.exe

.exe 10.7MB
event.dll

.dll 144KB

tax-documents_7.img

SHA256 68370cd8b70f90786a0b106cfc001c90a49c8dd407f60e9cd703de5dee4209e5
MD5 2e181539b3e1ec8a5a3e225b95c75202
SHA1 ffe486343b656713cff88120d8d943df56109df7
SHA512 a5d7af5d40a8d94d50ace23721c8f27d62d52be85ae1aae4f49c5ce1e24bf46da12f4ffce112700a1f84c1fd4409d4a7d5e55a04ba98dd6ef198a5763a16e864
SSDEEP 98304:WCE4Rhep0+YM+aADQX4xcELw34Ldlhf9PJNgb5j6HBT+TXqRDPb/FpNSykeEpW22:04Rq0+YM+HMflcDhlPbijY8X+/zkf2
TLSH
T123B69CB5F1A5AC6EDC0A31BD7759A47F0BA5A2D6034902EB23F9C159CA281C44CF7E4C
MD5 SHA1 SHA512 SSDEEP TLSH

accevent.exe

IMPHASH d2c7f1b09ad06bb84f38f71b7be8f299
SHA256 2a78fb704b96cfc88272ca8855b6599e663ceffadc801d488eb128b18c234954
MD5 95084247560c5fe1bb537c34e47a2fb7
SHA1 36013f4b8444cd913f8353d06cfb1f208af61ea5
SHA512 58b5f6edbd82757c1e8ac7250c6efc6ad3e610a6f4709791afaa4777d7bc1baaeec92e967dbbfd0774239f126e4e83d3620c5f319b8d34022f06463a67176501
SSDEEP 98304:FCE4Rhep0+YM+aADQX4xcELw34Ldlhf9PJNgb5j6HBT+TXqRDPb/FpNSykeEpW2:X4Rq0+YM+HMflcDhlPbijY8X+/zkf
TLSH
T16FB69CB5F1A5AC6EDC0A31BD7769A47F0BA5A2D6034902EB13F5C15AC9282C44CF7E4C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AccEvent.pdb

advapi32

OpenProcessToken GetTokenInformation EventRegister EventUnregister EventWriteTransfer RegOpenKeyW RegCreateKeyW RegCloseKey RegSetValueExW RegCreateKeyExW RegOpenKeyExW RegQueryValueExW

kernel32

InitOnceBeginInitialize InitOnceComplete SetEvent ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx CreateEventW OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId CreateThread GetCurrentThreadId CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer GetModuleFileNameA FormatMessageW WideCharToMultiByte InitializeCriticalSectionEx GetModuleFileNameW LeaveCriticalSection EnterCriticalSection AcquireSRWLockShared DeleteCriticalSection GetModuleHandleW AcquireSRWLockExclusive ReleaseSRWLockShared ReleaseSRWLockExclusive LocalAlloc LocalFree GetCommandLineW CreateFileW GetProcessHeap HeapFree HeapAlloc SetLastError Sleep GetStartupInfoW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount lstrlenW GetLastError OutputDebugStringW DebugBreak WriteFile IsDebuggerPresent lstrcmpiW MulDiv GetProcAddress GetModuleHandleExW CloseHandle FreeLibrary GetCurrentProcess HeapSetInformation ResetEvent

gdi32

DeleteObject GetStockObject CreateRectRgn CombineRgn LineTo SelectObject SetBkColor SetTextColor MoveToEx CreateSolidBrush GetTextMetricsW GetDeviceCaps CreateFontW

user32

GetDlgItem PostMessageW RegisterWindowMessageW SystemParametersInfoW LoadCursorW IsRectEmpty SetRectEmpty MessageBoxW GetWindowRect SetWindowTextW GetDC UpdateWindow DeleteMenu ModifyMenuW EnableMenuItem CheckMenuItem LoadMenuW SetWindowPlacement TranslateAcceleratorW LoadAcceleratorsW SetFocus IsIconic SetWindowPos ShowWindow DestroyWindow CreateWindowExW GetDesktopWindow RegisterClassW GetSystemMetrics DrawTextW SetWindowRgn InvalidateRect MapWindowPoints FillRect GetWindowLongPtrW SetWindowLongPtrW GetCursorPos PostThreadMessageW PeekMessageW ReleaseDC RegisterClassExW PostQuitMessage DefWindowProcW SendMessageW DispatchMessageW TranslateMessage GetMessageW LoadStringW SetDlgItemTextW EndDialog DialogBoxParamW wsprintfW EnableWindow LoadIconW GetClientRect

msvcrt

free malloc wcsstr _CxxThrowException __CxxFrameHandler3 memset memcpy _purecall ??1type_info@@UEAA@XZ ?terminate@@YAXXZ _onexit __dllonexit _unlock _lock _commode _fmode _acmdln __C_specific_handler _initterm __setusermatherr _ismbblead _cexit _exit exit __set_app_type __getmainargs _amsg_exit _XcptFilter _callnewh memcmp ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBV0@@Z ??0exception@@QEAA@XZ _vsnwprintf memcpy_s memmove_s

oleacc

GetStateTextW GetRoleTextW

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoGetInterfaceAndReleaseStream CoTaskMemFree CoMarshalInterThreadInterfaceInStream CoInitialize

oleaut32

VariantInit SafeArrayGetVartype SafeArrayUnaccessData SafeArrayAccessData VariantClear SafeArrayDestroy SafeArrayGetUBound SafeArrayGetDim SysAllocString SysStringLen SysFreeString SafeArrayGetLBound

shell32

ShellExecuteW

comdlg32

GetSaveFileNameW

comctl32

ord17

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

event

InstallEventHook DoSettingsDialog

Name

.text

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

fothk

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

28KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

event.dll

IMPHASH 0e7bc74d47353d3814c9980404ea6a98
SHA256 366e87f2b2d6a324048bd1f8b4e1736d997560eaeb0081d403ed625131ab34c0
MD5 4483c0055dd98f6aae09328dca7434dc
SHA1 485d9c82753a5f655ec62228b279a8b88f57796b
SHA512 ff19a76b445b06b29d637adc698d89e249d20510d99dbfb15d0bdac5f32e0ea00c939a2777f578e8cc5eb2afee5857355bc2a8593c916168fa9e6308afd31153
SSDEEP 3072:vmYs+2imSDbLwuGiTuZRo6cBJC4o1OEztCZZLMcArWpcetFXFRy:vtsvUFGBZRoLBJCzQEzkY/Hen7y
TLSH
T18BE3BF56F16158A9DC45A0FCA399A97B9FB2B193072510EF03F0C619DD602C06DBFE4E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Revoked Certificate in Chain

One or more certificates in the signing chain have been revoked, indicating potential compromise.

revoked_codesign
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

87:42:f6:13:a0:d9:dd:15:ef:73:73:3b:02:c2:e8:2a:d2:9f:42:94:cf:7b:a8:8d:96:9c:a6:f9:48:11:86:61

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=PengXueWu,O=PengXueWu,L=普洱市,ST=云南省,C=CN

Chains

Oct 25, 2026

CN=PengXueWu,O=PengXueWu,L=普洱市,ST=云南省,C=CN

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Subject

CN=PengXueWu,O=PengXueWu,L=普洱市,ST=云南省,C=CN

Serial Number

74:8c:41:3c:bc:2b:00:67:8e:ba:0e:03:8b:76:5a:2d

Issuer

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Revoked

Revocation Date

Oct 9, 2026

Timespan

Jul 31, 2026 - Jul 31, 2027

Subject

CN=Certum Code Signing 2021 CA,O=Asseco Data Systems S.A.,C=PL

Serial Number

99:a3:80:0a:26:55:3b:65:ab:dc:6e:84:a6:b3:ea:39

Issuer

CN=Certum Trusted Network CA 2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 19, 2021 - May 18, 2036

Subject

CN=Sectigo Public Time Stamping Signer R37,O=Sectigo Limited,ST=Greater London,C=GB

Serial Number

e7:4e:f2:55:b0:50:4f:fa:db:a6:df:f7:fc:8b:a3:15

Issuer

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Jun 24, 2037

Subject

CN=Sectigo Public Time Stamping CA R41,O=Sectigo Limited,C=GB

Serial Number

90:ac:08:72:20:fd:c5:a7:c4:6b:5c:c7:0d:f7:3d:06

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 25, 2026 - Mar 24, 2041

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

4832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

GetUserNameA RegCloseKey RegCreateKeyExW RegOpenKeyExA RegQueryInfoKeyA RegSetValueExW

user32

EnumDisplayDevicesA wsprintfA wsprintfW

api-ms-win-crt-string-l1-1-0

_strnicmp memset strcmp

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e abort

api-ms-win-crt-private-l1-1-0

memcpy strchr strrchr strstr wcsrchr

kernel32

CloseHandle CopyFileA CopyFileW CreateDirectoryA CreateEventA CreateFileA CreateFileW CreateMutexA CreateToolhelp32Snapshot CreateWaitableTimerA DeleteFileA DeviceIoControl DisableThreadLibraryCalls ExitProcess FindResourceA GetACP GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableA GetExitCodeProcess GetFileAttributesA GetFileAttributesW GetFileSize GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetOEMCP GetProcAddress GetSystemDirectoryA GetSystemInfo GetTempPathA GetTickCount GetTickCount64 GetWindowsDirectoryA GlobalMemoryStatusEx LoadLibraryA LoadResource LockResource MultiByteToWideChar Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency ReadFile ReleaseMutex SetEnvironmentVariableA SetEvent SetWaitableTimer SizeofResource Sleep TerminateProcess VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile lstrcatA lstrcpyA lstrcpynA lstrlenA lstrlenW

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf

tax-documents_7.img

out.iso

accevent.exe

advapi32

kernel32

gdi32

user32

msvcrt

oleacc

ole32

oleaut32

shell32

comdlg32

comctl32

version

event

generic

event.dll

PE Signature issue

advapi32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

kernel32

api-ms-win-crt-stdio-l1-1-0

generic