Cuckoo Sandbox

File 3edb27daf6f653f5_unicorn-24005.exe

Summary
Download Resubmit sample

Size	468.0KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`7ce939d11516104a77c217c6c19a1914`
SHA1	`731041f47c5e47789bee5651edd01deda6f80c9c`
SHA256	`3edb27daf6f653f52f29c9a0fc0e79d1ff54ea8188d5015cf6fa74b9b5e1d403`
SHA512	`3044d92ef355c2665b652810f18acc9cee27d88a63265510e677455ac6a41666455fc8a7aed05f077f08e75f350b59bf16fef971ec2948b423187f7051068daa`
CRC32	`9E668674`
ssdeep	`None`
Yara	SEH__vba - (no description)

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6585859

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	July 2, 2025, 12:12 p.m.	July 2, 2025, 12:22 p.m.	577 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-06-24 21:29:14,030 [analyzer] DEBUG: Starting analyzer from: C:\tmp4w2pkt
2025-06-24 21:29:14,062 [analyzer] DEBUG: Pipe server name: \??\PIPE\rnRGzHVPkwzKHGLtTaBVfwJwgUt
2025-06-24 21:29:14,062 [analyzer] DEBUG: Log pipe server name: \??\PIPE\eAViAtWxngGJdHpSGUjOlLpBzPlh
2025-06-24 21:29:14,062 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-06-24 21:29:14,078 [analyzer] INFO: Automatically selected analysis package "exe"
2025-06-24 21:29:14,733 [analyzer] DEBUG: Started auxiliary module Curtain
2025-06-24 21:29:14,733 [analyzer] DEBUG: Started auxiliary module DbgView
2025-06-24 21:29:15,328 [analyzer] DEBUG: Started auxiliary module Disguise
2025-06-24 21:29:15,592 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-06-24 21:29:15,608 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-06-24 21:29:15,608 [analyzer] DEBUG: Started auxiliary module Human
2025-06-24 21:29:15,625 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-06-24 21:29:15,625 [analyzer] DEBUG: Started auxiliary module Reboot
2025-06-24 21:29:15,717 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-06-24 21:29:15,717 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-06-24 21:29:15,717 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-06-24 21:29:15,717 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-06-24 21:29:15,983 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\3edb27daf6f653f5_unicorn-24005.exe' with arguments '' and pid 216
2025-06-24 21:29:16,250 [analyzer] DEBUG: Loaded monitor into process with pid 216
2025-06-24 21:29:19,342 [analyzer] INFO: Added new file to list with pid 216 and path C:\Users\Administrator\AppData\Local\Temp\Unicorn-28488.exe
2025-06-24 21:29:19,467 [analyzer] INFO: Injected into process with pid 2288 and name u'Unicorn-28488.exe'
2025-06-24 21:29:19,671 [analyzer] DEBUG: Loaded monitor into process with pid 2288
2025-06-24 21:32:35,000 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-06-24 21:32:35,967 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-06-24 21:32:35,967 [lib.api.process] INFO: Successfully terminated process with pid 216.
2025-06-24 21:32:35,967 [lib.api.process] INFO: Successfully terminated process with pid 2288.
2025-06-24 21:32:35,983 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-07-02 12:12:50,473 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:51,493 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:52,525 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:53,597 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:54,633 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:55,662 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:56,688 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:57,713 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:58,744 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:12:59,776 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:00,832 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:03,733 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:04,810 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:05,900 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:07,006 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:08,077 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:09,164 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:10,251 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:11,305 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:12,575 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:13,661 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:14,743 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:15,805 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:16,881 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:17,952 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:19,251 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:20,324 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:21,380 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:22,846 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:23,881 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:24,936 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:25,966 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:26,995 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:28,029 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:29,288 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:30,393 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:31,636 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:32,849 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:33,916 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:34,979 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:36,219 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:37,283 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:38,326 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:39,363 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:40,397 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:41,779 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:42,830 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:44,150 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:45,197 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:46,241 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:47,272 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:48,309 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:49,347 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:50,379 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:51,424 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:52,517 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:53,555 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:54,610 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:55,656 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:56,701 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:57,737 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:13:58,887 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:00,195 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:01,251 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:02,297 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:03,359 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:04,536 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:05,626 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:06,761 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:07,857 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:09,195 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:10,311 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:11,407 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:12,512 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:13,573 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:14,681 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:15,768 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:16,868 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:17,959 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:19,061 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:20,154 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:21,217 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:22,273 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:23,365 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:24,426 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:25,812 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:26,837 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:28,042 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:29,523 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:30,982 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:32,047 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:33,112 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:34,168 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:35,213 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:36,267 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:37,325 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:38,399 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:39,583 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:40,609 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:41,681 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:42,720 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:43,760 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:44,822 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:46,027 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:47,072 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:48,096 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:49,136 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:50,178 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:51,232 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:52,319 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:53,377 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:54,564 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:55,772 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:57,271 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:58,371 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:14:59,439 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:15:00,481 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:15:01,775 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:15:02,831 [cuckoo.core.scheduler] DEBUG: Task #6631139: no machine available yet
2025-07-02 12:15:03,875 [cuckoo.core.scheduler] INFO: Task #6631139: acquired machine win7x6423 (label=win7x6423)
2025-07-02 12:15:03,881 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.223 for task #6631139
2025-07-02 12:15:04,346 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 2754213 (interface=vboxnet0, host=192.168.168.223)
2025-07-02 12:15:06,430 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6423
2025-07-02 12:15:13,695 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6423 to vmcloak
2025-07-02 12:17:04,604 [cuckoo.core.guest] INFO: Starting analysis #6631139 on guest (id=win7x6423, ip=192.168.168.223)
2025-07-02 12:17:05,611 [cuckoo.core.guest] DEBUG: win7x6423: not ready yet
2025-07-02 12:17:10,654 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6423, ip=192.168.168.223)
2025-07-02 12:17:10,738 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6423, ip=192.168.168.223, monitor=latest, size=6660546)
2025-07-02 12:17:12,351 [cuckoo.core.resultserver] DEBUG: Task #6631139: live log analysis.log initialized.
2025-07-02 12:17:14,058 [cuckoo.core.resultserver] DEBUG: Task #6631139 is sending a BSON stream
2025-07-02 12:17:14,511 [cuckoo.core.resultserver] DEBUG: Task #6631139 is sending a BSON stream
2025-07-02 12:17:15,544 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'shots/0001.jpg'
2025-07-02 12:17:15,595 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 133483
2025-07-02 12:17:17,941 [cuckoo.core.resultserver] DEBUG: Task #6631139 is sending a BSON stream
2025-07-02 12:17:19,843 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'shots/0002.jpg'
2025-07-02 12:17:19,858 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 137663
2025-07-02 12:17:24,078 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'shots/0003.jpg'
2025-07-02 12:17:24,119 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 127062
2025-07-02 12:17:27,087 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:17:27,505 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'shots/0004.jpg'
2025-07-02 12:17:27,600 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 126224
2025-07-02 12:17:29,701 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'shots/0005.jpg'
2025-07-02 12:17:29,713 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 110199
2025-07-02 12:17:37,148 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'shots/0006.jpg'
2025-07-02 12:17:37,325 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 109547
2025-07-02 12:17:42,287 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:17:57,474 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:18:12,801 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:18:28,179 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:18:43,322 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:18:58,746 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:19:14,073 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:19:29,202 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:19:44,613 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:20:00,000 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:20:15,531 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:20:30,689 [cuckoo.core.guest] DEBUG: win7x6423: analysis #6631139 still processing
2025-07-02 12:20:33,579 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'curtain/1750793555.19.curtain.log'
2025-07-02 12:20:33,582 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 36
2025-07-02 12:20:34,280 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'sysmon/1750793555.89.sysmon.xml'
2025-07-02 12:20:34,355 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 8629882
2025-07-02 12:20:34,377 [cuckoo.core.resultserver] DEBUG: Task #6631139: File upload for 'files/b6c012b09a95105c_unicorn-28488.exe'
2025-07-02 12:20:34,389 [cuckoo.core.resultserver] DEBUG: Task #6631139 uploaded file length: 479243
2025-07-02 12:20:34,402 [cuckoo.core.resultserver] DEBUG: Task #6631139 had connection reset for <Context for LOG>
2025-07-02 12:20:36,737 [cuckoo.core.guest] INFO: win7x6423: analysis completed successfully
2025-07-02 12:20:36,777 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-07-02 12:20:36,810 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-07-02 12:20:37,826 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6423 to path /srv/cuckoo/cwd/storage/analyses/6631139/memory.dmp
2025-07-02 12:20:37,833 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6423
2025-07-02 12:22:26,970 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.223 for task #6631139
2025-07-02 12:22:27,719 [cuckoo.core.scheduler] DEBUG: Released database task #6631139
2025-07-02 12:22:27,744 [cuckoo.core.scheduler] INFO: Task #6631139: analysis procedure completed

Signatures

Yara rule detected for file (1 event)

description

(no description)

rule

SEH__vba

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ June 24, 2025, 10:29 p.m.	stacktrace: IID_IVbaHost+0x236f3 UserDllMain-0x41bc4 msvbvm60+0x51d33 @ 0x72991d33 3edb27daf6f653f5_unicorn-24005+0x297de @ 0x4297de IID_IVbaHost+0x239f4 UserDllMain-0x418c3 msvbvm60+0x52034 @ 0x72992034 IID_IVbaHost+0x23e5b UserDllMain-0x4145c msvbvm60+0x5249b @ 0x7299249b IID_IVbaHost+0x24027 UserDllMain-0x41290 msvbvm60+0x52667 @ 0x72992667 DllCanUnloadNow+0x1c1d9 DllRegisterServer-0xa1b8 msvbvm60+0xbbe8b @ 0x729fbe8b IID_IVbaHost+0x2e809 UserDllMain-0x36aae msvbvm60+0x5ce49 @ 0x7299ce49 IID_IVbaHost+0x3133d UserDllMain-0x33f7a msvbvm60+0x5f97d @ 0x7299f97d gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75e762fa GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75e76d3a CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x75e777c4 DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75e77bca __vbaStrToAnsi+0x2f1 EbGetObjConnectionCounts-0x479 msvbvm60+0xa6c8 @ 0x7294a6c8 __vbaStrToAnsi+0x268 EbGetObjConnectionCounts-0x502 msvbvm60+0xa63f @ 0x7294a63f __vbaStrToAnsi+0x146 EbGetObjConnectionCounts-0x624 msvbvm60+0xa51d @ 0x7294a51d exception.instruction_r: ff 15 d0 10 4b 00 83 c4 0c 8d 4d c0 51 8d 55 c4 exception.symbol: 3edb27daf6f653f5_unicorn-24005+0x2ab99 exception.instruction: call dword ptr [0x4b10d0] exception.module: 3edb27daf6f653f5_unicorn-24005.exe exception.exception_code: 0xc0000005 exception.offset: 175001 exception.address: 0x42ab99 registers.esp: 1636932 registers.edi: 1637180 registers.eax: 1637116 registers.ebp: 1637168 registers.edx: 1637112 registers.ebx: 1 registers.esi: 1637388 registers.ecx: 6622792	1	0	0
__exception__ June 24, 2025, 10:29 p.m.	stacktrace: BASIC_CLASS_QueryInterface+0xf52 EbLoadRunTime-0x131c msvbvm60+0x7bc6 @ 0x72947bc6 BASIC_CLASS_QueryInterface+0xe61 EbLoadRunTime-0x140d msvbvm60+0x7ad5 @ 0x72947ad5 ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981 ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600 unicorn-28488+0x13de @ 0x4013de RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x77599f72 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x77599f45 exception.instruction_r: 89 11 e9 5e 88 fe ff c7 45 fc 07 00 00 00 33 db exception.symbol: BASIC_CLASS_Release+0x11cb3 IID_IVbaHost-0xdf34 msvbvm60+0x2070c exception.instruction: mov dword ptr [ecx], edx exception.module: MSVBVM60.DLL exception.exception_code: 0xc0000005 exception.offset: 132876 exception.address: 0x7296070c registers.esp: 1637348 registers.edi: 4364280 registers.eax: 4362880 registers.ebp: 1638000 registers.edx: 0 registers.ebx: 0 registers.esi: 4374572 registers.ecx: 943898624	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

June 24, 2025, 10:29 p.m.

stacktrace:

IID_IVbaHost+0x236f3 UserDllMain-0x41bc4 msvbvm60+0x51d33 @ 0x72991d33
3edb27daf6f653f5_unicorn-24005+0x297de @ 0x4297de
IID_IVbaHost+0x239f4 UserDllMain-0x418c3 msvbvm60+0x52034 @ 0x72992034
IID_IVbaHost+0x23e5b UserDllMain-0x4145c msvbvm60+0x5249b @ 0x7299249b
IID_IVbaHost+0x24027 UserDllMain-0x41290 msvbvm60+0x52667 @ 0x72992667
DllCanUnloadNow+0x1c1d9 DllRegisterServer-0xa1b8 msvbvm60+0xbbe8b @ 0x729fbe8b
IID_IVbaHost+0x2e809 UserDllMain-0x36aae msvbvm60+0x5ce49 @ 0x7299ce49
IID_IVbaHost+0x3133d UserDllMain-0x33f7a msvbvm60+0x5f97d @ 0x7299f97d
gapfnScSendMessage+0x332 GetAppCompatFlags2-0x8ea user32+0x162fa @ 0x75e762fa
GetThreadDesktop+0xd7 GetWindowLongW-0x2c4 user32+0x16d3a @ 0x75e76d3a
CharPrevW+0x138 TranslateMessage-0x45 user32+0x177c4 @ 0x75e777c4
DispatchMessageA+0xf GetMessageA-0x9 user32+0x17bca @ 0x75e77bca
__vbaStrToAnsi+0x2f1 EbGetObjConnectionCounts-0x479 msvbvm60+0xa6c8 @ 0x7294a6c8
__vbaStrToAnsi+0x268 EbGetObjConnectionCounts-0x502 msvbvm60+0xa63f @ 0x7294a63f
__vbaStrToAnsi+0x146 EbGetObjConnectionCounts-0x624 msvbvm60+0xa51d @ 0x7294a51d

exception.instruction_r: ff 15 d0 10 4b 00 83 c4 0c 8d 4d c0 51 8d 55 c4
exception.symbol: 3edb27daf6f653f5_unicorn-24005+0x2ab99
exception.instruction: call dword ptr [0x4b10d0]
exception.module: 3edb27daf6f653f5_unicorn-24005.exe
exception.exception_code: 0xc0000005
exception.offset: 175001
exception.address: 0x42ab99
registers.esp: 1636932
registers.edi: 1637180
registers.eax: 1637116
registers.ebp: 1637168
registers.edx: 1637112
registers.ebx: 1
registers.esi: 1637388
registers.ecx: 6622792

__exception__

June 24, 2025, 10:29 p.m.

stacktrace:

BASIC_CLASS_QueryInterface+0xf52 EbLoadRunTime-0x131c msvbvm60+0x7bc6 @ 0x72947bc6
BASIC_CLASS_QueryInterface+0xe61 EbLoadRunTime-0x140d msvbvm60+0x7ad5 @ 0x72947ad5
ThunRTMain+0x3dd EbCreateContext-0x2e36 msvbvm60+0x3981 @ 0x72943981
ThunRTMain+0x156 EbCreateContext-0x30bd msvbvm60+0x36fa @ 0x729436fa
ThunRTMain+0x5c EbCreateContext-0x31b7 msvbvm60+0x3600 @ 0x72943600
unicorn-28488+0x13de @ 0x4013de
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa5 ntdll+0x39f72 @ 0x77599f72
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xd2 ntdll+0x39f45 @ 0x77599f45

exception.instruction_r: 89 11 e9 5e 88 fe ff c7 45 fc 07 00 00 00 33 db
exception.symbol: BASIC_CLASS_Release+0x11cb3 IID_IVbaHost-0xdf34 msvbvm60+0x2070c
exception.instruction: mov dword ptr [ecx], edx
exception.module: MSVBVM60.DLL
exception.exception_code: 0xc0000005
exception.offset: 132876
exception.address: 0x7296070c
registers.esp: 1637348
registers.edi: 4364280
registers.eax: 4362880
registers.ebp: 1638000
registers.edx: 0
registers.ebx: 0
registers.esi: 4374572
registers.ecx: 943898624

Foreign language identified in PE resource (1 event)

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000747c4

size

0x00000234

Creates executable files on the filesystem (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\Unicorn-28488.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\Unicorn-28488.exe

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 24, 2025, 10:29 p.m.	process_identifier: 216 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 24576 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x00330000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x0002b000', u'virtual_address': u'0x00001000', u'entropy': 7.571651483112819, u'name': u'.text', u'virtual_size': u'0x0002a5c4'}

entropy

7.57165148311

description

A section with a high entropy has been found

entropy

0.370689655172

description

Overall entropy of this PE file is high

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Generic.Dacic.94CCEEA9.A.009F1AA1 (Engine A), Win32.Trojan.PSE.1FY1FUT (Engine B)
Avast Core Security (Linux)	Win32:Evo-gen [Trj]
C4S ClamAV (Linux)	Win.Packed.Generic-9967832-0
Trend Micro SProtect (Linux)	Trojan.Win32.FAREIT.SME
WithSecure (Linux)	Trojan.TR/Crypt.XPACK.Gen
eScan Antivirus (Linux)	Generic.Dacic.94CCEEA9.A.009F1AA1(DB)
ESET Security (Windows)	a variant of Win32/VBClone.E trojan
Sophos Anti-Virus (Linux)	Troj/VB-KCP
DrWeb Antivirus (Linux)	Trojan.Siggen29.56020
ClamAV (Linux)	Win.Packed.Generic-9967832-0
Bitdefender Antivirus (Linux)	Generic.Dacic.94CCEEA9.A.009F1AA1
Kaspersky Standard (Windows)	Trojan.Win32.VB.dosq
Emsisoft Commandline Scanner (Windows)	Generic.Dacic.94CCEEA9.A.009F1AA1 (B)