MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03f00297dfcf082c1713057ffdcef8f76fd1df195e6ea3d6f409397f9b119800. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	03f00297dfcf082c1713057ffdcef8f76fd1df195e6ea3d6f409397f9b119800
SHA3-384 hash:	58da451bd794cab6a73a253b86687caa9c571bb9e4d2d6eb06fa5412a57d7c26afde8147acb7b98ae4fe3f2d86dddf7e
SHA1 hash:	e4746b52cb5b2de7602574eb87a8fa3905e8e6b2
MD5 hash:	58d2259b11b76fa72be8ac81e63a86e5
humanhash:	gee-fanta-eleven-oven
File name:	INVOICE.exe
Download:	download sample
File size:	49'664 bytes
First seen:	2023-07-04 08:52:00 UTC
Last seen:	2023-07-05 10:38:14 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	768:REE0JpSRzsE8Wou9cu5s6wxj8QM55O1tB5q3fRsEipq:QJuz7K7SQN7q35ipq
Threatray	11 similar samples on MalwareBazaar
TLSH	T17623B810B2F90209F2FF3B765AB752905A377C97E838D25D124E944D0F636858AA3F27
TrID	44.4% (.EXE) Win64 Executable (generic) (10523/12/4) 21.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.ICL) Windows Icons Library (generic) (2059/9) 8.5% (.EXE) OS/2 Executable (generic) (2029/13) 8.4% (.EXE) Generic Win/DOS Executable (2002/3)
Reporter	TeamDreier
Tags:	exe

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

276

Origin country :

DK

Vendor Threat Intelligence

ANY.RUN Malicious

Malware family:

n/a

ID:

1

File name:

INVOICE.exe

Verdict:

Malicious activity

Analysis date:

2023-07-04 08:56:46 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/11b63345-05f7-41ea-826b-cd544eb59dcc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

CAPE Sandbox

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/406321/

ClamAV Detected

Detection(s):

SecuriteInfo.com.Win32.SuspectCrc.7263.8992.UNOFFICIAL

Alert

Create hunting rule

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Sending a custom TCP request

Sending an HTTP GET request

Creating a window

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

finger lolbin masquerade

Link:

https://www.filescan.io/uploads/64a3ddb4cf99e7a5cfccb9b4/reports/bcac2178-6869-4d6f-9edb-36521d4282ed/overview

Hybrid Analysis Win/malicious_confidence_70%

Verdict:

Malicious

Labled as:

Win/malicious_confidence_70%

Link:

https://www.hybrid-analysis.com/sample/03f00297dfcf082c1713057ffdcef8f76fd1df195e6ea3d6f409397f9b119800

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Suspicious

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/1048e929-9e6f-4a84-9a61-533f1f4a5ffa

Joe Sandbox malicious

Result

Threat name:

n/a

Detection:

malicious

Classification:

expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1266479

Signature

Antivirus detection for URL or domain

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sample has a suspicious name (potential lure to open the executable)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Yara detected AntiVM3

Yara detected UAC Bypass using CMSTP

Behaviour

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/03f00297dfcf082c1713057ffdcef8f76fd1df195e6ea3d6f409397f9b119800/

ReversingLabs TitaniumCloud Win64.Trojan.Cusloader

Threat name:

Win64.Trojan.Cusloader

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-07-04 07:37:54 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

1

AV detection:

20 of 24 (83.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=apyaff67z4ecyfytav773txy65x5dxyzlzxkhvxube4x7gyrtaaa._file

Threatray malicious

Verdict:

malicious

Similar samples:

1201be819db6d09ce9bd23656c5bbd7430e0420f30c39afe37b3a4662581f143

22059817e04f84b60175d20e225c713482cd8091ecd4bb74a70946d4826da7f4

312a01b589aea6e8dfc11fdd5a362228970074eeec1a97d36f23f99b48b586f0

4c9b551910643eb2c5a4adaf517f41cf1c5035c1526b11f108accd970e675e31

8182fd64aabdf1d67f00c87fe9d90fa7d52be56284738995446f82890205dc93

950e8cfed90f2e567f20f1ba663e2a172596b96670da2f7b91ead407fc64fa77

a26842becdd6ced8f2b44de90122dbd4cc027348b569ef32703749bac877ca6f

a5ae679843b00396ed2349a9ce7d3d0dc077defb4f83c89489d4c2065863e0f7

b82291de6b50625fbe64293024d4b7d3f1bc874e14d8a6c613b56cf4c5854d30

+ 1 additional samples on MalwareBazaar

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/230704-ksqebsdc3v/

Behaviour

Modifies system certificate store

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Program crash

UnpacMe

Unpacked files

SH256 hash:

03f00297dfcf082c1713057ffdcef8f76fd1df195e6ea3d6f409397f9b119800

MD5 hash:

58d2259b11b76fa72be8ac81e63a86e5

SHA1 hash:

e4746b52cb5b2de7602574eb87a8fa3905e8e6b2

Link:

https://www.unpac.me/results/b79c21ac-d75e-4c94-a290-85aeb90c5d8e/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

File information

---

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

exe 03f00297dfcf082c1713057ffdcef8f76fd1df195e6ea3d6f409397f9b119800

(this sample)

  

Delivery method

Distributed via e-mail attachment

Cape

https://www.capesandbox.com/analysis/406321/