Summary
Built.exe
File Built.exe
Summary
| Size | 10.4MB |
|---|---|
| Type | PE32+ executable (GUI) x86-64, for MS Windows |
| MD5 | 7cd557a0086725a520c1332130e891c6 |
| SHA1 | c8f34cb394f79ea206f391cc0a7ef4eb0c5a53a1 |
| SHA256 | 846add5da51157241678372556b64a2f718810c4983fa24557ccc914ebd797d7 |
| SHA512 |
fac70a1c57f29e9c3b73d5b401c2d9702efa5a20d8731fa3a8edb06217e68ae8c9c08397e6d7cd24f5654d1cf761d5dd86b65056a144e1b0c958ffc862254b42
|
| CRC32 | F71F62EF |
| ssdeep | None |
| Yara |
|
Score
This file is very suspicious, with a score of 9.4 out of 10!
Please notice: The scoring system is currently still in development and should be considered an alpha feature.
Feedback
Expecting different results? Send us this analysis and we will inspect it. Click here
Information on Execution
Analysis
| Category | Started | Completed | Duration | Routing | Logs |
|---|---|---|---|---|---|
| FILE | May 25, 2025, 11 p.m. | May 25, 2025, 11:01 p.m. | 62 seconds | internet |
Show Analyzer Log Show Cuckoo Log |
Analyzer Log
2025-05-25 23:00:14,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpdyrg_l 2025-05-25 23:00:14,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\aVdpbgojenkHoWMESfQBkIwMgeST 2025-05-25 23:00:14,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\ToccmDZSotOEtxMSfUuqECTJLeHLDT 2025-05-25 23:00:14,280 [analyzer] DEBUG: Started auxiliary module Curtain 2025-05-25 23:00:14,280 [analyzer] DEBUG: Started auxiliary module DbgView 2025-05-25 23:00:14,703 [analyzer] DEBUG: Started auxiliary module Disguise 2025-05-25 23:00:14,905 [analyzer] DEBUG: Loaded monitor into process with pid 500 2025-05-25 23:00:14,905 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets 2025-05-25 23:00:14,905 [analyzer] DEBUG: Started auxiliary module Human 2025-05-25 23:00:14,905 [analyzer] DEBUG: Started auxiliary module InstallCertificate 2025-05-25 23:00:14,905 [analyzer] DEBUG: Started auxiliary module Reboot 2025-05-25 23:00:15,000 [analyzer] DEBUG: Started auxiliary module RecentFiles 2025-05-25 23:00:15,000 [analyzer] DEBUG: Started auxiliary module Screenshots 2025-05-25 23:00:15,000 [analyzer] DEBUG: Started auxiliary module Sysmon 2025-05-25 23:00:15,000 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n 2025-05-25 23:00:15,233 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\Built.exe' with arguments '' and pid 2772 2025-05-25 23:00:15,467 [analyzer] DEBUG: Loaded monitor into process with pid 2772 2025-05-25 23:00:15,671 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\VCRUNTIME140.dll 2025-05-25 23:00:15,905 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\VCRUNTIME140_1.dll 2025-05-25 23:00:16,046 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_asyncio.pyd 2025-05-25 23:00:16,203 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_bz2.pyd 2025-05-25 23:00:16,280 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_ctypes.pyd 2025-05-25 23:00:16,405 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_decimal.pyd 2025-05-25 23:00:16,608 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_hashlib.pyd 2025-05-25 23:00:16,687 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_lzma.pyd 2025-05-25 23:00:16,858 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_multiprocessing.pyd 2025-05-25 23:00:16,921 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_overlapped.pyd 2025-05-25 23:00:16,983 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_queue.pyd 2025-05-25 23:00:17,046 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_socket.pyd 2025-05-25 23:00:17,155 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_sqlite3.pyd 2025-05-25 23:00:17,312 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_ssl.pyd 2025-05-25 23:00:17,453 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\_wmi.pyd 2025-05-25 23:00:17,530 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\base_library.zip 2025-05-25 23:00:19,905 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\blank.aes 2025-05-25 23:00:20,140 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\libcrypto-3.dll 2025-05-25 23:00:22,592 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\libffi-8.dll 2025-05-25 23:00:22,671 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\libssl-3.dll 2025-05-25 23:00:23,108 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\pyexpat.pyd 2025-05-25 23:00:23,296 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\python313.dll 2025-05-25 23:00:26,140 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\rar.exe 2025-05-25 23:00:26,921 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\rarreg.key 2025-05-25 23:00:26,953 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\select.pyd 2025-05-25 23:00:27,015 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\INSTALLER 2025-05-25 23:00:27,062 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\LICENSE 2025-05-25 23:00:27,092 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\METADATA 2025-05-25 23:00:27,125 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\RECORD 2025-05-25 23:00:27,187 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\WHEEL 2025-05-25 23:00:27,217 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\setuptools\_vendor\importlib_metadata-8.0.0.dist-info\top_level.txt 2025-05-25 23:00:27,250 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\setuptools\_vendor\jaraco\text\Lorem ipsum.txt 2025-05-25 23:00:27,280 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\sqlite3.dll 2025-05-25 23:00:28,562 [analyzer] INFO: Added new file to list with pid 2772 and path C:\Users\Administrator\AppData\Local\Temp\_MEI27722\unicodedata.pyd 2025-05-25 23:00:29,046 [analyzer] INFO: Injected into process with pid 2504 and name u'Built.exe' 2025-05-25 23:00:29,280 [analyzer] DEBUG: Loaded monitor into process with pid 2504 2025-05-25 22:01:10,549 [analyzer] INFO: Analysis timeout hit, terminating analysis. 2025-05-25 22:01:10,862 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 2772. 2025-05-25 22:01:10,940 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 2504. 2025-05-25 22:01:11,190 [analyzer] INFO: Terminating remaining processes before shutdown. 2025-05-25 22:01:11,190 [lib.api.process] INFO: Successfully terminated process with pid 2772. 2025-05-25 22:01:11,190 [lib.api.process] INFO: Successfully terminated process with pid 2504. 2025-05-25 22:01:11,674 [analyzer] INFO: Analysis completed.
Cuckoo Log
2025-05-25 23:00:20,282 [cuckoo.core.scheduler] INFO: Task #6513130: acquired machine win7x6430 (label=win7x6430) 2025-05-25 23:00:20,283 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.230 for task #6513130 2025-05-25 23:00:20,621 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 3925751 (interface=vboxnet0, host=192.168.168.230) 2025-05-25 23:00:23,514 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6430 2025-05-25 23:00:23,998 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6430 to vmcloak 2025-05-25 23:00:32,523 [cuckoo.core.guest] INFO: Starting analysis #6513130 on guest (id=win7x6430, ip=192.168.168.230) 2025-05-25 23:00:33,529 [cuckoo.core.guest] DEBUG: win7x6430: not ready yet 2025-05-25 23:00:38,556 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6430, ip=192.168.168.230) 2025-05-25 23:00:38,638 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6430, ip=192.168.168.230, monitor=latest, size=6660546) 2025-05-25 23:00:40,304 [cuckoo.core.resultserver] DEBUG: Task #6513130: live log analysis.log initialized. 2025-05-25 23:00:41,158 [cuckoo.core.resultserver] DEBUG: Task #6513130 is sending a BSON stream 2025-05-25 23:00:41,626 [cuckoo.core.resultserver] DEBUG: Task #6513130 is sending a BSON stream 2025-05-25 23:00:42,447 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'shots/0001.jpg' 2025-05-25 23:00:42,461 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 133499 2025-05-25 23:00:55,064 [cuckoo.core.guest] DEBUG: win7x6430: analysis #6513130 still processing 2025-05-25 23:00:55,455 [cuckoo.core.resultserver] DEBUG: Task #6513130 is sending a BSON stream 2025-05-25 23:00:57,040 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'shots/0002.jpg' 2025-05-25 23:00:57,049 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 137280 2025-05-25 23:01:10,153 [cuckoo.core.guest] DEBUG: win7x6430: analysis #6513130 still processing 2025-05-25 23:01:11,080 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'curtain/1748203271.08.curtain.log' 2025-05-25 23:01:11,083 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 36 2025-05-25 23:01:11,188 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'sysmon/1748203271.17.sysmon.xml' 2025-05-25 23:01:11,192 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 141538 2025-05-25 23:01:11,202 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/6a7b90effee1e09d_metadata' 2025-05-25 23:01:11,204 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 4648 2025-05-25 23:01:11,208 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/ae3502eae5006810__multiprocessing.pyd' 2025-05-25 23:01:11,210 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 30064 2025-05-25 23:01:11,214 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/9a0b8c95618c5fe5_wheel' 2025-05-25 23:01:11,215 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 91 2025-05-25 23:01:11,224 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/90341ac8dcc9ec5f_rar.exe' 2025-05-25 23:01:11,231 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/716ccd55d1edbade_libssl-3.dll' 2025-05-25 23:01:11,233 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 630736 2025-05-25 23:01:11,236 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/58209c8ab4191e83_rarreg.key' 2025-05-25 23:01:11,238 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 456 2025-05-25 23:01:11,239 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 229232 2025-05-25 23:01:11,242 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/5e2cc7696b0046a6_select.pyd' 2025-05-25 23:01:11,244 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 27640 2025-05-25 23:01:11,262 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/bd11a1aed1a556c6_libcrypto-3.dll' 2025-05-25 23:01:11,290 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 1633136 2025-05-25 23:01:11,315 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/68f10724dee2e266_python313.dll' 2025-05-25 23:01:11,337 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 1988600 2025-05-25 23:01:11,345 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/135c772b42ba6353_libffi-8.dll' 2025-05-25 23:01:11,347 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 29968 2025-05-25 23:01:11,348 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/9f51191ebafa85ca__asyncio.pyd' 2025-05-25 23:01:11,350 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 39928 2025-05-25 23:01:11,355 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/1abe2efff04be307__ssl.pyd' 2025-05-25 23:01:11,358 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 69992 2025-05-25 23:01:11,363 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/44afb5ec148a9019__bz2.pyd' 2025-05-25 23:01:11,365 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 50680 2025-05-25 23:01:11,369 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/ceebae7b8927a322_installer' 2025-05-25 23:01:11,371 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 4 2025-05-25 23:01:11,376 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/eca8f9814896d44f__decimal.pyd' 2025-05-25 23:01:11,379 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 121848 2025-05-25 23:01:11,382 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/37fedcffbf73c4eb_lorem ipsum.txt' 2025-05-25 23:01:11,384 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 1335 2025-05-25 23:01:11,388 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/c3668794821c205b__hashlib.pyd' 2025-05-25 23:01:11,391 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 37368 2025-05-25 23:01:11,395 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/2a94e57d22451726__ctypes.pyd' 2025-05-25 23:01:11,398 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 66408 2025-05-25 23:01:11,403 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/5f9acf702c1267d4__wmi.pyd' 2025-05-25 23:01:11,405 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 30712 2025-05-25 23:01:11,409 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/0d8d3c6eeb9ebbe8_record' 2025-05-25 23:01:11,411 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 2518 2025-05-25 23:01:11,426 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/dc33bc5755299607_base_library.zip' 2025-05-25 23:01:11,437 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 1399388 2025-05-25 23:01:11,442 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/74ab9c9394361a0d__sqlite3.pyd' 2025-05-25 23:01:11,445 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 61432 2025-05-25 23:01:11,449 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/50446711af5b14ca_blank.aes' 2025-05-25 23:01:11,451 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 114280 2025-05-25 23:01:11,468 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/e79fcd94197daca6_unicodedata.pyd' 2025-05-25 23:01:11,494 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 269168 2025-05-25 23:01:11,500 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/7103aee3d458e6da__overlapped.pyd' 2025-05-25 23:01:11,587 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 35832 2025-05-25 23:01:11,588 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'shots/0003.jpg' 2025-05-25 23:01:11,610 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/814981c6946fa14f__socket.pyd' 2025-05-25 23:01:11,614 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 46584 2025-05-25 23:01:11,629 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 133498 2025-05-25 23:01:11,632 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/62eace924ee7fabe_pyexpat.pyd' 2025-05-25 23:01:11,634 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 94064 2025-05-25 23:01:11,638 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/6a99bc0128e0c7d6_vcruntime140_1.dll' 2025-05-25 23:01:11,640 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 49776 2025-05-25 23:01:11,644 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/cfc7749b96f63bd3_license' 2025-05-25 23:01:11,645 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 11358 2025-05-25 23:01:11,650 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/dfe06ccb200a88e1__lzma.pyd' 2025-05-25 23:01:11,652 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 89592 2025-05-25 23:01:11,660 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/01ad385c0c2e1800_sqlite3.dll' 2025-05-25 23:01:11,664 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 677880 2025-05-25 23:01:11,667 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/62290258f4e11c22__queue.pyd' 2025-05-25 23:01:11,669 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 29032 2025-05-25 23:01:11,671 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/052ad6a20d375957_vcruntime140.dll' 2025-05-25 23:01:11,673 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 120400 2025-05-25 23:01:11,677 [cuckoo.core.resultserver] DEBUG: Task #6513130: File upload for 'files/08eddf0fdcb29403_top_level.txt' 2025-05-25 23:01:11,679 [cuckoo.core.resultserver] DEBUG: Task #6513130 uploaded file length: 19 2025-05-25 23:01:11,701 [cuckoo.core.resultserver] DEBUG: Task #6513130 had connection reset for <Context for LOG> 2025-05-25 23:01:13,165 [cuckoo.core.guest] INFO: win7x6430: analysis completed successfully 2025-05-25 23:01:13,178 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks 2025-05-25 23:01:13,197 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2025-05-25 23:01:14,125 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6430 to path /srv/cuckoo/cwd/storage/analyses/6513130/memory.dmp 2025-05-25 23:01:14,126 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6430 2025-05-25 23:01:21,698 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.230 for task #6513130 2025-05-25 23:01:21,984 [cuckoo.core.scheduler] DEBUG: Released database task #6513130 2025-05-25 23:01:22,001 [cuckoo.core.scheduler] INFO: Task #6513130: analysis procedure completed
Signatures
| description | (no description) | rule | APT32_KerrDown | ||||||
| description | (no description) | rule | DebuggerException__SetConsoleCtrl | ||||||
| description | Checks if being debugged | rule | anti_dbg | ||||||
| description | Take screenshot | rule | screenshot | ||||||
| description | Affect system token | rule | win_token | ||||||
| description | Affect private profile | rule | win_files_operation | ||||||
| section | .fptable |
| file | C:\Users\Administrator\AppData\Local\Temp\_MEI27722\rar.exe |
| file | C:\Users\Administrator\AppData\Local\Temp\_MEI27722\libcrypto-3.dll |
| file | C:\Users\Administrator\AppData\Local\Temp\_MEI27722\VCRUNTIME140.dll |
| file | C:\Users\Administrator\AppData\Local\Temp\_MEI27722\libssl-3.dll |
| file | C:\Users\Administrator\AppData\Local\Temp\_MEI27722\VCRUNTIME140_1.dll |
| file | C:\Users\Administrator\AppData\Local\Temp\_MEI27722\sqlite3.dll |
| file | C:\Users\Administrator\AppData\Local\Temp\_MEI27722\python313.dll |
| file | C:\Users\Administrator\AppData\Local\Temp\_MEI27722\libffi-8.dll |
| G Data Antivirus (Windows) | Virus: Gen:Variant.Application.Tedy.764726 (Engine A) |
| WithSecure (Linux) | Heuristic.HEUR/AGEN.1364963 |
| eScan Antivirus (Linux) | Gen:Variant.Application.Tedy.764726(DB) |
| ESET Security (Windows) | a variant of Win64/Packed.PyInstaller.P suspicious application |
| DrWeb Antivirus (Linux) | Python.Packed.104 |
| Bitdefender Antivirus (Linux) | Gen:Variant.Application.Tedy.764726 |
| Kaspersky Standard (Windows) | Trojan-Spy.Win32.Agent.dffz |
Screenshots
| Name | Response | Post-Analysis Lookup |
|---|---|---|
| No hosts contacted. | ||
| IP Address | Status | Action | VT | Location |
|---|---|---|---|---|
| No hosts contacted. | ||||
