Summary

05c372c3f0eb2bf62a8a744e89b142f0f4df8be4de95b8eb3a4418d18e9818f1

File 05c372c3f0eb2bf62a8a744e89b142f0f4df8be4de95b8eb3a4418d18e9818f1

Summary
Download Resubmit sample

Size 9.5MB
Type PE32+ executable (console) x86-64, for MS Windows
MD5 1490dbb4f42bb99f3b3bd64327caec49
SHA1 d0315d2939a1cf16f3e3aaac61f10e12065c3f4d
SHA256 05c372c3f0eb2bf62a8a744e89b142f0f4df8be4de95b8eb3a4418d18e9818f1
SHA512
0753ac5521979f7472122e19d8c1dd010bc70ecc53f23b6ba946819379d97ebaaa0c4247a914b1c861b562944591e91453f048425d6500cc84d6a7eea785cbf2
CRC32 75978E49
ssdeep None
Yara
  • powershell - (no description)
  • DebuggerCheck__QueryInfo - (no description)
  • DebuggerException__ConsoleCtrl - (no description)
  • DebuggerException__SetConsoleCtrl - (no description)
  • ThreadControl__Context - (no description)
  • SEH__vectored - (no description)
  • disable_dep - Bypass DEP
  • create_service - Create a windows service
  • network_udp_sock - Communications over UDP network
  • network_tcp_listen - Listen for incoming communication

Score

This file shows numerous signs of malicious behavior.

The score of this file is 4.4 out of 10.

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Feb. 20, 2026, 11:27 a.m. Feb. 20, 2026, 11:28 a.m. 40 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2026-02-20 10:27:27,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpwwr_kc
2026-02-20 10:27:27,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\ZVyjoXNJyqOOioEFLjgOqELMTrYobAxY
2026-02-20 10:27:27,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\taZXPwvxntoUiQgvCRhzoD
2026-02-20 10:27:27,342 [analyzer] DEBUG: Started auxiliary module Curtain
2026-02-20 10:27:27,342 [analyzer] DEBUG: Started auxiliary module DbgView
2026-02-20 10:27:27,765 [analyzer] DEBUG: Started auxiliary module Disguise
2026-02-20 10:27:28,015 [analyzer] DEBUG: Loaded monitor into process with pid 504
2026-02-20 10:27:28,015 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2026-02-20 10:27:28,015 [analyzer] DEBUG: Started auxiliary module Human
2026-02-20 10:27:28,015 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2026-02-20 10:27:28,015 [analyzer] DEBUG: Started auxiliary module Reboot
2026-02-20 10:27:28,155 [analyzer] DEBUG: Started auxiliary module RecentFiles
2026-02-20 10:27:28,155 [analyzer] DEBUG: Started auxiliary module Screenshots
2026-02-20 10:27:28,155 [analyzer] DEBUG: Started auxiliary module Sysmon
2026-02-20 10:27:28,171 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2026-02-20 10:27:28,375 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\05c372c3f0eb2bf62a8a744e89b142f0f4df8be4de95b8eb3a4418d18e9818f1.exe' with arguments '' and pid 1412
2026-02-20 10:27:28,655 [analyzer] DEBUG: Loaded monitor into process with pid 1412
2026-02-20 10:27:29,076 [lib.api.process] ERROR: Failed to dump memory of 64-bit process with pid 1412.
2026-02-20 10:27:29,377 [analyzer] INFO: Process with pid 1412 has terminated
2026-02-20 10:27:29,377 [analyzer] INFO: Process list is empty, terminating analysis.
2026-02-20 10:27:30,581 [analyzer] INFO: Terminating remaining processes before shutdown.
2026-02-20 10:27:30,581 [analyzer] INFO: Analysis completed.

Cuckoo Log

2026-02-20 11:27:28,165 [cuckoo.core.scheduler] INFO: Task #7458878: acquired machine win7x645 (label=win7x645)
2026-02-20 11:27:28,166 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.205 for task #7458878
2026-02-20 11:27:28,770 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2512090 (interface=vboxnet0, host=192.168.168.205)
2026-02-20 11:27:33,354 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x645
2026-02-20 11:27:34,082 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x645 to vmcloak
2026-02-20 11:27:44,183 [cuckoo.core.guest] INFO: Starting analysis #7458878 on guest (id=win7x645, ip=192.168.168.205)
2026-02-20 11:27:45,189 [cuckoo.core.guest] DEBUG: win7x645: not ready yet
2026-02-20 11:27:50,219 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x645, ip=192.168.168.205)
2026-02-20 11:27:50,303 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x645, ip=192.168.168.205, monitor=latest, size=6660546)
2026-02-20 11:27:52,145 [cuckoo.core.resultserver] DEBUG: Task #7458878: live log analysis.log initialized.
2026-02-20 11:27:53,110 [cuckoo.core.resultserver] DEBUG: Task #7458878 is sending a BSON stream
2026-02-20 11:27:53,672 [cuckoo.core.resultserver] DEBUG: Task #7458878 is sending a BSON stream
2026-02-20 11:27:54,445 [cuckoo.core.resultserver] DEBUG: Task #7458878: File upload for 'shots/0001.jpg'
2026-02-20 11:27:54,468 [cuckoo.core.resultserver] DEBUG: Task #7458878 uploaded file length: 133961
2026-02-20 11:27:55,631 [cuckoo.core.resultserver] DEBUG: Task #7458878: File upload for 'curtain/1771579650.47.curtain.log'
2026-02-20 11:27:55,635 [cuckoo.core.resultserver] DEBUG: Task #7458878 uploaded file length: 36
2026-02-20 11:27:55,739 [cuckoo.core.resultserver] DEBUG: Task #7458878: File upload for 'sysmon/1771579650.58.sysmon.xml'
2026-02-20 11:27:55,743 [cuckoo.core.resultserver] DEBUG: Task #7458878 uploaded file length: 38742
2026-02-20 11:27:56,559 [cuckoo.core.resultserver] DEBUG: Task #7458878 had connection reset for <Context for LOG>
2026-02-20 11:27:57,697 [cuckoo.core.guest] INFO: win7x645: analysis completed successfully
2026-02-20 11:27:57,710 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2026-02-20 11:27:57,732 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2026-02-20 11:27:59,257 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x645 to path /srv/cuckoo/cwd/storage/analyses/7458878/memory.dmp
2026-02-20 11:27:59,258 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x645
2026-02-20 11:28:07,902 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.205 for task #7458878
2026-02-20 11:28:08,225 [cuckoo.core.scheduler] DEBUG: Released database task #7458878
2026-02-20 11:28:08,237 [cuckoo.core.scheduler] INFO: Task #7458878: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description (no description) rule powershell
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
description Create a windows service rule create_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)
section .symtab
One or more processes crashed (1 event)
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 

        
      
      
      

    
  
    
      
        exception.symbol:
        
        

      
        exception.exception_code:
        0xc0000005
        

      
        exception.address:
        0x0
        

      
    
  
    
      
        registers.r14:
        14001792
        

      
        registers.r15:
        0
        

      
        registers.rcx:
        14348000
        

      
        registers.rsi:
        2293408
        

      
        registers.r10:
        14157944
        

      
        registers.rbx:
        14003424
        

      
        registers.rsp:
        2292856
        

      
        registers.r11:
        33
        

      
        registers.r8:
        0
        

      
        registers.r9:
        2293472
        

      
        registers.rdx:
        128
        

      
        registers.r12:
        2293440
        

      
        registers.rbp:
        2293216
        

      
        registers.rdi:
        8796092874752
        

      
        registers.rax:
        0
        

      
        registers.r13:
        1
        

      
    
  



    
        1
    



  
    0
  
  


    
        0
    

 

                                  
                                


                            

                        

                    


                

            

        
            


                
                    Detects the presence of Wine emulator
                    
                        
                        (1 event)
                        
                    
                

                


                    


                        

                            

                                

                                    

                                    
                                        

                                          
                                              Time & API
                                              Arguments
                                              Status
                                              Return
                                              Repeated
                                          
                                        

                                    

                                

                                

                                  
                                      

  
LdrGetProcedureAddress

  
  
    
      
    
  


  
    
      ordinal:
      
      0
      
      
      

    
  
    
      function_address:
      
      0x000007feff8e7a50
      
      
      

    
  
    
      function_name:
      
      wine_get_version
      
      
      

    
  
    
      module:
      
      ntdll
      
      
      

    
  
    
      module_address:
      
      0x0000000077600000
      
      
      

    
  



    



  
    -1073741511
  
  


    
        0
    

 

                                  
                                


                            

                        

                    


                

            

        
            


                
                    File has been identified by 4 AntiVirus engine on IRMA as malicious
                    
                        
                        (4 events)
                        
                    
                

                


                    


                        

                            

                                

                                    C4S ClamAV (Linux)
                                    Win.Tool.Garble-10044180-0
                                    
                                


                            

                        

                            

                                

                                    WithSecure (Linux)
                                    Heuristic.HEUR/AGEN.1379695
                                    
                                


                            

                        

                            

                                

                                    Sophos Anti-Virus (Linux)
                                    CXrep/MalGo-B
                                    
                                


                            

                        

                            

                                

                                    ClamAV (Linux)
                                    Win.Tool.Garble-10044180-0
                                    
                                


                            

                        

                    


                

            

        

        

    






                    


    

        

             Screenshots
            

                
            

        


        

            
                
    







                    

                        





    

        
            

                Name
                Response
                Post-Analysis Lookup
            

        
        

            
                

                    No hosts contacted.
                

            

        
    






                        


    

        
            

                IP Address
                Status
                Action
                VT
                Location
            

        
        
            

                

                    No hosts contacted.
                


            

        
    






                    


                


            


            
            

        


    



	



    
    
    

    
    


    
    

        

            Cuckoo
        

        

            
            
        

        

            
We're processing your submission... This could take a few seconds.