Summary

malware 1.unknown

File malware 1.unknown

Summary
Download Resubmit sample Download yara

Size 950.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 a909bf582d125e0bdba9e84f3b86afe0
SHA1 5174b586e739ecffe32e2feb58fc0903cbe69303
SHA256 4b639ccbb814fd794d341a70d93d90969c88fdc58cb5436a74702312fce816fd
SHA512
88bbf7496c3ba20fe92030d65e498447ea58f456a0d8a811c96f394fc2f918c1c83cce708b8ae0b7372ff52220c1b67a22f2251518803575efe5a380ae2b4b79
CRC32 68BD3BD8
ssdeep None
Yara
  • APT32_KerrDown - (no description)
  • DebuggerException__SetConsoleCtrl - (no description)
  • Check_OutputDebugStringA_iat - (no description)
  • anti_dbg - Checks if being debugged
  • screenshot - Take screenshot
  • win_registry - Affect system registries
  • win_files_operation - Affect private profile

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE April 18, 2025, 3:53 a.m. April 18, 2025, 3:54 a.m. 65 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-04-18 03:53:03,030 [analyzer] DEBUG: Starting analyzer from: C:\tmpj6atou
2025-04-18 03:53:03,046 [analyzer] DEBUG: Pipe server name: \??\PIPE\CgSkzvXyBedjAFMcGOjMGLzqsmDC
2025-04-18 03:53:03,046 [analyzer] DEBUG: Log pipe server name: \??\PIPE\zTNBRlaINIPXSEuhYoFjt
2025-04-18 03:53:03,296 [analyzer] DEBUG: Started auxiliary module Curtain
2025-04-18 03:53:03,296 [analyzer] DEBUG: Started auxiliary module DbgView
2025-04-18 03:53:03,828 [analyzer] DEBUG: Started auxiliary module Disguise
2025-04-18 03:53:04,030 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-04-18 03:53:04,030 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-04-18 03:53:04,030 [analyzer] DEBUG: Started auxiliary module Human
2025-04-18 03:53:04,030 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-04-18 03:53:04,030 [analyzer] DEBUG: Started auxiliary module Reboot
2025-04-18 03:53:04,125 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-04-18 03:53:04,125 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-04-18 03:53:04,125 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-04-18 03:53:04,140 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-04-18 03:53:04,280 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\malware 1.unknown' with arguments '' and pid 2752
2025-04-18 03:53:04,483 [analyzer] DEBUG: Loaded monitor into process with pid 2752
2025-04-18 02:54:02,934 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-04-18 02:54:03,153 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 2752.
2025-04-18 02:54:03,388 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-04-18 02:54:03,388 [lib.api.process] INFO: Successfully terminated process with pid 2752.
2025-04-18 02:54:03,388 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-04-18 03:53:09,519 [cuckoo.core.scheduler] INFO: Task #6297989: acquired machine win7x6416 (label=win7x6416)
2025-04-18 03:53:09,519 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.216 for task #6297989
2025-04-18 03:53:09,910 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2929063 (interface=vboxnet0, host=192.168.168.216)
2025-04-18 03:53:10,771 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6416
2025-04-18 03:53:11,408 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6416 to vmcloak
2025-04-18 03:53:25,173 [cuckoo.core.guest] INFO: Starting analysis #6297989 on guest (id=win7x6416, ip=192.168.168.216)
2025-04-18 03:53:26,179 [cuckoo.core.guest] DEBUG: win7x6416: not ready yet
2025-04-18 03:53:31,209 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6416, ip=192.168.168.216)
2025-04-18 03:53:31,288 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6416, ip=192.168.168.216, monitor=latest, size=6660546)
2025-04-18 03:53:32,636 [cuckoo.core.resultserver] DEBUG: Task #6297989: live log analysis.log initialized.
2025-04-18 03:53:33,620 [cuckoo.core.resultserver] DEBUG: Task #6297989 is sending a BSON stream
2025-04-18 03:53:34,033 [cuckoo.core.resultserver] DEBUG: Task #6297989 is sending a BSON stream
2025-04-18 03:53:34,913 [cuckoo.core.resultserver] DEBUG: Task #6297989: File upload for 'shots/0001.jpg'
2025-04-18 03:53:34,924 [cuckoo.core.resultserver] DEBUG: Task #6297989 uploaded file length: 142490
2025-04-18 03:53:42,214 [cuckoo.core.resultserver] DEBUG: Task #6297989: File upload for 'shots/0002.jpg'
2025-04-18 03:53:42,226 [cuckoo.core.resultserver] DEBUG: Task #6297989 uploaded file length: 141948
2025-04-18 03:53:47,105 [cuckoo.core.guest] DEBUG: win7x6416: analysis #6297989 still processing
2025-04-18 03:54:02,191 [cuckoo.core.guest] DEBUG: win7x6416: analysis #6297989 still processing
2025-04-18 03:54:03,301 [cuckoo.core.resultserver] DEBUG: Task #6297989: File upload for 'curtain/1744937643.29.curtain.log'
2025-04-18 03:54:03,304 [cuckoo.core.resultserver] DEBUG: Task #6297989 uploaded file length: 36
2025-04-18 03:54:03,396 [cuckoo.core.resultserver] DEBUG: Task #6297989: File upload for 'sysmon/1744937643.39.sysmon.xml'
2025-04-18 03:54:03,401 [cuckoo.core.resultserver] DEBUG: Task #6297989 uploaded file length: 137930
2025-04-18 03:54:03,992 [cuckoo.core.resultserver] DEBUG: Task #6297989: File upload for 'shots/0003.jpg'
2025-04-18 03:54:04,006 [cuckoo.core.resultserver] DEBUG: Task #6297989 uploaded file length: 133570
2025-04-18 03:54:04,022 [cuckoo.core.resultserver] DEBUG: Task #6297989 had connection reset for <Context for LOG>
2025-04-18 03:54:05,205 [cuckoo.core.guest] INFO: win7x6416: analysis completed successfully
2025-04-18 03:54:05,216 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-04-18 03:54:05,239 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-04-18 03:54:06,198 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6416 to path /srv/cuckoo/cwd/storage/analyses/6297989/memory.dmp
2025-04-18 03:54:06,199 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6416
2025-04-18 03:54:13,964 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.216 for task #6297989
2025-04-18 03:54:14,231 [cuckoo.core.scheduler] DEBUG: Released database task #6297989
2025-04-18 03:54:14,303 [cuckoo.core.scheduler] INFO: Task #6297989: analysis procedure completed

Signatures

Yara rules detected for file (7 events)
description (no description) rule APT32_KerrDown
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule Check_OutputDebugStringA_iat
description Checks if being debugged rule anti_dbg
description Take screenshot rule screenshot
description Affect system registries rule win_registry
description Affect private profile rule win_files_operation
The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)
section .textbss
section .gfids
section .00cfg
The executable uses a known packer (1 event)
packer Microsoft Visual C++ V8.0 (Debug)
File has been identified by 10 AntiVirus engine on IRMA as malicious (10 events)
G Data Antivirus (Windows) Virus: Gen:Variant.Jaik.275529 (Engine A)
Avast Core Security (Linux) Win32:MalwareX-gen [Adw]
WithSecure (Linux) Heuristic.HEUR/AGEN.1318902
eScan Antivirus (Linux) Gen:Variant.Jaik.275529(DB)
ESET Security (Windows) a variant of Win32/BadJoke.SQ trojan
Sophos Anti-Virus (Linux) Mal/Generic-S
DrWeb Antivirus (Linux) Trojan.MBRlock.345
Bitdefender Antivirus (Linux) Gen:Variant.Jaik.275529
Kaspersky Standard (Windows) UDS:Trojan.Win32.DiskWriter.mkq
Emsisoft Commandline Scanner (Windows) Gen:Variant.Jaik.275529 (B)
File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)
Lionic Trojan.Win32.BadJoke.4!c
Cynet Malicious (score: 100)
CAT-QuickHeal Trojan.Ghanarava.174056760386afe0
Cylance Unsafe
CrowdStrike win/malicious_confidence_90% (W)
BitDefender Trojan.GenericKD.75908067
Arcabit Trojan.Generic.D48643E3
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/BadJoke.SQ
APEX Malicious
Avast Win32:AdwareX-gen [Adw]
Kaspersky UDS:Trojan.Win32.DiskWriter.mkq
MicroWorld-eScan Trojan.GenericKD.75908067
Rising Trojan.BadJoke!8.EDE4 (CLOUD)
Emsisoft Trojan.GenericKD.75908067 (B)
F-Secure Heuristic.HEUR/AGEN.1318902
McAfeeD Real Protect-LS!A909BF582D12
Trapmine suspicious.low.ml.score
CTX exe.trojan.badjoke
Sophos Mal/Generic-S
SentinelOne Static AI - Suspicious PE
FireEye Generic.mg.a909bf582d125e0b
Google Detected
Avira HEUR/AGEN.1318902
Antiy-AVL Trojan/Win32.Phonzy
Kingsoft malware.kb.a.942
Microsoft Trojan:Win32/Phonzy.B!ml
GData Win32.Trojan.Agent.6YDYBC
Varist W32/ABApplication.NYWN-6202
McAfee Artemis!A909BF582D12
DeepInstinct MALICIOUS
Malwarebytes Malware.Heuristic.2012
Ikarus Trojan.Win32.BadJoke
MaxSecure Trojan.Malware.300983.susgen
Fortinet Riskware/BadJoke
AVG Win32:AdwareX-gen [Adw]
Paloalto generic.ml
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.