Summary

642c4f1bd3ff5114_eeintl.dll

File 642c4f1bd3ff5114_eeintl.dll

Summary
Download Resubmit sample

Size 27.2MB
Type PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
MD5 86d4a7fce70763f9a63a4514762ac016
SHA1 008bf7c269e7b86797e7294fc06f6f1686103678
SHA256 642c4f1bd3ff511478612c4a0009d87da0e6db91ab1f61ec52985592369b651d
SHA512
28e6d0205341f4dcebc721e29b58a704913e7cfc6c5094133fc22d7c4c5047a66f5bebc2984e5f1298cd303cd4b8d5af87529dab69217192ed1fa790147292c8
CRC32 4BD37567
ssdeep None
Yara
  • PoetRat_Python - (no description)
  • Base64_encoded_Executable - Detects an base64 encoded executable (often embedded)
  • DebuggerException__ConsoleCtrl - (no description)
  • DebuggerException__SetConsoleCtrl - (no description)
  • SEH__vectored - (no description)
  • create_service - Create a windows service
  • network_udp_sock - Communications over UDP network
  • network_tcp_listen - Listen for incoming communication
  • network_tcp_socket - Communications over RAW socket
  • network_dns - Communications use DNS

Score

This file is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Autosubmit

Parent_Task_ID:7168471

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
FILE Nov. 25, 2025, 3:10 p.m. Nov. 25, 2025, 3:19 p.m. 572 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2025-11-22 02:12:42,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpf7a_02
2025-11-22 02:12:42,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\GKGItcorDVbwpAtxFUB
2025-11-22 02:12:42,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\yWfcwaoULgHzFAiiuyklRhgLOusPcXtG
2025-11-22 02:12:42,046 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically.
2025-11-22 02:12:42,187 [analyzer] INFO: Automatically selected analysis package "exe"
2025-11-22 02:12:42,500 [analyzer] DEBUG: Started auxiliary module Curtain
2025-11-22 02:12:42,500 [analyzer] DEBUG: Started auxiliary module DbgView
2025-11-22 02:12:43,187 [analyzer] DEBUG: Started auxiliary module Disguise
2025-11-22 02:12:43,390 [analyzer] DEBUG: Loaded monitor into process with pid 504
2025-11-22 02:12:43,390 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2025-11-22 02:12:43,390 [analyzer] DEBUG: Started auxiliary module Human
2025-11-22 02:12:43,390 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2025-11-22 02:12:43,405 [analyzer] DEBUG: Started auxiliary module Reboot
2025-11-22 02:12:43,483 [analyzer] DEBUG: Started auxiliary module RecentFiles
2025-11-22 02:12:43,500 [analyzer] DEBUG: Started auxiliary module Screenshots
2025-11-22 02:12:43,500 [analyzer] DEBUG: Started auxiliary module Sysmon
2025-11-22 02:12:43,500 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2025-11-22 02:12:43,890 [lib.api.process] INFO: Successfully executed process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\642c4f1bd3ff5114_eeintl.dll' with arguments '' and pid 668
2025-11-22 02:12:44,187 [analyzer] DEBUG: Loaded monitor into process with pid 668
2025-11-22 02:13:06,749 [analyzer] INFO: Added new file to list with pid 668 and path C:\Windows\System32\VV.exe
2025-11-22 02:13:06,938 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL
2025-11-22 02:13:07,076 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.exe
2025-11-22 02:13:07,240 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL
2025-11-22 02:13:07,434 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.exe
2025-11-22 02:13:07,569 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
2025-11-22 02:13:07,707 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.exe
2025-11-22 02:13:08,200 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
2025-11-22 02:13:08,467 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.exe
2025-11-22 02:13:08,655 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL
2025-11-22 02:13:08,828 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.exe
2025-11-22 02:13:08,982 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT
2025-11-22 02:13:09,122 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.exe
2025-11-22 02:13:09,315 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
2025-11-22 02:13:09,474 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.exe
2025-11-22 02:13:09,674 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP
2025-11-22 02:13:09,838 [analyzer] INFO: Added new file to list with pid 668 and path C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.exe
2025-11-22 02:13:10,957 [analyzer] INFO: Process with pid 668 has terminated
2025-11-22 02:13:10,957 [analyzer] INFO: Process list is empty, terminating analysis.
2025-11-22 02:13:12,520 [analyzer] INFO: Terminating remaining processes before shutdown.
2025-11-22 02:13:28,348 [analyzer] WARNING: File at path u'c:\\windows\\system32\\vv.exe' does not exist, skip.
2025-11-22 02:15:10,645 [analyzer] INFO: Analysis completed.

Cuckoo Log

2025-11-25 15:10:05,721 [cuckoo.core.scheduler] INFO: Task #7199894: acquired machine win7x6427 (label=win7x6427)
2025-11-25 15:10:05,734 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.227 for task #7199894
2025-11-25 15:10:06,325 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 298608 (interface=vboxnet0, host=192.168.168.227)
2025-11-25 15:11:48,594 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6427
2025-11-25 15:11:50,516 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6427 to vmcloak
2025-11-25 15:14:28,729 [cuckoo.core.guest] INFO: Starting analysis #7199894 on guest (id=win7x6427, ip=192.168.168.227)
2025-11-25 15:14:29,737 [cuckoo.core.guest] DEBUG: win7x6427: not ready yet
2025-11-25 15:14:35,051 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6427, ip=192.168.168.227)
2025-11-25 15:14:36,610 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6427, ip=192.168.168.227, monitor=latest, size=6660546)
2025-11-25 15:14:50,822 [cuckoo.core.resultserver] DEBUG: Task #7199894: live log analysis.log initialized.
2025-11-25 15:14:50,845 [cuckoo.core.resultserver] DEBUG: Task #7199894 is sending a BSON stream
2025-11-25 15:14:50,853 [cuckoo.core.resultserver] DEBUG: Task #7199894 is sending a BSON stream
2025-11-25 15:14:50,861 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'shots/0001.jpg'
2025-11-25 15:14:50,880 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 111902
2025-11-25 15:14:54,208 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'shots/0002.jpg'
2025-11-25 15:14:54,219 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 125276
2025-11-25 15:15:02,703 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:15:14,843 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'shots/0003.jpg'
2025-11-25 15:15:14,879 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 127327
2025-11-25 15:15:14,887 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'curtain/1763773992.24.curtain.log'
2025-11-25 15:15:14,927 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 36
2025-11-25 15:15:14,936 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'sysmon/1763773992.52.sysmon.xml'
2025-11-25 15:15:15,108 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 963166
2025-11-25 15:15:15,121 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/1e962f488655c5e5_eeintl.dll'
2025-11-25 15:15:19,478 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29164276
2025-11-25 15:15:22,706 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:15:23,511 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/2901a4a1374cc92c_dw20.exe'
2025-11-25 15:15:28,228 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29211380
2025-11-25 15:15:32,835 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/54914c3e7d38d14a_msaddndr.dll'
2025-11-25 15:15:37,218 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29196020
2025-11-25 15:15:38,027 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:15:41,490 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/e6166c6f4236b492_dw20.exe.exe'
2025-11-25 15:15:45,671 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29300476
2025-11-25 15:15:49,899 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/accb08dda7b5f2c0_dwtrig20.exe.exe'
2025-11-25 15:15:53,266 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:15:53,471 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29201148
2025-11-25 15:15:56,786 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/86d39c2e80853cd1_eeintl.dll.exe'
2025-11-25 15:16:00,834 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29253372
2025-11-25 15:16:07,633 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/a283cfcff93d93e0_msaddndr.dll.exe'
2025-11-25 15:16:08,487 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:16:11,847 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29273852
2025-11-25 15:16:15,226 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/bbf71031398f567c_eqnedt32.cnt.exe'
2025-11-25 15:16:17,934 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29181692
2025-11-25 15:16:23,084 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/0d6997a908e4ebe8_dwtrig20.exe'
2025-11-25 15:16:23,827 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:16:26,654 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29153012
2025-11-25 15:16:30,824 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/1a67e4c543235853_eqnedt32.exe'
2025-11-25 15:16:34,362 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29150964
2025-11-25 15:16:37,121 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/248ac31ee4daa67c_eqnedt32.cnt'
2025-11-25 15:16:39,031 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:16:40,031 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29177588
2025-11-25 15:16:44,072 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/bb78e17d160edf86_dbghelp.dll.exe'
2025-11-25 15:16:46,089 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29251324
2025-11-25 15:16:49,060 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/febe37111861ade8_eqnedt32.exe.exe'
2025-11-25 15:16:51,229 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29151996
2025-11-25 15:16:54,283 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:16:55,225 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/5e6fdc58ef4fb85e_dbghelp.dll'
2025-11-25 15:16:57,330 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29188852
2025-11-25 15:17:01,011 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/d11b0710241729c4_eqnedt32.hlp.exe'
2025-11-25 15:17:04,174 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29258492
2025-11-25 15:17:07,574 [cuckoo.core.resultserver] DEBUG: Task #7199894: File upload for 'files/81eb56e49b0fb607_eqnedt32.hlp'
2025-11-25 15:17:09,472 [cuckoo.core.guest] DEBUG: win7x6427: analysis #7199894 still processing
2025-11-25 15:17:10,412 [cuckoo.core.resultserver] DEBUG: Task #7199894 uploaded file length: 29213428
2025-11-25 15:17:11,226 [cuckoo.core.resultserver] DEBUG: Task #7199894 had connection reset for <Context for LOG>
2025-11-25 15:17:12,495 [cuckoo.core.guest] INFO: win7x6427: analysis completed successfully
2025-11-25 15:17:12,521 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2025-11-25 15:17:12,549 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2025-11-25 15:17:13,871 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6427 to path /srv/cuckoo/cwd/storage/analyses/7199894/memory.dmp
2025-11-25 15:17:13,881 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6427
2025-11-25 15:19:33,334 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.227 for task #7199894
2025-11-25 15:19:34,119 [cuckoo.core.scheduler] DEBUG: Released database task #7199894
2025-11-25 15:19:34,161 [cuckoo.core.scheduler] INFO: Task #7199894: analysis procedure completed

Signatures

Yara rules detected for file (10 events)
description (no description) rule PoetRat_Python
description Detects an base64 encoded executable (often embedded) rule Base64_encoded_Executable
description (no description) rule DebuggerException__ConsoleCtrl
description (no description) rule DebuggerException__SetConsoleCtrl
description (no description) rule SEH__vectored
description Create a windows service rule create_service
description Communications over UDP network rule network_udp_sock
description Listen for incoming communication rule network_tcp_listen
description Communications over RAW socket rule network_tcp_socket
description Communications use DNS rule network_dns
Command line console output was observed (10 events)
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: https://ent34ndx3cz8k.x.pipedream.net//a?son=1364545123&brother=1146177651&selfhash=642c4f1bd3ff511478612c4a0009d87da0e6db91ab1f61ec52985592369b651d&seed=1763773964692382800&runnigfrom=C:\Users\Administrator\AppData\Local\Temp\642c4f1bd3ff5114_eeintl.dll
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP
console_handle: 0x0000000000000007
1 1 0

WriteConsoleW

 buffer: C:\Program Files\Common Files\Microsoft Shared\EQUATION\MTEXTRA.TTF
console_handle: 0x0000000000000007
1 1 0
The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)
section .symtab
Creates executable files on the filesystem (15 events)
file C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL
file C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
file c:\Windows\System32\VV.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE.exe
file C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL
file C:\Program Files\Common Files\Microsoft Shared\EQUATION\1033\EEINTL.DLL.exe
file C:\Program Files\Common Files\DESIGNER\MSADDNDR.DLL.exe
file C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.CNT.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DWTRIG20.EXE
file C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
file C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.HLP.exe
file C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL.exe
file C:\Program Files\Common Files\Microsoft Shared\DW\DBGHELP.DLL
Raised Snort alerts (1 event)
snort ET INFO DNS Query for Webhook/HTTP Request Inspection Service (x .pipedream .net)
Installs itself for autorun at Windows startup (1 event)
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\VV reg_value c:\Windows\System32\VV.exe
Detects the presence of Wine emulator (1 event)
Time & API Arguments Status Return Repeated

LdrGetProcedureAddress

 ordinal: 0
function_address: 0x000007fefde27a50
function_name: wine_get_version
module: ntdll
module_address: 0x00000000777c0000
-1073741511 0
File has been identified by 10 AntiVirus engine on IRMA as malicious (10 events)
G Data Antivirus (Windows) Virus: Gen:Variant.Tedy.816526 (Engine A)
Avast Core Security (Linux) Win64:MalwareX-gen [Misc]
WithSecure (Linux) Trojan.TR/Spy.Gen
eScan Antivirus (Linux) Gen:Variant.Tedy.816526(DB)
ESET Security (Windows) a variant of Win64/Agent.PR trojan
Sophos Anti-Virus (Linux) Troj/Agent-BLKX
DrWeb Antivirus (Linux) BackDoor.GravityRAT.3
Bitdefender Antivirus (Linux) Gen:Variant.Tedy.816526
Kaspersky Standard (Windows) HEUR:Trojan.Win32.Vimditator.gen
Emsisoft Commandline Scanner (Windows) Gen:Variant.Tedy.816526 (B)
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.