File name:

Faktura nr 705_04_03_2025.exe

Full analysis: https://app.any.run/tasks/f54bd48d-b51f-4b9d-8b69-88d55f43ea95
Verdict: Malicious activity
Analysis date: March 24, 2025, 12:17:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
python
pyinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

F7FF49977FC815BD2D702E5125CDCB6C

SHA1:

1C006EB0906957E277FF88BE153E873256C3042A

SHA256:

210149633F1CA3D4713589D54232960E7B6EB460F37EA285295CF08994FBDDAD

SSDEEP:

98304:wosatG4+SrHukznb3PAyGuEo89KdlDnP5y2XK+17API5EQNwHcjyjCkNl5HfXGs4:G/NUvIMX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • The process drops C-runtime libraries

      • Faktura nr 705_04_03_2025.exe (PID: 7232)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)

    • Application launched itself

      • Faktura nr 705_04_03_2025.exe (PID: 7232)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)

    • Process drops python dynamic module

      • Faktura nr 705_04_03_2025.exe (PID: 7232)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)

    • Loads Python modules

      • Faktura nr 705_04_03_2025.exe (PID: 7268)
      • Faktura nr 705_04_03_2025.exe (PID: 6640)
      • Faktura nr 705_04_03_2025.exe (PID: 7708)

    • There is functionality for taking screenshot (YARA)

      • Faktura nr 705_04_03_2025.exe (PID: 7268)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 6640)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)
      • Faktura nr 705_04_03_2025.exe (PID: 7708)
      • Faktura nr 705_04_03_2025.exe (PID: 7232)

    • Executable content was dropped or overwritten

      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)
      • Faktura nr 705_04_03_2025.exe (PID: 7232)

    • Process drops legitimate windows executable

      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)
      • Faktura nr 705_04_03_2025.exe (PID: 7232)

  • INFO

    • Create files in a temporary directory

      • Faktura nr 705_04_03_2025.exe (PID: 7232)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)

    • Reads the computer name

      • Faktura nr 705_04_03_2025.exe (PID: 7232)
      • Faktura nr 705_04_03_2025.exe (PID: 7268)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 6640)
      • Faktura nr 705_04_03_2025.exe (PID: 7708)

    • Reads the machine GUID from the registry

      • Faktura nr 705_04_03_2025.exe (PID: 7268)
      • Faktura nr 705_04_03_2025.exe (PID: 6640)
      • Faktura nr 705_04_03_2025.exe (PID: 7708)

    • Checks supported languages

      • Faktura nr 705_04_03_2025.exe (PID: 7232)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7268)
      • Faktura nr 705_04_03_2025.exe (PID: 6640)
      • Faktura nr 705_04_03_2025.exe (PID: 7708)

    • The sample compiled with english language support

      • Faktura nr 705_04_03_2025.exe (PID: 7232)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)

    • PyInstaller has been detected (YARA)

      • Faktura nr 705_04_03_2025.exe (PID: 7232)
      • Faktura nr 705_04_03_2025.exe (PID: 7268)
      • Faktura nr 705_04_03_2025.exe (PID: 6640)
      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)
      • Faktura nr 705_04_03_2025.exe (PID: 7708)

    • Manual execution by a user

      • Faktura nr 705_04_03_2025.exe (PID: 5404)
      • Faktura nr 705_04_03_2025.exe (PID: 7688)

    • Reads the software policy settings

      • slui.exe (PID: 6032)

    • Checks proxy server information

      • slui.exe (PID: 6032)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:02:24 11:10:30+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.32
CodeSize: 151552
InitializedDataSize: 794624
UninitializedDataSize: -
EntryPoint: 0xa3e0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
148
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start faktura nr 705_04_03_2025.exe faktura nr 705_04_03_2025.exe no specs rundll32.exe no specs faktura nr 705_04_03_2025.exe faktura nr 705_04_03_2025.exe no specs slui.exe faktura nr 705_04_03_2025.exe faktura nr 705_04_03_2025.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2564C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
5404"C:\Users\admin\AppData\Local\Temp\Faktura nr 705_04_03_2025.exe" C:\Users\admin\AppData\Local\Temp\Faktura nr 705_04_03_2025.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\faktura nr 705_04_03_2025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6032C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6640"C:\Users\admin\AppData\Local\Temp\Faktura nr 705_04_03_2025.exe" C:\Users\admin\AppData\Local\Temp\Faktura nr 705_04_03_2025.exe—Faktura nr 705_04_03_2025.exe
User:
admin
Integrity Level:
HIGH
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\faktura nr 705_04_03_2025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7232"C:\Users\admin\AppData\Local\Temp\Faktura nr 705_04_03_2025.exe" C:\Users\admin\AppData\Local\Temp\Faktura nr 705_04_03_2025.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\faktura nr 705_04_03_2025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7268"C:\Users\admin\AppData\Local\Temp\Faktura nr 705_04_03_2025.exe" C:\Users\admin\AppData\Local\Temp\Faktura nr 705_04_03_2025.exe—Faktura nr 705_04_03_2025.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\appdata\local\temp\faktura nr 705_04_03_2025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7688"C:\Users\admin\Downloads\Faktura nr 705_04_03_2025.exe" C:\Users\admin\Downloads\Faktura nr 705_04_03_2025.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\downloads\faktura nr 705_04_03_2025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7708"C:\Users\admin\Downloads\Faktura nr 705_04_03_2025.exe" C:\Users\admin\Downloads\Faktura nr 705_04_03_2025.exe—Faktura nr 705_04_03_2025.exe
User:
admin
Integrity Level:
HIGH
Modules
Images
c:\users\admin\downloads\faktura nr 705_04_03_2025.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
1 034
Read events
1 034
Write events
0
Delete events
0

Modification events

No data
Executable files
165
Suspicious files
3
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\api-ms-win-core-debug-l1-1-0.dllexecutable
MD5:97C0DD1A96684907FC1CDBB05F172376
SHA256:22F40B4D9F547F2271D608CE83FAC8C91BAB75DAA2EB4DCA8678BAD4F80D7D21
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\VCRUNTIME140.dllexecutable
MD5:1B171F9A428C44ACF85F89989007C328
SHA256:9D02E952396BDFF3ABFE5654E07B7A713C84268A225E11ED9A3BF338ED1E424C
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\_ssl.pydexecutable
MD5:279DDD37C939D7FCDE6C259BACD67C20
SHA256:5F156156E7EE88F3EF9B115D8AD835190FE7139F6DCEAD286D9BAA472C3A0882
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\api-ms-win-core-file-l2-1-0.dllexecutable
MD5:8403E7B9EC4B0C4F6C9BF0EC93687C77
SHA256:A8B79E230A81102735996500DD00D34BFA77955C11D87C0F9C967EC85003E116
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\_socket.pydexecutable
MD5:F815C78FD043AB384203C3C65A79F718
SHA256:DF2960527ADC8B1004D46E0EF8664EF085A6C7DE2129EE2B9883984A45E017E9
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\api-ms-win-core-interlocked-l1-1-0.dllexecutable
MD5:82D9D29B54E96C6EFB26D76768375389
SHA256:6AD1B74728FA0679FAEE909339DB727FC4D0658F449C64713072169C618149D3
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\_bz2.pydexecutable
MD5:8A4C977BAA9BD8C626A949AFE1678963
SHA256:D035C0D3C1815DDC61C343692EB0CB82E8F1ADF4EBEACC680E44B8903219BF27
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\api-ms-win-core-datetime-l1-1-0.dllexecutable
MD5:3C1897A32050D1594A40BC30A5B575E1
SHA256:286C40186B8DDC0AABBB2859BD90D58E2D2B0B3FB503D0144D3EA6B16538A6A4
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\api-ms-win-core-localization-l1-2-0.dllexecutable
MD5:2E2C78125C66CDE5859559F5E6167034
SHA256:9BF2BFF3ADCB1FB5707794B18320D7113F45446DD505EEE43ABBF8835CD73A44
7232Faktura nr 705_04_03_2025.exeC:\Users\admin\AppData\Local\Temp\_MEI72322\api-ms-win-core-heap-l1-1-0.dllexecutable
MD5:8E9D89B673EF43E9526D8AEF557402CD
SHA256:3CFF7828694AB43F5F15CAE329C1A6059E28463E90C45EAA30408CF6789B5429
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
24
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8140
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8140
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.112:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7548
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.112:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6544
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
20.197.71.89:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
7548
backgroundTaskHost.exe
20.31.169.57:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7548
backgroundTaskHost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.164.112
  • 2.16.164.113
whitelisted
login.live.com
  • 40.126.31.67
  • 40.126.31.1
  • 40.126.31.71
  • 20.190.159.2
  • 20.190.159.4
  • 20.190.159.129
  • 20.190.159.130
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
client.wns.windows.com
  • 20.197.71.89
  • 20.198.162.76
whitelisted
arc.msn.com
  • 20.31.169.57
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Faktura nr 705_04_03_2025.exe