Windows Analysis Report
invoice.exe

Overview

General Information

Sample Name:	invoice.exe
Analysis ID:	828743
MD5:	f111934675c34cca18d9d76fc34a2e40
SHA1:	6c54e0fbae03df56fee84195f3deb4d2ebd8d8c1
SHA256:	c627b8bb6c4ea0cf03aa2d209d0ecc53ff9784283328dabd44c1675aef0939c2
Tags:	exesigned
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Multi AV Scanner detection for submitted file

Initial sample is a PE file and has a suspicious name

Found potential ransomware demand text

Uses 32bit PE files

PE file does not import any functions

Sample file is different than original file name gathered from version info

Drops certificate files (DER)

Drops PE files

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

PE file contains sections with non-standard names

Detected potential crypto function

PE / OLE file has an invalid certificate

Contains functionality to dynamically determine API calls

Found dropped PE file which has not been started or loaded

Abnormal high CPU Usage

Contains functionality for read data from the clipboard

Classification

Signatures

AV Detection

Multi AV Scanner detection for submitted file

Source: invoice.exe

ReversingLabs: Detection: 35%

Uses 32bit PE files

Source: invoice.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: invoice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: f:\apps8.0.0.270\sw\src\coexagent\mini-agent\release\Ath_CoexAgent.pdb source: Ath_CoexAgent.exe.0.dr
Source:	Binary string: C:\Builds\219\N2\HO_NMDllHost_g_2016_r_0\Sources\NMDllHost_2016\src\NMDllHost\NMDllHost\x86\Release\NMDllHost.pdb source: NMDllHost.exe.0.dr

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00406268 FindFirstFileA,FindClose,	0_2_00406268
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0040572D GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040572D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_004026F8 FindFirstFileA,	0_2_004026F8

Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, lang-1059.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: invoice.exe	String found in binary or memory: http://crl.certum.pl/ctnca.crl0k
Source: invoice.exe	String found in binary or memory: http://crl.certum.pl/ctnca2.crl0l
Source: invoice.exe	String found in binary or memory: http://crl.certum.pl/ctsca2021.crl0o
Source: NMDllHost.exe.0.dr, Mss32.dll.0.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, lang-1059.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, lang-1059.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, lang-1059.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: invoice.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: invoice.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, lang-1059.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0O
Source: NMDllHost.exe.0.dr, Mss32.dll.0.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: invoice.exe	String found in binary or memory: http://repository.certum.pl/ctnca.cer09
Source: invoice.exe	String found in binary or memory: http://repository.certum.pl/ctnca2.cer09
Source: invoice.exe	String found in binary or memory: http://repository.certum.pl/ctsca2021.cer0
Source: NMDllHost.exe.0.dr	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: NMDllHost.exe.0.dr	String found in binary or memory: http://s2.symcb.com0
Source: SourceCodePro-ExtraLight.otf.0.dr	String found in binary or memory: http://scripts.sil.org/OFLSource
Source: invoice.exe	String found in binary or memory: http://subca.ocsp-certum.com01
Source: invoice.exe	String found in binary or memory: http://subca.ocsp-certum.com02
Source: invoice.exe	String found in binary or memory: http://subca.ocsp-certum.com05
Source: NMDllHost.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: NMDllHost.exe.0.dr	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: NMDllHost.exe.0.dr	String found in binary or memory: http://sv.symcd.com0&
Source: NMDllHost.exe.0.dr, Mss32.dll.0.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: NMDllHost.exe.0.dr, Mss32.dll.0.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: NMDllHost.exe.0.dr, Mss32.dll.0.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, lang-1059.dll.0.dr	String found in binary or memory: http://www.avast.com0/
Source: invoice.exe	String found in binary or memory: http://www.certum.pl/CPS0
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, lang-1059.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: NMDllHost.exe.0.dr	String found in binary or memory: http://www.nero.com
Source: NMDllHost.exe.0.dr	String found in binary or memory: http://www.symauth.com/cps0(
Source: NMDllHost.exe.0.dr	String found in binary or memory: http://www.symauth.com/rpa00
Source: NMDllHost.exe.0.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: NMDllHost.exe.0.dr	String found in binary or memory: https://d.symcb.com/rpa0
Source: invoice.exe, 00000000.00000002.837716661.000000000040A000.00000004.00000001.01000000.00000003.sdmp, Mss32.dll.0.dr, lang-1059.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_004051CA GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,FindCloseChangeNotification,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

0_2_004051CA

Drops certificate files (DER)

Source: C:\Users\user\Desktop\invoice.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Diskofils\Justiciaryship\vmusbmouse.cat

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Found potential ransomware demand text

Source: NMDllHost.exe.0.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ
Source: NMDllHost.exe.0.dr	String found in binary or memory: ?_Unlock@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@UAEXXZ6
Source: Mss32.dll.0.dr	String found in binary or memory: _AIL_unlock@0

System Summary

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: invoice.exe

Uses 32bit PE files

Source: invoice.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

PE file does not import any functions

Source: lang-1059.dll.0.dr

Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: invoice.exe, 00000000.00000002.837788784.0000000000441000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamepaaklders Nonblameful.exe` vs invoice.exe
Source: invoice.exe	Binary or memory string: OriginalFilenamepaaklders Nonblameful.exe` vs invoice.exe

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_004031F1 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

0_2_004031F1

Detected potential crypto function

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00406742	0_2_00406742
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00404A09	0_2_00404A09
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00406F19	0_2_00406F19

PE / OLE file has an invalid certificate

Source: invoice.exe

Static PE information: invalid certificate

Abnormal high CPU Usage

Source: C:\Users\user\Desktop\invoice.exe

Process Stats: CPU usage > 98%

Source: invoice.exe

ReversingLabs: Detection: 35%

Source: C:\Users\user\Desktop\invoice.exe

File read: C:\Users\user\Desktop\invoice.exe

Jump to behavior

Source: invoice.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\invoice.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

0_2_004031F1

Source: C:\Users\user\Desktop\invoice.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

File created: C:\Users\user\AppData\Local\Temp\nsfE50D.tmp

Jump to behavior

Source: classification engine

Classification label: mal56.rans.winEXE@1/12@0/0

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_004020CB CoCreateInstance,MultiByteToWideChar,

0_2_004020CB

Source: C:\Users\user\Desktop\invoice.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_00404496 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

0_2_00404496

Source: invoice.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: f:\apps8.0.0.270\sw\src\coexagent\mini-agent\release\Ath_CoexAgent.pdb source: Ath_CoexAgent.exe.0.dr
Source:	Binary string: C:\Builds\219\N2\HO_NMDllHost_g_2016_r_0\Sources\NMDllHost_2016\src\NMDllHost\NMDllHost\x86\Release\NMDllHost.pdb source: NMDllHost.exe.0.dr

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_10002D20 push eax; ret

0_2_10002D4E

PE file contains sections with non-standard names

Source: Mss32.dll.0.dr	Static PE information: section name: MSSMIXER
Source: NMDllHost.exe.0.dr	Static PE information: section name: .shared

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Drops PE files

Source: C:\Users\user\Desktop\invoice.exe	File created: C:\Users\user\AppData\Local\Temp\nsfE5AA.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\Desktop\invoice.exe	File created: C:\Users\user\AppData\Local\Temp\nsfE5AA.tmp\AdvSplash.dll	Jump to dropped file
Source: C:\Users\user\Desktop\invoice.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Antimodernly\trever\Hovedinteressers\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\invoice.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Inkshed\NMDllHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Ath_CoexAgent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Inkshed\Mss32.dll	Jump to dropped file

Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\Desktop\invoice.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Antimodernly\trever\Hovedinteressers\lang-1059.dll	Jump to dropped file
Source: C:\Users\user\Desktop\invoice.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Inkshed\NMDllHost.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Ath_CoexAgent.exe	Jump to dropped file
Source: C:\Users\user\Desktop\invoice.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Inkshed\Mss32.dll	Jump to dropped file

Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_00406268 FindFirstFileA,FindClose,	0_2_00406268
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_0040572D GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	0_2_0040572D
Source: C:\Users\user\Desktop\invoice.exe	Code function: 0_2_004026F8 FindFirstFileA,	0_2_004026F8

Source: C:\Users\user\Desktop\invoice.exe	API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\invoice.exe	API call chain: ExitProcess graph end node

Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\invoice.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows	Jump to behavior

Source: vmusbmouse.cat.0.dr

Binary or memory string: VMware, Inc.

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\invoice.exe

Code function: 0_2_10001A5D GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

0_2_10001A5D

Source: C:\Users\user\Desktop\invoice.exe

0_2_004031F1

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

⊘No contacted IP infos

ID:	828743
Product:	CloudBasic
Start time:	14:20:40
Start date:	17.03.2023
Sample:	invoice.exe
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	f111934675c34cca18d9d76fc34a2e40
SHA1:	6c54e0fbae03df56fee84195f3deb4d2ebd8d8c1
SHA256:	c627b8bb6c4ea0cf03aa2d209d0ecc53ff9784283328dabd44c1675aef0939c2
Filetype:	Win32 Executable (generic) a (10002005/4) 99.96%

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Antimodernly\trever\Hovedinteressers\icon-ui.icns	HTML document, ASCII text, with CRLF line terminators	5343C1A8B203C162A3BF3870D9F50FD4	04B5B886C20D88B57EEA6D8FF882624A4AC1E51D	DC1D54DAB6EC8C00F70137927504E4F222C8395F10760B6BEECFCFA94E08249F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Antimodernly\trever\Hovedinteressers\lang-1059.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B47C741673A92A16B48140FCBDA04030	AA7A003DA656320A274F276EE4BF8C27203D1B4C	E6E775E7A5AC1BFA01B5A5CB9A7532171817408E67E346E33CA3CB091BDEA478
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Ath_CoexAgent.exe	PE32 executable (console) Intel 80386, for MS Windows	86B8B1F5C1189D68B07666784BE882FE	B023E9442CFC9C9652E1C8990F06DEF08BDC5B01	0DD8C627F3DDBDB61B1910540C465C0D62C9F8D84C7CBB6C80782DB02D535AF0
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Diskofils\Justiciaryship\vmusbmouse.cat	data	DBE99D951395F37E5C3F4164D8A22245	238EF179549F6AEB2E3C6F4188365814A965312B	671CB26C75AC0256B07835AE00E7018AF6126FAE7400BF21E57707E0CC9164B5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Inkshed\Mss32.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	B75A8E0DDEEB4330C1DBA37105244B0F	E5302CA8517AC2826B5D56E3395D41C34B5B3DF7	CC142B9D8B5223E2720C6440CB7A124C0A80D2FB04ECF59AD7331DFD6E3CB51F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Inkshed\NMDllHost.exe	PE32 executable (GUI) Intel 80386, for MS Windows	DBF787BD6E5CE77FB34FF281A144EB96	50B7799ECCA566BE35429828245D44CB04AD8885	CCBACEEA04837229C95C08274C747ABE069279AFB990DDD89EC743C42ADC0AD9
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Stemningssvingning\Urgently.Suk	ASCII text, with very long lines (52812), with no line terminators	4C6FAD70762561B0D38AA152C52796A8	9FAFD1E9CF41E5482AC7960F7F0C20AB5B703D30	C7CC1E08C3B0850EF02E7F4371D71918B55686581FDE5D124149884EE56C8F4F
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Udlandsrejse153\Aeroscopic\Clanging\Uskyldsrent\SourceCodePro-ExtraLight.otf	OpenType font data	9ECC8DF598E9EDDE1072942D344CC0CF	9FF240AB48EB7E97237E25D8C6F8CD738BA97CAA	D945E1C81A59A434E36EEDEF21E64B61CC6901A9E43936AF79C20BDBF57592B1
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\Udlandsrejse153\Aeroscopic\Clanging\Uskyldsrent\cs.txt	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators	641B90F9AEDFC68486D0D20B40F7ECA6	0A683DD844534905336784FADD80498AFE26F6FA	87A4B9369FD51D76C9032C0E65C3C6221659E086798829072785BE589E55B839
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\predepository\figuranternes.Han	data	DF0C864AD6FE636F3AD391B04A408AC7	B0072D5406BA66EDD9F6A1A443D56378BDA688C5	A802EB02B9345615A947C6B8B57441D7DEBD4300FFEAFC16623CE18F68CABBF2
C:\Users\user\AppData\Local\Temp\nsfE5AA.tmp\AdvSplash.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	88C3BA1802AEF228541820767453E058	4F3AEFB9E4EC27CB49973CB19BD968E54A2BA676	2722555EC1F72523774B64D25FD4C2B460000BFE82140876D6100DC4FB1F62B1
C:\Users\user\AppData\Local\Temp\nsfE5AA.tmp\System.dll	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	C9473CB90D79A374B2BA6040CA16E45C	AB95B54F12796DCE57210D65F05124A6ED81234A	B80A5CBA69D1853ED5979B0CA0352437BF368A5CFB86CB4528EDADD410E11352

Windows Analysis Report
invoice.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report invoice.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Screenshots

Behavior Graph

Network Map

Windows Analysis Report
invoice.exe