Play interactive tour

Edit tour

Windows Analysis Report Proforma Invoice.exe

Overview

General Information

Sample Name:	Proforma Invoice.exe
Analysis ID:	491978
MD5:	05dea597f5e2fdaf7dd91dc2732eb54b
SHA1:	6067e82bf295eb76c415a5c4910ea578bae96933
SHA256:	6e6d502d455f4d1db45f465ff69d1d2f53a78afffbda8e6bc2b12c99ca012926
Tags:	exeInvoice
Infos:
Most interesting Screenshot:

Detection

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Yara detected AntiVM3

Initial sample is a PE file and has a suspicious name

.NET source code contains very large strings

Executable has a suspicious name (potential lure to open the executable)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

.NET source code contains potential unpacker

Uses 32bit PE files

Found inlined nop instructions (likely shell or obfuscated code)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Creates a process in suspended mode (likely to inject code)

Contains long sleeps (>= 3 min)

Enables debug privileges

Classification

Process Tree

System is w10x64

Proforma Invoice.exe (PID: 6612 cmdline: 'C:\Users\user\Desktop\Proforma Invoice.exe' MD5: 05DEA597F5E2FDAF7DD91DC2732EB54B)

Proforma Invoice.exe (PID: 6752 cmdline: C:\Users\user\Desktop\Proforma Invoice.exe MD5: 05DEA597F5E2FDAF7DD91DC2732EB54B)

Proforma Invoice.exe (PID: 6804 cmdline: C:\Users\user\Desktop\Proforma Invoice.exe MD5: 05DEA597F5E2FDAF7DD91DC2732EB54B)

Proforma Invoice.exe (PID: 6812 cmdline: C:\Users\user\Desktop\Proforma Invoice.exe MD5: 05DEA597F5E2FDAF7DD91DC2732EB54B)

Proforma Invoice.exe (PID: 6820 cmdline: C:\Users\user\Desktop\Proforma Invoice.exe MD5: 05DEA597F5E2FDAF7DD91DC2732EB54B)

Proforma Invoice.exe (PID: 6832 cmdline: C:\Users\user\Desktop\Proforma Invoice.exe MD5: 05DEA597F5E2FDAF7DD91DC2732EB54B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
00000001.00000002.384252504.0000000002D84000.00000004.00000001.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Proforma Invoice.exe PID: 6612	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.Proforma Invoice.exe.2d8482c.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: Proforma Invoice.exe	Virustotal: Detection: 19%			Perma Link
Source: Proforma Invoice.exe	ReversingLabs: Detection: 24%

Source: Proforma Invoice.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Proforma Invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 4x nop then jmp 05F01B4Eh
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 4x nop then jmp 05F01B4Eh
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 4x nop then jmp 05F01B4Eh

Source: Proforma Invoice.exe, 00000001.00000002.384252504.0000000002D84000.00000004.00000001.sdmp

String found in binary or memory: http://schemas.m

System Summary:

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Proforma Invoice.exe

.NET source code contains very large strings

Show sources

Source: Proforma Invoice.exe, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 1.0.Proforma Invoice.exe.990000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 1.2.Proforma Invoice.exe.990000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 4.2.Proforma Invoice.exe.130000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 5.2.Proforma Invoice.exe.80000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776
Source: 5.0.Proforma Invoice.exe.80000.0.unpack, Castle.Samples.Extensibility/UI/Input.cs	Long String: Length: 75776

Executable has a suspicious name (potential lure to open the executable)

Show sources

Source: Proforma Invoice.exe

Static file information: Suspicious name

Source: Proforma Invoice.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000001.00000002.394557947.0000000003DA3000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000001.00000002.383529720.0000000000992000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000004.00000002.355667372.0000000000132000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000004.00000002.355919793.0000000000595000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000005.00000002.356678194.0000000000082000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000005.00000002.356866662.0000000000535000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000006.00000002.362518414.00000000009A2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000006.00000002.362605907.0000000000E35000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000007.00000002.372325904.0000000000CB2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000007.00000002.372402576.0000000001135000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilename vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000008.00000000.375243263.00000000002B2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe
Source: Proforma Invoice.exe, 00000008.00000002.383624530.0000000000735000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCF_Secretaria.dll< vs Proforma Invoice.exe
Source: Proforma Invoice.exe	Binary or memory string: OriginalFilenameSearchResultHandl.exeJ vs Proforma Invoice.exe

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D90D38
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D9DE40
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D911D0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D9D1E8
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D911E0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D93591
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D90D28
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D972C0
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Code function: 1_2_05D972B2

Source: Proforma Invoice.exe	Virustotal: Detection: 19%
Source: Proforma Invoice.exe	ReversingLabs: Detection: 24%

Source: Proforma Invoice.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: unknown	Process created: C:\Users\user\Desktop\Proforma Invoice.exe 'C:\Users\user\Desktop\Proforma Invoice.exe'
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe

Source: C:\Users\user\Desktop\Proforma Invoice.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Proforma Invoice.exe.log

Jump to behavior

Source: classification engine

Classification label: mal76.evad.winEXE@11/1@0/0

Source: C:\Users\user\Desktop\Proforma Invoice.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Source: Proforma Invoice.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Proforma Invoice.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

.NET source code contains potential unpacker

Show sources

Source: Proforma Invoice.exe, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.Proforma Invoice.exe.990000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.Proforma Invoice.exe.990000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.Proforma Invoice.exe.130000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.2.Proforma Invoice.exe.80000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 5.0.Proforma Invoice.exe.80000.0.unpack, Castle.Samples.Extensibility/UI/ApplicationShell.cs	.Net Code: DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Code function: 1_2_05F03EFD push FFFFFF8Bh; iretd

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match	File source: 1.2.Proforma Invoice.exe.2d8482c.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.384252504.0000000002D84000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Proforma Invoice.exe PID: 6612, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Source: C:\Users\user\Desktop\Proforma Invoice.exe TID: 6616	Thread sleep time: -35345s >= -30000s
Source: C:\Users\user\Desktop\Proforma Invoice.exe TID: 6672	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Thread delayed: delay time: 35345
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Thread delayed: delay time: 922337203685477

Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Proforma Invoice.exe, 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Process token adjusted: Debug

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Memory allocated: page read and write | page guard

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Process created: C:\Users\user\Desktop\Proforma Invoice.exe C:\Users\user\Desktop\Proforma Invoice.exe

Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Users\user\Desktop\Proforma Invoice.exe VolumeInformation
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\Desktop\Proforma Invoice.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation

Source: C:\Users\user\Desktop\Proforma Invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection11	Masquerading1	OS Credential Dumping	Security Software Discovery11	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Disable or Modify Tools1	LSASS Memory	Virtualization/Sandbox Evasion21	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Junk Data	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	System Information Discovery12	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection11	LSA Secrets	Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information2	Cached Domain Credentials	System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Proforma Invoice.exe	19%	Virustotal		Browse
Proforma Invoice.exe	24%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://schemas.m	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.m	Proforma Invoice.exe, 00000001.00000002.384252504.0000000002D84000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No contacted IP infos

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	491978
Start date:	28.09.2021
Start time:	08:38:14
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 33s
Hypervisor based Inspection enabled:	false
Report type:	light
Sample file name:	Proforma Invoice.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.evad.winEXE@11/1@0/0
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 97% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe Stop behavior analysis, all processes terminated
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.82.210.154, 8.253.204.120, 67.26.139.254, 67.26.73.254, 8.248.143.254, 67.26.137.254 Excluded domains from analysis (whitelisted): e12564.dspb.akamaiedge.net, fg.download.windowsupdate.com.c.footprint.net, store-images.s-microsoft.com, wu-shim.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, arc.trafficmanager.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, arc.msn.com Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
08:39:15	API Interceptor	1x Sleep call for process: Proforma Invoice.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Proforma Invoice.exe.log Download File
Process:	C:\Users\user\Desktop\Proforma Invoice.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.4740779345585215
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Proforma Invoice.exe
File size:	420352
MD5:	05dea597f5e2fdaf7dd91dc2732eb54b
SHA1:	6067e82bf295eb76c415a5c4910ea578bae96933
SHA256:	6e6d502d455f4d1db45f465ff69d1d2f53a78afffbda8e6bc2b12c99ca012926
SHA512:	35d0436a5154a7b9b44b56a9f8cba583cea20a66c9149a54751f55a18bc4f75cb4467c64ef2636c395c6425aad00815a1c4c97522031574bd947e7e8410a5d31
SSDEEP:	6144:iubE9UmzhN23zG8KGBAOq+hKqr7tGUAI/njChopL3Woqz2ss1SJMllo:azhYz/Ni+hBr7IUAILVzAsvlo
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...,.Ra..............0..^...........y... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4679ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6152A12C [Tue Sep 28 04:59:24 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
xchg eax, esi
xor byte ptr [edi], al
jnbe 00007F7BD0A06B9Eh
popad
push cs
out dx, al
mov edx, 19990951h
les ebp, fword ptr [ebp+07h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6795c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x68000	0x644	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x6a000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x65dbc	0x65e00	False	0.595688746166	data	6.49089350535	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x68000	0x644	0x800	False	0.34619140625	data	3.51671275132	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x6a000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x68090	0x3b4	data
RT_MANIFEST	0x68454	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Highland Appliance 2021
Assembly Version	4.5.0.4
InternalName	SearchResultHandl.exe
FileVersion	4.0.0.0
CompanyName	Highland Appliance
LegalTrademarks	Capricorn
Comments
ProductName	Castle Extensibility
ProductVersion	4.0.0.0
FileDescription	Castle Extensibility
OriginalFilename	SearchResultHandl.exe

Network Behavior

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 28, 2021 08:39:06.727948904 CEST	63791	53	192.168.2.6	8.8.8.8
Sep 28, 2021 08:39:06.775583029 CEST	53	63791	8.8.8.8	192.168.2.6
Sep 28, 2021 08:39:43.329668999 CEST	64267	53	192.168.2.6	8.8.8.8
Sep 28, 2021 08:39:43.363185883 CEST	53	64267	8.8.8.8	192.168.2.6
Sep 28, 2021 08:39:57.258754969 CEST	49448	53	192.168.2.6	8.8.8.8
Sep 28, 2021 08:39:57.278573036 CEST	53	49448	8.8.8.8	192.168.2.6

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: Proforma Invoice.exe PID: 6612 Parent PID: 3876

General

Start time:	08:39:12
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\Proforma Invoice.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Proforma Invoice.exe'
Imagebase:	0x990000
File size:	420352 bytes
MD5 hash:	05DEA597F5E2FDAF7DD91DC2732EB54B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.384187519.0000000002D41000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000001.00000002.384252504.0000000002D84000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	low

Analysis Process: Proforma Invoice.exe PID: 6752 Parent PID: 6612

General

Start time:	08:39:16
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\Proforma Invoice.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Proforma Invoice.exe
Imagebase:	0x130000
File size:	420352 bytes
MD5 hash:	05DEA597F5E2FDAF7DD91DC2732EB54B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: Proforma Invoice.exe PID: 6804 Parent PID: 6612

General

Start time:	08:39:16
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\Proforma Invoice.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Proforma Invoice.exe
Imagebase:	0x80000
File size:	420352 bytes
MD5 hash:	05DEA597F5E2FDAF7DD91DC2732EB54B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: Proforma Invoice.exe PID: 6812 Parent PID: 6612

General

Start time:	08:39:17
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\Proforma Invoice.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Proforma Invoice.exe
Imagebase:	0x9a0000
File size:	420352 bytes
MD5 hash:	05DEA597F5E2FDAF7DD91DC2732EB54B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: Proforma Invoice.exe PID: 6820 Parent PID: 6612

General

Start time:	08:39:20
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\Proforma Invoice.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Proforma Invoice.exe
Imagebase:	0xcb0000
File size:	420352 bytes
MD5 hash:	05DEA597F5E2FDAF7DD91DC2732EB54B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: Proforma Invoice.exe PID: 6832 Parent PID: 6612

General

Start time:	08:39:25
Start date:	28/09/2021
Path:	C:\Users\user\Desktop\Proforma Invoice.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\Desktop\Proforma Invoice.exe
Imagebase:	0x2b0000
File size:	420352 bytes
MD5 hash:	05DEA597F5E2FDAF7DD91DC2732EB54B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Proforma Invoice.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

UDP Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: Proforma Invoice.exe PID: 6612 Parent PID: 3876

General

Analysis Process: Proforma Invoice.exe PID: 6752 Parent PID: 6612

General

Analysis Process: Proforma Invoice.exe PID: 6804 Parent PID: 6612

General

Analysis Process: Proforma Invoice.exe PID: 6812 Parent PID: 6612