File name:

Invitation 2.exe

Full analysis: https://app.any.run/tasks/f4fba7dc-13eb-4853-a447-d6c9c6c5897e
Verdict: Malicious activity
Analysis date: November 21, 2024, 07:27:19
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 7 sections
MD5:

E564B030B054264BF772BF8D6DB7F959

SHA1:

EB5E1F3DE56FE9D0E47785ED95EC721AD342B18D

SHA256:

10F5DA850017F03008D61E4D3A58503370097F31224FA7C660E403E434D015A3

SSDEEP:

98304:PbX30suDFqWXAz+SnzHpAbYpB4RplQ94geo7HNR9dIofyxmxqMogIn/B25cQgDnc:vYYhji+GQzDGI4Y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • Invitation 2.exe (PID: 4428)

    • The process drops C-runtime libraries

      • Invitation 2.exe (PID: 4428)

    • Executable content was dropped or overwritten

      • Invitation 2.exe (PID: 4428)

    • Application launched itself

      • Invitation 2.exe (PID: 4428)

    • Process drops python dynamic module

      • Invitation 2.exe (PID: 4428)

  • INFO

    • Reads the computer name

      • Invitation 2.exe (PID: 4428)

    • PyInstaller has been detected (YARA)

      • Invitation 2.exe (PID: 4428)

    • Checks supported languages

      • Invitation 2.exe (PID: 4428)

    • Create files in a temporary directory

      • Invitation 2.exe (PID: 4428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | InstallShield setup (57.6)
.exe | Win64 Executable (generic) (36.9)
.exe | Generic Win/DOS Executable (2.6)
.exe | DOS Executable Generic (2.6)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2023:05:09 15:05:45+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.34
CodeSize: 165888
InitializedDataSize: 154624
UninitializedDataSize: -
EntryPoint: 0xb310
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
3
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start invitation 2.exe invitation 2.exe no specs textinputhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2380"C:\Users\admin\AppData\Local\Temp\Invitation 2.exe" C:\Users\admin\AppData\Local\Temp\Invitation 2.exe—Invitation 2.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\invitation 2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4428"C:\Users\admin\AppData\Local\Temp\Invitation 2.exe" C:\Users\admin\AppData\Local\Temp\Invitation 2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\invitation 2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5888"C:\WINDOWS\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXjd5de1g66v206tj52m9d0dtpppx4cgpn.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
123.26505.0.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\textinputhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
573
Read events
573
Write events
0
Delete events
0

Modification events

No data
Executable files
15
Suspicious files
3
Text files
920
Unknown types
0

Dropped files

PID
Process
Filename
Type
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\VCRUNTIME140.dllexecutable
MD5:4585A96CC4EEF6AAFD5E27EA09147DC6
SHA256:A8F950B4357EC12CFCCDDC9094CCA56A3D5244B95E09EA6E9A746489F2D58736
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\_bz2.pydexecutable
MD5:A62207FC33140DE460444E191AE19B74
SHA256:EBCAC51449F323AE3AE961A33843029C34B6A82138CCD9214CF99F98DD2148C2
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\_hashlib.pydexecutable
MD5:787B82D4466F393366657B8F1BC5F1A9
SHA256:241322647BA9F94BDC3AE387413FFB57AE14C8CF88BD564A31FE193C6CA43E37
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\_decimal.pydexecutable
MD5:692C751A1782CC4B54C203546F238B73
SHA256:C70F05F6BC564FE400527B30C29461E9642FB973F66EEC719D282D3D0B402F93
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\unicodedata.pydexecutable
MD5:58F7988B50CBA7B793884F580C7083E1
SHA256:E36D14CF49CA2AF44FAE8F278E883341167BC380099DAC803276A11E57C9CFA1
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\tk86t.dllexecutable
MD5:499FA3DEA045AF56EE5356C0CE7D6CE2
SHA256:20139F4C327711BAF18289584FA0C8112F7BB3BA55475BDED21F3D107672ED94
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\select.pydexecutable
MD5:756C95D4D9B7820B00A3099FAF3F4F51
SHA256:13E4D9A734A453A3613E11B6A518430099AD7E3D874EA407D1F9625B7F60268A
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\tcl86t.dllexecutable
MD5:AC6CD2FB2CD91780DB186B8D6E447B7C
SHA256:A91781FE13548B89817462B00058A75FB0B607EC8CE99D265719CED573ADE7B6
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\tcl8\8.4\platform\shell-1.1.4.tmtext
MD5:8ABC3029963E433D1D9865AAA7E1057B
SHA256:0A6B4B109CFDFC4B40FBDEFDB2282F9B1AF3CC2F9624DD39958EEBD78781AFB2
4428Invitation 2.exeC:\Users\admin\AppData\Local\Temp\_MEI44282\tcl8\8.4\platform-1.0.18.tmtext
MD5:628A1F34F7B7149303918E52114D2C3B
SHA256:C96140D154C3BDC0A13A06C8B8B7628DFCD014DF827704D1DBCB2B3B38349605
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
32
DNS requests
19
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6096
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4932
svchost.exe
GET
200
23.53.40.178:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6096
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
3220
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4036
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4932
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.204.147:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4932
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4932
svchost.exe
23.53.40.178:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4932
svchost.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.16.204.147
  • 2.16.204.148
  • 2.16.204.150
  • 2.16.204.146
  • 2.16.204.149
  • 2.16.204.137
  • 2.16.204.143
  • 2.16.204.141
  • 2.16.204.138
whitelisted
google.com
  • 172.217.18.14
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
crl.microsoft.com
  • 23.53.40.178
  • 23.53.40.176
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
login.live.com
  • 40.126.32.68
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.136
  • 20.190.160.14
  • 40.126.32.72
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.17
  • 40.126.32.138
  • 40.126.32.140
  • 40.126.32.76
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 40.69.42.241
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Invitation 2.exe