Cuckoo Sandbox

File 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f

Summary
Download Resubmit sample

Size	2.0MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`9902e8cf90cacd7fb644fcae2ce2a8a2`
SHA1	`46c78df5524625e7ec36893c57b1cbcb9b5c1c9f`
SHA256	`676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f`
SHA512	`f4eaaf8da310415685b865546bcb5cef5c91f4bdf13ca4cf89694b1a61bca83e2dc242fae9fbb45d0b4f75662c1b20d50b2c86eaa0421e3338f2b10aa3b3dab4`
CRC32	`44F27269`
ssdeep	`None`
Yara	DebuggerException__SetConsoleCtrl - (no description) win_mutex - Create or check mutex win_registry - Affect system registries win_files_operation - Affect private profile

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

7007508

7007509

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis

Category	Started	Completed	Duration	Routing	Logs
FILE	Sept. 25, 2025, 7:08 a.m.	Sept. 25, 2025, 7:15 a.m.	370 seconds	internet	Show Analyzer Log Show Cuckoo Log

Analyzer Log

2025-09-22 21:05:05,015 [analyzer] DEBUG: Starting analyzer from: C:\tmp1xmcit
2025-09-22 21:05:05,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\DOziCdcRwgSfMuzTXLumdnjOEs
2025-09-22 21:05:05,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\KNZTdFNbHAVUAjcfxHLOu
2025-09-22 21:05:05,265 [analyzer] DEBUG: Started auxiliary module Curtain
2025-09-22 21:05:05,265 [analyzer] DEBUG: Started auxiliary module DbgView
2025-09-22 21:05:05,828 [analyzer] DEBUG: Started auxiliary module Disguise
2025-09-22 21:05:06,030 [analyzer] DEBUG: Loaded monitor into process with pid 508
2025-09-22 21:05:06,030 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-09-22 21:05:06,030 [analyzer] DEBUG: Started auxiliary module Human
2025-09-22 21:05:06,030 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-09-22 21:05:06,030 [analyzer] DEBUG: Started auxiliary module Reboot
2025-09-22 21:05:06,078 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-09-22 21:05:06,078 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-09-22 21:05:06,078 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-09-22 21:05:06,078 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-09-22 21:05:06,265 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe' with arguments '' and pid 2236
2025-09-22 21:05:06,453 [analyzer] DEBUG: Loaded monitor into process with pid 2236
2025-09-22 21:05:07,405 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Windows6g2yf6t03h
2025-09-22 21:05:07,437 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Program Files\Common Files\Microsoft Shared\9k8bf2i uncut aqp9g9a  (Sandy,ynve4mgf).rar.exe
2025-09-22 21:05:07,687 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Program Files\DVD Maker\Shared\beast d2jspkm3 .rar.exe
2025-09-22 21:05:07,983 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Program Files\Microsoft Office\Templates\xiwlzi0 4fq06c horse srpvkzygmcsw titts 45ld689 .mpg.exe
2025-09-22 21:05:08,000 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\tvolgth nude xxx big glans .avi.exe
2025-09-22 21:05:08,140 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Program Files\Windows Journal\Templates\z8dvsxk 6r3apw4 qcjxxhb .zip.exe
2025-09-22 21:05:08,250 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Program Files\Windows Sidebar\Shared Gadgets\7smpob5w y6go35p sperm girls titts shoes  (gia9m99).avi.exe
2025-09-22 21:05:08,390 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Program Files (x86)\Common Files\microsoft shared\xiwlzi0 horse 4mvc8yaot j8bb56pcl4 50+ .zip.exe
2025-09-22 21:05:08,717 [analyzer] INFO: Injected into process with pid 2164 and name ''
2025-09-22 21:05:08,858 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\vftv0ou y6go35p xxx 6mjj01 cock .rar.exe
2025-09-22 21:05:08,875 [analyzer] DEBUG: Loaded monitor into process with pid 2164
2025-09-22 21:05:08,953 [analyzer] INFO: Added new file to list with pid 2236 and path C:\ProgramData\Microsoft\RAC\Temp\ovqqw9 horse z8dvsxk f6br2s2 cock .avi.exe
2025-09-22 21:05:09,000 [analyzer] INFO: Added new file to list with pid 2236 and path C:\ProgramData\Microsoft\Search\Data\Temp\ovqqw9 jmmawhs l8qccpyq kmozxo .mpg.exe
2025-09-22 21:05:09,062 [analyzer] INFO: Added new file to list with pid 2236 and path C:\ProgramData\Microsoft\Windows\Templates\tvolgth 9oypb8 6r3apw4 j8bb56pcl4 sm .mpeg.exe
2025-09-22 21:05:09,155 [analyzer] INFO: Added new file to list with pid 2236 and path C:\ProgramData\Microsoft\Windows\Templates\horse 6r3apw4 young .mpeg.exe
2025-09-22 21:05:09,625 [analyzer] INFO: Added new file to list with pid 2236 and path C:\tmp1xmcit\xiwlzi0 mtu2oyuh5 xxx d2jspkm3 .mpeg.exe
2025-09-22 21:05:09,765 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\6r3apw4 j8bb56pcl4 .avi.exe
2025-09-22 21:05:09,875 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Administrator\AppData\Local\Temp\z8dvsxk girls glans .mpeg.exe
2025-09-22 21:05:09,890 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Administrator\AppData\Local\Temp\mozilla-temp-files\tvolgth uv0dxwt8x4m beast [bangbus] o2de75il .zip.exe
2025-09-22 21:05:09,905 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\yn0pxd ko6o6a beast j8bb56pcl4 .rar.exe
2025-09-22 21:05:10,155 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Administrator\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\yn0pxd horse horse [milf] titts .mpg.exe
2025-09-22 21:05:10,280 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\7smpob5w jmmawhs gay [free] ttbp10m .avi.exe
2025-09-22 21:05:10,375 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\7smpob5w porn a3xo5xtn d2jspkm3  (Sarah).rar.exe
2025-09-22 21:05:10,467 [analyzer] INFO: Added new file to list with pid 2236 and path C:\ProgramData\Microsoft\RAC\Temp\27bjd3d2x horse 4mvc8yaot 6r3apw4 feet nr8wosn .zip.exe
2025-09-22 21:05:10,515 [analyzer] INFO: Added new file to list with pid 2236 and path C:\ProgramData\Microsoft\Search\Data\Temp\9k8bf2i kmozxo ash  (a89thik,Jade).zip.exe
2025-09-22 21:05:10,578 [analyzer] INFO: Added new file to list with pid 2236 and path C:\ProgramData\Microsoft\Windows\Templates\ovqqw9 mtu2oyuh5 6r3apw4 [bangbus]  (ysxdgxr).avi.exe
2025-09-22 21:05:10,640 [analyzer] INFO: Added new file to list with pid 2236 and path C:\ProgramData\Microsoft\Windows\Templates\cw4ymo3u y6go35p 4mvc8yaot kc2hrt2j fishy  (Gina,gia9m99).mpeg.exe
2025-09-22 21:05:10,671 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\l8qccpyq j8bb56pcl4 sm  (Jenna,5qcarib).zip.exe
2025-09-22 21:05:10,703 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Default\AppData\Local\Temp\r2qc46i jmmawhs 6r3apw4 d2jspkm3 rqmct8k1i30 .mpg.exe
2025-09-22 21:05:10,733 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\z8dvsxk [bangbus]  (Jade).zip.exe
2025-09-22 21:05:10,796 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\r2qc46i mtu2oyuh5 z8dvsxk d2jspkm3  (ysxdgxr).zip.exe
2025-09-22 21:05:10,828 [analyzer] INFO: Added new file to list with pid 2236 and path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\ovqqw9 jmmawhs sperm 6r3apw4 aqp9g9a .rar.exe
2025-09-22 21:05:35,265 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2025-09-22 21:05:35,671 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-09-22 21:05:35,671 [lib.api.process] INFO: Successfully terminated process with pid 2236.
2025-09-22 21:05:35,671 [lib.api.process] INFO: Successfully terminated process with pid 2164.
2025-09-22 21:05:36,390 [analyzer] WARNING: Too many files: c:\users\default\appdata\local\microsoft\windows\temporary internet files\l8qccpyq j8bb56pcl4 sm  (jenna,5qcarib).zip.exe
2025-09-22 21:05:36,390 [analyzer] WARNING: Too many files: c:\users\administrator\appdata\local\microsoft\windows\temporary internet files\yn0pxd ko6o6a beast j8bb56pcl4 .rar.exe
2025-09-22 21:05:36,390 [analyzer] WARNING: Too many files: c:\programdata\microsoft\windows\templates\ovqqw9 mtu2oyuh5 6r3apw4 [bangbus]  (ysxdgxr).avi.exe
2025-09-22 21:05:36,390 [analyzer] WARNING: Too many files: c:\programdata\microsoft\search\data\temp\9k8bf2i kmozxo ash  (a89thik,jade).zip.exe
2025-09-22 21:05:36,390 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-09-25 07:08:59,496 [cuckoo.core.scheduler] INFO: Task #6999863: acquired machine win7x6414 (label=win7x6414)
2025-09-25 07:08:59,500 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.214 for task #6999863
2025-09-25 07:09:00,398 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1416772 (interface=vboxnet0, host=192.168.168.214)
2025-09-25 07:09:06,077 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6414
2025-09-25 07:09:07,611 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6414 to vmcloak
2025-09-25 07:12:37,866 [cuckoo.core.guest] INFO: Starting analysis #6999863 on guest (id=win7x6414, ip=192.168.168.214)
2025-09-25 07:12:38,872 [cuckoo.core.guest] DEBUG: win7x6414: not ready yet
2025-09-25 07:12:44,098 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6414, ip=192.168.168.214)
2025-09-25 07:12:44,284 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6414, ip=192.168.168.214, monitor=latest, size=6660546)
2025-09-25 07:12:46,203 [cuckoo.core.resultserver] DEBUG: Task #6999863: live log analysis.log initialized.
2025-09-25 07:12:46,973 [cuckoo.core.resultserver] DEBUG: Task #6999863 is sending a BSON stream
2025-09-25 07:12:47,624 [cuckoo.core.resultserver] DEBUG: Task #6999863 is sending a BSON stream
2025-09-25 07:12:48,182 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'shots/0001.jpg'
2025-09-25 07:12:48,198 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 133480
2025-09-25 07:12:50,140 [cuckoo.core.resultserver] DEBUG: Task #6999863 is sending a BSON stream
2025-09-25 07:13:03,432 [cuckoo.core.guest] DEBUG: win7x6414: analysis #6999863 still processing
2025-09-25 07:13:16,527 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'curtain/1758567935.44.curtain.log'
2025-09-25 07:13:16,537 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 36
2025-09-25 07:13:16,635 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'sysmon/1758567935.62.sysmon.xml'
2025-09-25 07:13:16,677 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1799406
2025-09-25 07:13:16,689 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/31777b18b82c23e2_z8dvsxk girls glans .mpeg.exe'
2025-09-25 07:13:16,697 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 859838
2025-09-25 07:13:16,704 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/1327313487c32e95_yn0pxd horse horse [milf] titts .mpg.exe'
2025-09-25 07:13:16,728 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1927010
2025-09-25 07:13:16,736 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/a848c0768130ef4a_7smpob5w y6go35p sperm girls titts shoes  (gia9m99).avi.exe'
2025-09-25 07:13:16,743 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 766933
2025-09-25 07:13:16,750 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/de2284bf995dbf9b_z8dvsxk 6r3apw4 qcjxxhb .zip.exe'
2025-09-25 07:13:16,757 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 562298
2025-09-25 07:13:16,761 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/21a847d088bd51d3_ovqqw9 jmmawhs sperm 6r3apw4 aqp9g9a .rar.exe'
2025-09-25 07:13:16,900 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1506428
2025-09-25 07:13:16,909 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/74dfc88ccf291063_xiwlzi0 4fq06c horse srpvkzygmcsw titts 45ld689 .mpg.exe'
2025-09-25 07:13:16,911 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/282fce20160b2198_9k8bf2i uncut aqp9g9a  (sandy,ynve4mgf).rar.exe'
2025-09-25 07:13:16,918 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 663107
2025-09-25 07:13:16,933 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1796651
2025-09-25 07:13:16,950 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/7c5c32bec90bb9ce_xiwlzi0 horse 4mvc8yaot j8bb56pcl4 50+ .zip.exe'
2025-09-25 07:13:16,974 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1602806
2025-09-25 07:13:16,985 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/7bd98c6d3e9d9b4d_6r3apw4 j8bb56pcl4 .avi.exe'
2025-09-25 07:13:16,999 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1207123
2025-09-25 07:13:17,011 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/45bcd03cdd2b96b2_ovqqw9 horse z8dvsxk f6br2s2 cock .avi.exe'
2025-09-25 07:13:17,021 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1220486
2025-09-25 07:13:17,036 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/60c1277e8f6e9f42_windows6g2yf6t03h'
2025-09-25 07:13:17,053 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 2033686
2025-09-25 07:13:17,069 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/9776717455cc8c5a_z8dvsxk [bangbus]  (jade).zip.exe'
2025-09-25 07:13:17,087 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 2074649
2025-09-25 07:13:17,104 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/13c6e23b590fade9_vftv0ou y6go35p xxx 6mjj01 cock .rar.exe'
2025-09-25 07:13:17,136 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1717706
2025-09-25 07:13:17,149 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/364bd043a968fc7f_r2qc46i jmmawhs 6r3apw4 d2jspkm3 rqmct8k1i30 .mpg.exe'
2025-09-25 07:13:17,161 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1358082
2025-09-25 07:13:17,171 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/0a017d66cf2b6bb2_horse 6r3apw4 young .mpeg.exe'
2025-09-25 07:13:17,180 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1015720
2025-09-25 07:13:17,186 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/fa9a0b58e812d4ad_tvolgth uv0dxwt8x4m beast [bangbus] o2de75il .zip.exe'
2025-09-25 07:13:17,192 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 683988
2025-09-25 07:13:17,197 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/55266c2bab5683e4_xiwlzi0 mtu2oyuh5 xxx d2jspkm3 .mpeg.exe'
2025-09-25 07:13:17,209 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1435533
2025-09-25 07:13:17,219 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/2206c4c5a024673e_r2qc46i mtu2oyuh5 z8dvsxk d2jspkm3  (ysxdgxr).zip.exe'
2025-09-25 07:13:17,228 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1037989
2025-09-25 07:13:17,248 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/75cccccc29b70c47_tvolgth 9oypb8 6r3apw4 j8bb56pcl4 sm .mpeg.exe'
2025-09-25 07:13:17,263 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1572454
2025-09-25 07:13:17,273 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/872054315f6a70cf_tvolgth nude xxx big glans .avi.exe'
2025-09-25 07:13:17,281 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1044228
2025-09-25 07:13:17,286 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/ae4b89030033ff64_ovqqw9 jmmawhs l8qccpyq kmozxo .mpg.exe'
2025-09-25 07:13:17,292 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 786113
2025-09-25 07:13:17,297 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/8f65c6d23e62ec97_7smpob5w porn a3xo5xtn d2jspkm3  (sarah).rar.exe'
2025-09-25 07:13:17,303 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 664445
2025-09-25 07:13:17,317 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/a43484d20b555720_cw4ymo3u y6go35p 4mvc8yaot kc2hrt2j fishy  (gina,gia9m99).mpeg.exe'
2025-09-25 07:13:17,331 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1696723
2025-09-25 07:13:17,344 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/b88ce6099dffd005_beast d2jspkm3 .rar.exe'
2025-09-25 07:13:17,354 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1311305
2025-09-25 07:13:17,368 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/c4f2484aab56dd9a_27bjd3d2x horse 4mvc8yaot 6r3apw4 feet nr8wosn .zip.exe'
2025-09-25 07:13:17,378 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1271031
2025-09-25 07:13:17,393 [cuckoo.core.resultserver] DEBUG: Task #6999863: File upload for 'files/738c6be50b62bf0f_7smpob5w jmmawhs gay [free] ttbp10m .avi.exe'
2025-09-25 07:13:17,405 [cuckoo.core.resultserver] DEBUG: Task #6999863 uploaded file length: 1715066
2025-09-25 07:13:17,423 [cuckoo.core.resultserver] DEBUG: Task #6999863 had connection reset for <Context for LOG>
2025-09-25 07:13:18,541 [cuckoo.core.guest] INFO: win7x6414: analysis completed successfully
2025-09-25 07:13:18,554 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-09-25 07:13:18,576 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-09-25 07:13:20,893 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6414 to path /srv/cuckoo/cwd/storage/analyses/6999863/memory.dmp
2025-09-25 07:13:20,894 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6414
2025-09-25 07:14:56,932 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.214 for task #6999863
2025-09-25 07:14:59,444 [cuckoo.core.scheduler] DEBUG: Released database task #6999863
2025-09-25 07:15:09,778 [cuckoo.core.scheduler] INFO: Task #6999863: analysis procedure completed

Signatures

Yara rules detected for file (4 events)

description	(no description)	rule	DebuggerException__SetConsoleCtrl
description	Create or check mutex	rule	win_mutex
description	Affect system registries	rule	win_registry
description	Affect private profile	rule	win_files_operation

The executable contains unknown PE section names indicative of a packer (could be a false positive) (2 events)

section	.text\x00\xe5\xfb
section	.data\x00E\x86

The executable uses a known packer (1 event)

packer

Pelles C 3.00, 4.00, 4.50 EXE (X86 CRT-LIB)

A process attempted to delay the analysis task. (1 event)

description

676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe tried to sleep 150 seconds, actually delayed analysis time by 150 seconds

Creates executable files on the filesystem (29 events)

file	C:\ProgramData\Microsoft\Windows\Templates\tvolgth 9oypb8 6r3apw4 j8bb56pcl4 sm .mpeg.exe
file	C:\Users\Default\AppData\Local\Temporary Internet Files\z8dvsxk [bangbus] (Jade).zip.exe
file	C:\Program Files\Windows Sidebar\Shared Gadgets\7smpob5w y6go35p sperm girls titts shoes (gia9m99).avi.exe
file	C:\Users\All Users\Microsoft\Windows\Templates\ovqqw9 mtu2oyuh5 6r3apw4 [bangbus] (ysxdgxr).avi.exe
file	C:\Program Files\DVD Maker\Shared\beast d2jspkm3 .rar.exe
file	C:\ProgramData\Templates\horse 6r3apw4 young .mpeg.exe
file	C:\Users\Default\AppData\Local\Temp\r2qc46i jmmawhs 6r3apw4 d2jspkm3 rqmct8k1i30 .mpg.exe
file	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Templates\r2qc46i mtu2oyuh5 z8dvsxk d2jspkm3 (ysxdgxr).zip.exe
file	C:\Users\Administrator\AppData\Local\Temp\z8dvsxk girls glans .mpeg.exe
file	C:\ProgramData\Microsoft\RAC\Temp\ovqqw9 horse z8dvsxk f6br2s2 cock .avi.exe
file	C:\Users\Administrator\AppData\Local\Temporary Internet Files\yn0pxd ko6o6a beast j8bb56pcl4 .rar.exe
file	C:\Users\All Users\Microsoft\Search\Data\Temp\9k8bf2i kmozxo ash (a89thik,Jade).zip.exe
file	C:\Program Files (x86)\Common Files\microsoft shared\xiwlzi0 horse 4mvc8yaot j8bb56pcl4 50+ .zip.exe
file	C:\Users\Administrator\AppData\Roaming\Microsoft\Windows\Templates\7smpob5w jmmawhs gay [free] ttbp10m .avi.exe
file	C:\Users\Administrator\AppData\Local\Microsoft\Windows\Temporary Internet Files\6r3apw4 j8bb56pcl4 .avi.exe
file	C:\Program Files\Windows Journal\Templates\z8dvsxk 6r3apw4 qcjxxhb .zip.exe
file	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\vftv0ou y6go35p xxx 6mjj01 cock .rar.exe
file	C:\Program Files\Microsoft Office\Templates\xiwlzi0 4fq06c horse srpvkzygmcsw titts 45ld689 .mpg.exe
file	C:\Users\All Users\Microsoft\RAC\Temp\27bjd3d2x horse 4mvc8yaot 6r3apw4 feet nr8wosn .zip.exe
file	C:\Users\Administrator\AppData\Local\Temp\mozilla-temp-files\tvolgth uv0dxwt8x4m beast [bangbus] o2de75il .zip.exe
file	C:\tmp1xmcit\xiwlzi0 mtu2oyuh5 xxx d2jspkm3 .mpeg.exe
file	C:\Program Files\Common Files\Microsoft Shared\9k8bf2i uncut aqp9g9a (Sandy,ynve4mgf).rar.exe
file	C:\Users\All Users\Templates\cw4ymo3u y6go35p 4mvc8yaot kc2hrt2j fishy (Gina,gia9m99).mpeg.exe
file	C:\Users\Default\AppData\Local\Microsoft\Windows\Temporary Internet Files\l8qccpyq j8bb56pcl4 sm (Jenna,5qcarib).zip.exe
file	C:\Program Files\Microsoft Office\Templates\1033\ONENOTE\14\Notebook Templates\tvolgth nude xxx big glans .avi.exe
file	C:\Users\Administrator\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\yn0pxd horse horse [milf] titts .mpg.exe
file	C:\ProgramData\Microsoft\Search\Data\Temp\ovqqw9 jmmawhs l8qccpyq kmozxo .mpg.exe
file	C:\Users\Default\Templates\ovqqw9 jmmawhs sperm 6r3apw4 aqp9g9a .rar.exe
file	C:\Users\Administrator\Templates\7smpob5w porn a3xo5xtn d2jspkm3 (Sarah).rar.exe

Drops an executable to the user AppData folder (2 events)

file	C:\Users\Administrator\AppData\Local\Temp\z8dvsxk girls glans .mpeg.exe
file	C:\Users\Administrator\AppData\Roaming\Macromedia\Flash Player\#SharedObjects\yn0pxd horse horse [milf] titts .mpg.exe

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (3 events)

Time & API	Arguments	Status	Return
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000120 process_name: mobsync.exe process_identifier: 2284	1	1
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000120 process_name: taskhost.exe process_identifier: 2272	1	1
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000298 process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2164	1	1

Repeatedly searches for a not-found process, you may want to run a web browser during analysis (15 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000120 process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2236		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000298 process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2164		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x0000026c process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x0000026c process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x0000026c process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x0000026c process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x0000026c process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x0000026c process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x0000026c process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x0000026c process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000260 process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000260 process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000260 process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000260 process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2796		0	0
Process32NextW Sept. 22, 2025, 10:05 p.m.	snapshot_handle: 0x00000118 process_name: 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f.exe process_identifier: 2164		0	0

Enumerates services, possibly for anti-virtualization (1 event)

Time & API	Arguments	Status	Return	Repeated
EnumServicesStatusA Sept. 22, 2025, 10:05 p.m.	service_handle: 0x005ecb68 service_type: 48 service_status: 1		0	0

File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)

G Data Antivirus (Windows)	Virus: Dropped:Generic.Malware.PVPk!!prn!.FE0B916D (Engine A)
Avast Core Security (Linux)	Win32:MalwareX-gen [Misc]
C4S ClamAV (Linux)	Win.Malware.Pvpk-10056926-0
Trellix (Linux)	GenericRXMK-QV
WithSecure (Linux)	Trojan.TR/Spy.Gen
eScan Antivirus (Linux)	Dropped:Generic.Malware.PVPk!!prn!.FE0B916D(DB)
ESET Security (Windows)	a variant of Win32/Agent.CP worm
Sophos Anti-Virus (Linux)	Mal/Generic-S
DrWeb Antivirus (Linux)	Win32.HLLW.Siggen.1607
ClamAV (Linux)	Win.Malware.Pvpk-10056926-0
Bitdefender Antivirus (Linux)	Dropped:Generic.Malware.PVPk!!prn!.FE0B916D
Kaspersky Standard (Windows)	HEUR:Trojan.Win32.Generic
Emsisoft Commandline Scanner (Windows)	Dropped:Generic.Malware.PVPk!!prn!.FE0B916D (B)

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.AIDetectMalware
tehtris	Generic.Malware
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Generic.tc
ALYac	Dropped:Generic.Malware.PVPk!!prn!.FE0B916D
Cylance	Unsafe
VIPRE	Dropped:Generic.Malware.PVPk!!prn!.FE0B916D
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Dropped:Generic.Malware.PVPk!!prn!.FE0B916D
K7GW	Trojan ( 004ca8b71 )
K7AntiVirus	Trojan ( 004ca8b71 )
Arcabit	Generic.Malware.PVPk!!prn!.FE0B916D
Baidu	Win32.Worm.Agent.fj
VirIT	Worm.Win32.Agent.CP
Symantec	ML.Attribute.HighConfidence
Elastic	Windows.Generic.Threat
ESET-NOD32	a variant of Win32/Agent.CP
APEX	Malicious
Avast	Win32:MalwareX-gen [Misc]
ClamAV	Win.Malware.Pvpk-10056926-0
Kaspersky	HEUR:Trojan.Win32.Generic
NANO-Antivirus	Trojan.Win32.Wofith.iariji
MicroWorld-eScan	Dropped:Generic.Malware.PVPk!!prn!.FE0B916D
Rising	Worm.Agent!1.12BB7 (CLASSIC)
Emsisoft	Dropped:Generic.Malware.PVPk!!prn!.FE0B916D (B)
F-Secure	Trojan.TR/Spy.Gen
DrWeb	Win32.HLLW.Siggen.1607
Zillya	Worm.Agent.Win32.9
McAfeeD	Real Protect-LS!9902E8CF90CA
Trapmine	malicious.high.ml.score
CTX	exe.unknown.dropped
Sophos	Mal/Generic-S
SentinelOne	Static AI - Malicious PE
Jiangmin	Worm.Agent.yh
Webroot	W32.Worm.Gen
Google	Detected
Avira	TR/Spy.Gen
Antiy-AVL	Trojan/Win32.Vindor
Kingsoft	malware.kb.a.1000
Gridinsoft	Ransom.Win32.Zbot.oa!s1
Microsoft	Worm:Win32/Sfone!pz
GData	Win32.Trojan.PSE.166UMSX
Varist	W32/Agent.LDP.gen!Eldorado
AhnLab-V3	Worm/Win.Generic.R704852
Acronis	suspicious
VBA32	BScope.Worm.Convagent
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware.AI.DDS
Ikarus	Worm.Win32.Agent

Screenshots

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action	VT	Location
No hosts contacted.

Browser recommendation

File 676d09b4297711d591f2f3806feba7090567e4874d65aa5831d93249e1637a4f

Summary Download Resubmit sample

Score

Autosubmit

Feedback

Information on Execution

Analyzer Log

Cuckoo Log

Signatures

Feedback

Summary
Download Resubmit sample