Size | 35.1KB |
---|---|
Type | ISO-8859 text, with CRLF line terminators |
MD5 | 375f2c59cabdd8abc2f1930f734de1ea |
SHA1 | e5480f2b2a22aa6afab16e259f83e11f82f5c5c4 |
SHA256 | 0a1f696fa00bc70b0036f4015cfb978d11040e2f2b6ee0c883ee43acbcb9617f |
SHA512 |
b18e3dedea5c6d67b98e22e09e40f2219b83051f12bdc3f2901a52ad68261808251e357226b37d40e05c273c48be013dc579ee5e2661a4d1f808083711bba2ad
|
CRC32 | C3BD1874 |
ssdeep | None |
Yara | None matched |
This file is very suspicious, with a score of 10 out of 10!
Please notice: The scoring system is currently still in development and should be considered an alpha feature.
Expecting different results? Send us this analysis and we will inspect it. Click here
Category | Started | Completed | Duration | Routing | Logs |
---|---|---|---|---|---|
FILE | April 8, 2025, 5:09 a.m. | April 8, 2025, 5:12 a.m. | 174 seconds | internet |
Show Analyzer Log Show Cuckoo Log |
2025-04-06 05:25:33,015 [analyzer] DEBUG: Starting analyzer from: C:\tmp564etj 2025-04-06 05:25:33,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\JimjXyPaGWcAfdgvTbLHRJMJvn 2025-04-06 05:25:33,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\vFsfKESPXSwkYwkhmjhsTsXozmnZtXGt
2025-04-08 05:09:53,340 [cuckoo.core.scheduler] INFO: Task #6244033: acquired machine win7x6419 (label=win7x6419) 2025-04-08 05:09:53,342 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.219 for task #6244033 2025-04-08 05:09:53,537 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1451139 (interface=vboxnet0, host=192.168.168.219) 2025-04-08 05:09:53,612 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6419 2025-04-08 05:09:54,011 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6419 to vmcloak 2025-04-08 05:11:20,223 [cuckoo.core.guest] INFO: Starting analysis #6244033 on guest (id=win7x6419, ip=192.168.168.219) 2025-04-08 05:11:21,231 [cuckoo.core.guest] DEBUG: win7x6419: not ready yet 2025-04-08 05:11:26,258 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6419, ip=192.168.168.219) 2025-04-08 05:11:26,349 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6419, ip=192.168.168.219, monitor=latest, size=6660546) 2025-04-08 05:11:27,819 [cuckoo.core.resultserver] DEBUG: Task #6244033: live log analysis.log initialized. 2025-04-08 05:11:27,907 [cuckoo.core.resultserver] DEBUG: Task #6244033 had connection reset for <Context for LOG> 2025-04-08 05:11:30,426 [cuckoo.core.guest] WARNING: win7x6419: analysis #6244033 caught an exception Traceback (most recent call last): File "C:/tmp564etj/analyzer.py", line 824, in <module> success = analyzer.run() File "C:/tmp564etj/analyzer.py", line 593, in run "not exist.".format(package_name)) CuckooError: Unable to import package "modules.packages.vb", does not exist. 2025-04-08 05:11:30,436 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks 2025-04-08 05:11:30,460 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2025-04-08 05:11:31,019 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6419 to path /srv/cuckoo/cwd/storage/analyses/6244033/memory.dmp 2025-04-08 05:11:31,105 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6419 2025-04-08 05:12:47,043 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.219 for task #6244033 2025-04-08 05:12:47,402 [cuckoo.core.scheduler] DEBUG: Released database task #6244033 2025-04-08 05:12:47,420 [cuckoo.core.scheduler] INFO: Task #6244033: analysis procedure completed
Avast Core Security (Linux) | Script:SNH-gen [Trj] |
C4S ClamAV (Linux) | Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL |
WithSecure (Linux) | Malware.VBS/Drop.Agent.VPWH |
ESET Security (Windows) | VBS/Agent.QWZ trojan |
ClamAV (Linux) | Sanesecurity.Malware.25834.JsHeur.UNOFFICIAL |
Kaspersky Standard (Windows) | HEUR:Trojan-Dropper.VBS.SDrop.gen |
Symantec | Trojan.Malscript |
ESET-NOD32 | VBS/Agent.QWZ |
Avast | Script:SNH-gen [Trj] |
Cynet | Malicious (score: 99) |
Kaspersky | HEUR:Trojan-Dropper.VBS.SDrop.gen |
NANO-Antivirus | Trojan.Script.Vbs-heuristic.druvzi |
Rising | Trojan.Agent/VBS!1.12983 (CLASSIC) |
F-Secure | Malware.VBS/Drop.Agent.VPWH |
Ikarus | Win32.Outbreak |
Detected | |
Avira | VBS/Drop.Agent.VPWH |
Varist | VBS/Agent.BES |
Tencent | Trojan.VBS.Agent.404668 |
huorong | TrojanDropper/VBS.Agent.cb |
AVG | Script:SNH-gen [Trj] |
Name | Response | Post-Analysis Lookup |
---|---|---|
No hosts contacted. |
IP Address | Status | Action | VT | Location |
---|---|---|---|---|
No hosts contacted. |