Cuckoo Sandbox

File 0c5e20db2c78bb68_winhelp34.exe

Summary
Download Resubmit sample

Size	74.4KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`755c1fd0127b434d56e9a4f59fa8f0b1`
SHA1	`27a2e06db74bfc20c49c4e3130aefc3cbff1e33e`
SHA256	`0c5e20db2c78bb68194a65f5f67391c5f782e2cedf02d87293c3e6484ad59a7e`
SHA512	`39f34118e958fa3ba9eda4394ae6a7655bdca2e5b08fb2a64fd80e6c4531a2b8fd96e2c357334e5cc578d32a1d5c8197050d2bd6254cae801ca730cf881e2c54`
CRC32	`33E5A53B`
ssdeep	`None`
Yara	RSharedStrings - identifiers for remote and gmremote

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:6920100

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	Sept. 1, 2025, 7:31 p.m.	Sept. 1, 2025, 7:35 p.m.	230 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-08-28 16:56:01,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpl4240h
2025-08-28 16:56:01,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\DazpfYKDiYGFwibBfsRRHxzSxGR
2025-08-28 16:56:01,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\dObFpYgbJitlcVlBaQKnU
2025-08-28 16:56:01,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-08-28 16:56:01,030 [analyzer] INFO: Automatically selected analysis package "exe"
2025-08-28 16:56:01,312 [analyzer] DEBUG: Started auxiliary module Curtain
2025-08-28 16:56:01,312 [analyzer] DEBUG: Started auxiliary module DbgView
2025-08-28 16:56:01,812 [analyzer] DEBUG: Started auxiliary module Disguise
2025-08-28 16:56:02,030 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-08-28 16:56:02,030 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-08-28 16:56:02,030 [analyzer] DEBUG: Started auxiliary module Human
2025-08-28 16:56:02,030 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-08-28 16:56:02,030 [analyzer] DEBUG: Started auxiliary module Reboot
2025-08-28 16:56:02,062 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-08-28 16:56:02,062 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-08-28 16:56:02,078 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-08-28 16:56:02,078 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-08-28 16:56:02,203 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\0c5e20db2c78bb68_winhelp34.exe' with arguments '' and pid 636
2025-08-28 16:56:02,375 [analyzer] DEBUG: Loaded monitor into process with pid 636
2025-08-28 16:56:02,390 [analyzer] INFO: Added new file to list with pid 636 and path C:\Users\Administrator\AppData\Local\Temp\24722953.reg
2025-08-28 16:56:02,467 [analyzer] INFO: Injected into process with pid 1940 and name u'regedit.exe'
2025-08-28 16:56:02,483 [analyzer] INFO: Added new file to list with pid 636 and path C:\Windows\SysWOW64\WinHelp53.exe
2025-08-28 16:56:02,687 [analyzer] DEBUG: Loaded monitor into process with pid 1940
2025-08-28 16:56:03,203 [analyzer] INFO: Process with pid 1940 has terminated
2025-08-28 16:56:07,108 [analyzer] INFO: Injected into process with pid 2456 and name u'WinHelp53.exe'
2025-08-28 16:56:07,203 [analyzer] INFO: Process with pid 636 has terminated
2025-08-28 16:56:07,250 [analyzer] DEBUG: Loaded monitor into process with pid 2456
2025-08-28 16:56:07,342 [analyzer] INFO: Injected into process with pid 2168 and name u'svchost.exe'
2025-08-28 16:56:08,203 [analyzer] INFO: Process with pid 2456 has terminated
2025-08-28 16:56:09,203 [analyzer] INFO: Process with pid 2168 has terminated
2025-08-28 16:56:09,203 [analyzer] INFO: Process list is empty, terminating analysis.
2025-08-28 16:56:10,453 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-08-28 16:56:10,467 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-09-01 19:31:32,523 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:33,573 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:34,597 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:35,621 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:36,661 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:37,683 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:38,708 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:39,731 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:40,750 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:41,770 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:42,907 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:44,100 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:45,127 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:46,145 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:47,170 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:48,191 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:49,226 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:50,244 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:51,261 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:52,285 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:53,308 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:54,329 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:55,346 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:56,384 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:57,406 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:58,424 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:31:59,442 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:00,457 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:01,479 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:02,509 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:03,527 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:04,548 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:05,568 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:06,654 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:07,689 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:08,722 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:09,766 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:10,791 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:11,830 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:12,884 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:14,049 [cuckoo.core.scheduler] DEBUG: Task #6945081: no machine available yet
2025-09-01 19:32:15,098 [cuckoo.core.scheduler] INFO: Task #6945081: acquired machine win7x649 (label=win7x649)
2025-09-01 19:32:15,099 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.209 for task #6945081
2025-09-01 19:32:15,533 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 404513 (interface=vboxnet0, host=192.168.168.209)
2025-09-01 19:32:15,830 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x649
2025-09-01 19:32:16,567 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x649 to vmcloak
2025-09-01 19:33:48,420 [cuckoo.core.guest] INFO: Starting analysis #6945081 on guest (id=win7x649, ip=192.168.168.209)
2025-09-01 19:33:49,425 [cuckoo.core.guest] DEBUG: win7x649: not ready yet
2025-09-01 19:33:54,446 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x649, ip=192.168.168.209)
2025-09-01 19:33:54,540 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x649, ip=192.168.168.209, monitor=latest, size=6660546)
2025-09-01 19:33:55,781 [cuckoo.core.resultserver] DEBUG: Task #6945081: live log analysis.log initialized.
2025-09-01 19:33:56,767 [cuckoo.core.resultserver] DEBUG: Task #6945081 is sending a BSON stream
2025-09-01 19:33:57,094 [cuckoo.core.resultserver] DEBUG: Task #6945081 is sending a BSON stream
2025-09-01 19:33:57,394 [cuckoo.core.resultserver] DEBUG: Task #6945081 is sending a BSON stream
2025-09-01 19:33:57,992 [cuckoo.core.resultserver] DEBUG: Task #6945081: File upload for 'shots/0001.jpg'
2025-09-01 19:33:58,273 [cuckoo.core.resultserver] DEBUG: Task #6945081 uploaded file length: 133489
2025-09-01 19:34:01,986 [cuckoo.core.resultserver] DEBUG: Task #6945081 is sending a BSON stream
2025-09-01 19:34:02,190 [cuckoo.core.resultserver] DEBUG: Task #6945081: File upload for 'files/0c5e20db2c78bb68_0c5e20db2c78bb68_winhelp34.exe'
2025-09-01 19:34:02,195 [cuckoo.core.resultserver] DEBUG: Task #6945081 uploaded file length: 76200
2025-09-01 19:34:05,203 [cuckoo.core.resultserver] DEBUG: Task #6945081: File upload for 'curtain/1756392970.33.curtain.log'
2025-09-01 19:34:05,206 [cuckoo.core.resultserver] DEBUG: Task #6945081 uploaded file length: 36
2025-09-01 19:34:05,261 [cuckoo.core.resultserver] DEBUG: Task #6945081: File upload for 'sysmon/1756392970.45.sysmon.xml'
2025-09-01 19:34:05,282 [cuckoo.core.resultserver] DEBUG: Task #6945081: File upload for 'files/5dafc45dbec64514_winhelp53.exe'
2025-09-01 19:34:05,303 [cuckoo.core.resultserver] DEBUG: Task #6945081: File upload for 'files/eb01f810b76025ba_24722953.reg'
2025-09-01 19:34:05,305 [cuckoo.core.resultserver] DEBUG: Task #6945081 uploaded file length: 384
2025-09-01 19:34:05,307 [cuckoo.core.resultserver] DEBUG: Task #6945081 uploaded file length: 77533
2025-09-01 19:34:05,309 [cuckoo.core.resultserver] DEBUG: Task #6945081 had connection reset for <Context for LOG>
2025-09-01 19:34:05,311 [cuckoo.core.resultserver] DEBUG: Task #6945081 uploaded file length: 810602
2025-09-01 19:34:07,446 [cuckoo.core.guest] INFO: win7x649: analysis completed successfully
2025-09-01 19:34:07,459 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-09-01 19:34:07,486 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-09-01 19:34:08,464 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x649 to path /srv/cuckoo/cwd/storage/analyses/6945081/memory.dmp
2025-09-01 19:34:08,465 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x649
2025-09-01 19:35:12,121 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.209 for task #6945081
2025-09-01 19:35:12,561 [cuckoo.core.scheduler] DEBUG: Released database task #6945081
2025-09-01 19:35:12,590 [cuckoo.core.scheduler] INFO: Task #6945081: analysis procedure completed

Signatures

Yara rule detected for file (1 event)

description

identifiers for remote and gmremote

rule

RSharedStrings

Allocates read-write-execute memory (usually to unpack itself) (50 out of 172 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 53248 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13152000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13151000 process_handle: 0xffffffff	1

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.ex_cod
section	.ex_rsc
section	.ccc

The executable uses a known packer (1 event)

packer

eXPressor v1.3 -> CGSoftLabs

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Foreign language identified in PE resource (3 events)

name

RT_ICON

language

LANG_CHINESE

filetype

Device independent bitmap graphic, 48 x 96 x 32, image size 9216

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000140f0

size

0x000025a8

name

RT_GROUP_ICON

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x00016698

size

0x00000014

name

RT_VERSION

language

LANG_CHINESE

filetype

data

sublanguage

SUBLANG_CHINESE_SIMPLIFIED

offset

0x000166ac

size

0x00000348

Creates executable files on the filesystem (2 events)

file	C:\Windows\System32\WinHelp53.exe
file	C:\Users\Administrator\AppData\Local\Temp\24722953.reg

Creates a suspicious process (1 event)

cmdline

C:\Windows\system32\svchost.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\Administrator\AppData\Local\Temp\0c5e20db2c78bb68_winhelp34.exe

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00005dcf', u'virtual_address': u'0x00001000', u'entropy': 7.260986913236932, u'name': u'.data', u'virtual_size': u'0x00011000'}

entropy

7.26098691324

description

A section with a high entropy has been found

entropy

0.419585917708

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Aug. 28, 2025, 5:56 p.m.	system_name: privilege_name: SeShutdownPrivilege	1	1	0

One or more of the buffers contains an embedded PE file (1 event)

buffer

Buffer with sha1: 3fc7abd6d2afa0be1e869efa62814119bb2e0260

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 2168 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000f0	1	0	0

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{CFF8FD86-05DB-4990-92A9-0EE5FDFB7BFE}\stubpath

reg_value

C:\Windows\system32\WinHelp53.exe

Creates a thread using CreateRemoteThread in a non-child process indicative of process injection (2 events)

Process injection

Process 2456 created a remote thread in non-child process 2168

Time & API	Arguments	Status	Return	Repeated
CreateRemoteThread Aug. 28, 2025, 5:56 p.m.	thread_identifier: 0 process_identifier: 2168 function_address: 0x13157d20 flags: 0 stack_size: 0 parameter: 0x13150000 process_handle: 0x000000f0	1	236	0

Manipulates memory of a non-child process indicative of process injection (2 events)

Process injection

Process 2456 manipulating memory of non-child process 2168

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Aug. 28, 2025, 5:56 p.m.	process_identifier: 2168 region_size: 98304 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x13150000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000000f0	1	0	0

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Gen:Variant.Barys.494697 (Engine A)
Avast Core Security (Linux)	Win32:MalwareX-gen [Trj]
C4S ClamAV (Linux)	Win.Dropper.Gh0stRAT-7645027-0
Trellix (Linux)	Generic Malware.dq trojan
WithSecure (Linux)	Trojan.TR/Crypt.XPACK.Gen
eScan Antivirus (Linux)	Gen:Variant.Barys.494697(DB)
ESET Security (Windows)	Win32/Farfli.AAG trojan
Sophos Anti-Virus (Linux)	Troj/Farfli-DL
DrWeb Antivirus (Linux)	Trojan.DownLoad3.17387
ClamAV (Linux)	Win.Dropper.Gh0stRAT-7645027-0
Bitdefender Antivirus (Linux)	Gen:Variant.Barys.494697
Kaspersky Standard (Windows)	HEUR:Trojan-Dropper.Win32.Injector.gen
Emsisoft Commandline Scanner (Windows)	Gen:Variant.Barys.494697 (B)

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File 0c5e20db2c78bb68_winhelp34.exe

Summary Download Resubmit sample

Score

Autosubmit

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample