Introduction

The analyzed malware disguises itself as a supposed TurboTax activation software, taking advantage of the brand’s familiarity to trick the user into running the malicious file. TurboTax is a commercially available software widely used in the United States to help with filling out and filing income taxes.

Static Analysis - Setup PE Informations

Dentro da pasta zip do download fornecido do software, alem de termos arquivos dll, temos um arquivo de setup, com o nome ‘Setup_v1.8.2.exe’, vamos analisar seu cabecalho PE.