Commercial_Invoice[.]exe

resource
unpack001/$PLUGINSDIR/System.dll

resource
Commercial_Invoice.exe

Commercial_Invoice.exe

IMPHASH f4639a0b3116c2cfc71144b88a929cfd
SHA256 dd053f3890a5c093ece2685a8bc11c8c1f6c1cc2b0f15d828a02e3af202a970f
MD5 3c02558bf0cffafe9f90925c1a45db4b
SHA1 803b0b6bae23471dfb0e7920dd87f29445bc13d6
SHA512 1e7189ac71a34debf8700f805fdf734ceac481cd7083123e209d4436cc3c49757842755d62284d788198bb2d1576893c573a15a67420104e14b3be3a9abe9fda
SSDEEP 6144:kfY+onP0DrOB1DpPb6Y1YFM1dQGUw1Wfiqrwh:kfYg6B1Dp6Y1YFMhUw1WfR4
TLSH
T1C12402D2B9A4DA26ED6307312478AD3B46BA7DF75BE5598393203A043D933C0A65F307
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

83:ed:bc:85:db:92:46:61:c3:f3:fc:0a:16:01:dd:bf:ec:1e:5f:6b:4d:f1:cf:70:71:42:65:e7:db:dd:f6:8a:29:1c:24:69:35:dc:35:bc:11:d2:fc:51:91:5b:b7:bb

Digest Algorithm

sha384

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Modehandlerne,OU=Offsettrykkeriets Velella Beduinstammerne\ ,O=Modehandlerne,C=FR,1.2.840.113549.1.9.1=#0c1c42656d757a7a6c696e6740416b74697669736572656e6465732e566c

Chains

Jun 21, 2026

CN=Modehandlerne,OU=Offsettrykkeriets Velella Beduinstammerne\ ,O=Modehandlerne,C=FR,1.2.840.113549.1.9.1=#0c1c42656d757a7a6c696e6740416b74697669736572656e6465732e566c

Subject

CN=Modehandlerne,OU=Offsettrykkeriets Velella Beduinstammerne\ ,O=Modehandlerne,C=FR,1.2.840.113549.1.9.1=#0c1c42656d757a7a6c696e6740416b74697669736572656e6465732e566c

Serial Number

3e:39:39:2a:4a:fc:cc:67:1e:27:88:7f:6b:58:04:96:4c:33:7b:e1

Issuer

CN=Modehandlerne,OU=Offsettrykkeriets Velella Beduinstammerne\ ,O=Modehandlerne,C=FR,1.2.840.113549.1.9.1=#0c1c42656d757a7a6c696e6740416b74697669736572656e6465732e566c

Revocation Status

Not revoked

Timespan

May 10, 2026 - May 10, 2027

Subject

CN=DigiCert SHA384 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0c:20:43:49:f9:d0:f7:59:fb:98:2d:e4:08:1b:88:7b

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

0

Major OS version

4

Entry point

13650

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

lstrcmpiA CreateFileW GetTempFileNameW RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW WriteFile CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject SetEnvironmentVariableW

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Betruknes.prj

SHA256 5256187aaf725891f84a9ad72aca74b1ba8a61a9437b7cb824f645a27fe0f942
MD5 06aa0272567205e16cb24493ca14ba64
SHA1 01b964603ad601f2a04876b8fdef74f623a11199
SHA512 d7eb6dd6558a6a08e764170e1d7ae60bb2efd7e5a8e2c19cfb1219b12a831f834a64979445f22697d9ac1aabb33fc9f9638351172fadfc1225c2477734bba9d7
SSDEEP 6:1X2f66krOUGqGGY4EzfizfgXUYzfmEAzXk9oGXWyzX2+z6t:1X25MNi4EbQtYbRAI9oqSM6t
TLSH
T18EF1228FBC29A28B32E0B0CCB112F1339A0E7CB1C60E7423C41322903401629228CA37
MD5 SHA1 SHA512 SSDEEP TLSH

Marchernes

SHA256 a0b383ae0ac759a20da21f274aa2579918c21a12994dca93651910a116073823
MD5 1af8c45600c2bbc11a92ac9ac44e8b40
SHA1 7ab561330ea3997995e65b6799599eca7bace282
SHA512 beb997ccecd75cc7ef47f1da576a16830cb8ce13e547021662cee24e9ba9e8a74741c8a490cae73a5a9ceca8b43ad2997e976a0061c993f22ff571fdadd35c10
SSDEEP 3072:cTaIt2uIMPvBjHFWKMxZ4loL+CvCeygjcDjyT5fZVVU14a:cTaIEUBIdxZWdHylfZVV7a
TLSH
T15FF3E1D561DEAB3EF99ECD3A902F1249EF08846FF0A325D31427128756B67ED8B58031
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/Bouch2.sto

SHA256 6928be6484e884d3dd961e412b1638829af8d7527f8ba627d08fc4848c7af12f
MD5 d5f1aead33955449d4c58becdf65fd67
SHA1 fc3dcc401432bba5bcab3569dff38980d26bc761
SHA512 f29a28c60b1eb53c96ab364681794ef626382c3c46ed4ad67fbba204d51b79a3d71675600d71bf36a53b0fa663b8240f627cfa00b986208b64d7aa01de05351d
SSDEEP 48:Y+YhESz7pjaJ6T1soI/lJBIJKkI2idu7xYRv9cIuUIWy7e8OoGV4kt81e8:xYiU3hsNkI2/9O/ToGjqF
TLSH
T135430BC079347719AC62C19B4C544E02DB7C84B76258BAD4565431FC46380BF76EBC9A
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/Milrids

SHA256 3c6a12344f65bd1d6ca9d91465b1b68abb88f7ccfc3f43ac0cb0041451fc7e06
MD5 828ab6b8a9e448715216f0ad2363accb
SHA1 f88b0530d4df5d00854a3330663cd21510da9a9e
SHA512 95fb69974d24354f06bf24255c8f12c5b145bd1f0ab3115d95b8bff68a5fcaf46aaed9ef8a74239e586b4f4eeb6a1d723ac8a9fb4a24fe57048dbe432ed756d8
SSDEEP 192:f+GVABLhgNH4yYurvI/9hlCiErpaUqaBdBc18TfDUN+9bpKpY:fR2loYyZrvWapiaTa16LY6bspY
TLSH
T18F526C64B7A59CBEC093C634E54321AB4894B827570DD5DE9266FC10E2863FB1234B7F
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/Selektive/skraakants.sku

SHA256 6167aae62410f3bc53cc344b5b61e38618972f6829aa6aebe18243b897da6fe6
MD5 e24f07b5e7f1c4490e31189d5ed427bd
SHA1 2a81ae60f6fd9ee82a0bc920cb560a6b14a0cac2
SHA512 30402eef790a93f25ee81680882d138d1606fa73cd7df099ddd349cfa4929104d05b11beb9ba679b110d8f40b58f5ca374fe098750e96c82adbb48f37c70d491
SSDEEP 3:PNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNK:YklkMalCdI6lmWdMCVdIlwlACWl9
TLSH
T1F4A12B5CDE6D00091A401C4FD33F2A187232C2E8150149C0149C14179020C307C4D446
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/Selektive/skydesejls.ops

SHA256 ef12bc3006cee739fe1d83e1bd1198aaf7a0059e7542784fa4b93aa3f1d21517
MD5 5c6e4720cc89e79e00b96ca8882893b8
SHA1 b179d7999baca22c1d5cb247664393a0ae49a212
SHA512 b087010e429d6ec5f4f9e7d158e7ba5c3cd18a8cfa83fd2b42613d5b966c2c0dfe5df14a50e0cd52a815b280b247d48d13af38630393c41a8c3ad4aad0b60eeb
SSDEEP 6:2i+g/Yqu////T6qgVD//k7ii//cXIXq/kz1S/MO//Zn8ko//828SX2XgXm///+WE:NDZeXGtbcHA4UPOxmhWm72ucM//6
TLSH
T1B2522303AA594C95411C6CD9CD8D89051C20BA094B703B04CA44EB123C5137D79CC2F9
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/Selektive/tonsil.scu

SHA256 1da3f833dcb0cd92cf0091bdfce8afc6b084b463d538f158aadadeb2be06c994
MD5 a41ada08aee38fa0df17885da26c1d39
SHA1 30fd310a397fa16f0238f6860bbba89cbf9f7657
SHA512 e99c1fec414ccb232aef6cf2f76619612cce926e3ddfa710826c06696a9970d4106642198508e77c779351fb7ca09eebe18cd1570f9fcfc83ae0f782da2fc2c2
SSDEEP 24:vsbS0PyP0OZLdgc8HLkhDcwHHMGKoYNlIDCSoZQ1CX3A2YmI9vAj:v+60CgrHLjQMLoYfI0O1CXdYf9a
TLSH
T14603B4ABF93CCFDB900D7C865410B905619AABB8FBA548DD8A45419C32C7D00B098AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/abought.unp

SHA256 42d868836e8ec4fa39ac264fd7dfae57d496711321578b938d0676de35ed4c4f
MD5 757fd8bbd9185dd17c183febc1c2288e
SHA1 68cfe37a72541f00839943088a56070eefbd2e1e
SHA512 e2f2dd482860897751ae4d73e954083a39cb45fc73cf2242a26e45ccafb154781f67daff41588b736550b6076eeafee801c47cdd02bfd9164c27b97add35dc80
SSDEEP 48:IP2OOCUQ70hCEq3bHJMoHSO0NoElw3v0dnLvUeS3nu:IuKZcCz7JEoinr7S3u
TLSH
T1B7731A3C826AE34FD359D2B71261234DE628A622DDBC963F603C0E582B4736C1A27179
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/aragonese.obj

SHA256 e96dc8139113109cfb850785c5bbf6df72e5cf3a2ebd58b694d00183caabe2d5
MD5 471e97c30a58ced2484234a8d5ca1887
SHA1 2a5abbdc4ae26a43d51522f23a9090addf17e2c6
SHA512 ed57335bd5325afaac1c9984554cfae838a9c1e1dfa7d27d978902b8e78029b3d1ce9e845b5d11ed69f5c0bfa0ddac62ad5745f6443c66bbe759ceb5c1f2ec13
SSDEEP 48:vaaHDqcXtYCmapWAnhvKA6w9wYzh0xIBRa6n1Pynv4+XT:FWcXdb6wWvg6rXT
TLSH
T19BD286D19A66BA10E6839CEA1C40077FE90DC5116E82A55D5B5C27575C9261033C8D90
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/coneflower.van

SHA256 a129c6375d03e75bf1754a9a85e2de9e4d287b49d4069e3d48003269d7fc0d93
MD5 60f4a1eaeff12f0a61bd79bec51e2e69
SHA1 da704832a5e2242d8a1556bab0b489e475baa979
SHA512 980edb961b46d1a1693526703362f93749d73b9362560805225b257b6a574d7f356dbb381721ee2518fb643f14a1df2e60650b97c564b8bf89dc006587a0a3f4
SSDEEP 12:IdgCJwHT70APgM6D71EXU74SZmH6X/8pBM82XGQpKsowQgslh:Idgcw30APB6D5Ee/makpBMHWQQtwQgsD
TLSH
T11E625483CDF47E8A010B10C896F0395C02EAA0C2B2F105A105A4DF6F02B731CBC80E4C
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/infirmly.hyd

SHA256 dd97e2733c2bb05a196580a3c72dde2791a643468bfb4d1044909adcc1fd6167
MD5 5de871a3c1ae0fc97b1e35a69146261c
SHA1 a4fb1686c80f342a0673badc2d4793cf975eb57c
SHA512 a398828f9ec4c9cb903348b77df17fa49c3c06734e04a8d30108d57cf56cef0d929fc9a86558b26d615a4db56bccedb87abd9df1dc194e9cd310685da1dc73b9
SSDEEP 24:9szcz/3iXhqn7YaKT+oa8LwALa63ak/W+uoUWAZmZui:977bc4Ze7LaYBzsmZui
TLSH
T167D2673DD35D087752A0CA5A15C4CF6903FE1A34B9655695C2A193404AB3D06926914B
MD5 SHA1 SHA512 SSDEEP TLSH

Ordne/normaltilstandes.par

SHA256 a6536c64590ff209758e9fc27d93e1c51c908fe243bd104629a1d6d50512f0b8
MD5 500118d1617a83b0a053336e4b350614
SHA1 9087c95011c286ae6809c362dbf9d2e75fef2d29
SHA512 d571a2d346d07b0ec446c49802fa146c2759d97affc5017c5d65d569ef88c0528cab9a6462a88548ceacc8ce8a47b9742927f66794f04919c3ac18ee03ad4dd4
SSDEEP 24:E7SjIBvy4mLYCIiBn56x+JJKMlNf9nOBjC6n6rv20natf:E7SaKX/ILx+VV66rOqatf
TLSH
T15CD2D68DBB3004F18087CC1A3A4AB001D1D180351C42EE117977684A9AEF8C2CC4F33C
MD5 SHA1 SHA512 SSDEEP TLSH

Commercial_Invoice.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Betruknes.prj

Marchernes

Ordne/Bouch2.sto

Ordne/Milrids

Ordne/Selektive/skraakants.sku

Ordne/Selektive/skydesejls.ops

Ordne/Selektive/tonsil.scu

Ordne/abought.unp

Ordne/aragonese.obj

Ordne/coneflower.van

Ordne/infirmly.hyd

Ordne/normaltilstandes.par

Sharing

General

Malware Config

Signatures

File Explorer

Commercial_Invoice.exe

PE Signature issue

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

generic

$PLUGINSDIR/System.dll

kernel32

user32

ole32

generic

Betruknes.prj

Marchernes

Ordne/Bouch2.sto

Ordne/Milrids

Ordne/Selektive/skraakants.sku

Ordne/Selektive/skydesejls.ops

Ordne/Selektive/tonsil.scu

Ordne/abought.unp

Ordne/aragonese.obj

Ordne/coneflower.van

Ordne/infirmly.hyd

Ordne/normaltilstandes.par