Summary

Archive f381e338212079c3a03fbbb532cdec44b1d27db03e8cc4c47408ef038885d934.exe @ Q1.zip

Summary
Download Resubmit sample

Size 1.0MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 411019bcb582ef6e3dab080d99925b4b
SHA1 38cfa080a7ab69fb6c5010f38e321272a39d5f19
SHA256 f381e338212079c3a03fbbb532cdec44b1d27db03e8cc4c47408ef038885d934
SHA512
8908321719d00323c5fac12e1c7ea3a11a79b534e11d9434743651630402369c32f33c5054fc31ddd34ca9fb3403e0cef6c72f5b2c242a4b1ed6283ce1040a80
CRC32 12F641B7
ssdeep None
Yara
  • keylogger - Run a keylogger

Score

This archive is very suspicious, with a score of 10 out of 10!

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Analysis
Category Started Completed Duration Routing Logs
ARCHIVE May 17, 2026, 12:56 p.m. May 17, 2026, 12:57 p.m. 61 seconds internet Show Analyzer Log
Show Cuckoo Log

Analyzer Log

2026-05-17 12:55:59,030 [analyzer] DEBUG: Starting analyzer from: C:\tmpdrdvpd
2026-05-17 12:55:59,030 [analyzer] DEBUG: Pipe server name: \??\PIPE\lZhkhAxeCEACTfrbXjqNoocMNvoxGsLS
2026-05-17 12:55:59,030 [analyzer] DEBUG: Log pipe server name: \??\PIPE\haijlLqRDqrAuMnqMvCUl
2026-05-17 12:55:59,233 [analyzer] DEBUG: Started auxiliary module Curtain
2026-05-17 12:55:59,233 [analyzer] DEBUG: Started auxiliary module DbgView
2026-05-17 12:55:59,733 [analyzer] DEBUG: Started auxiliary module Disguise
2026-05-17 12:55:59,937 [analyzer] DEBUG: Loaded monitor into process with pid 508
2026-05-17 12:55:59,937 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2026-05-17 12:55:59,937 [analyzer] DEBUG: Started auxiliary module Human
2026-05-17 12:55:59,937 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2026-05-17 12:55:59,937 [analyzer] DEBUG: Started auxiliary module Reboot
2026-05-17 12:56:00,000 [analyzer] DEBUG: Started auxiliary module RecentFiles
2026-05-17 12:56:00,000 [analyzer] DEBUG: Started auxiliary module Screenshots
2026-05-17 12:56:00,015 [analyzer] DEBUG: Started auxiliary module Sysmon
2026-05-17 12:56:00,015 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2026-05-17 12:56:00,140 [lib.api.process] INFO: Successfully executed process from path 'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\f381e338212079c3a03fbbb532cdec44b1d27db03e8cc4c47408ef038885d934.exe' with arguments '' and pid 1920
2026-05-17 12:56:00,312 [analyzer] DEBUG: Loaded monitor into process with pid 1920
2026-05-17 11:56:48,832 [analyzer] INFO: Analysis timeout hit, terminating analysis.
2026-05-17 11:56:49,066 [lib.api.process] ERROR: Failed to dump memory of 32-bit process with pid 1920.
2026-05-17 11:56:49,380 [analyzer] INFO: Terminating remaining processes before shutdown.
2026-05-17 11:56:49,380 [lib.api.process] INFO: Successfully terminated process with pid 1920.
2026-05-17 11:56:49,380 [analyzer] INFO: Analysis completed.

Cuckoo Log

2026-05-17 12:56:00,202 [cuckoo.core.scheduler] INFO: Task #7556153: acquired machine win7x6412 (label=win7x6412)
2026-05-17 12:56:00,204 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.212 for task #7556153
2026-05-17 12:56:00,822 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1242150 (interface=vboxnet0, host=192.168.168.212)
2026-05-17 12:56:00,851 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x6412
2026-05-17 12:56:01,736 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x6412 to vmcloak
2026-05-17 12:56:11,474 [cuckoo.core.guest] INFO: Starting analysis #7556153 on guest (id=win7x6412, ip=192.168.168.212)
2026-05-17 12:56:12,482 [cuckoo.core.guest] DEBUG: win7x6412: not ready yet
2026-05-17 12:56:17,515 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x6412, ip=192.168.168.212)
2026-05-17 12:56:17,590 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x6412, ip=192.168.168.212, monitor=latest, size=6660546)
2026-05-17 12:56:18,668 [cuckoo.core.resultserver] DEBUG: Task #7556153: live log analysis.log initialized.
2026-05-17 12:56:19,546 [cuckoo.core.resultserver] DEBUG: Task #7556153 is sending a BSON stream
2026-05-17 12:56:19,906 [cuckoo.core.resultserver] DEBUG: Task #7556153 is sending a BSON stream
2026-05-17 12:56:20,829 [cuckoo.core.resultserver] DEBUG: Task #7556153: File upload for 'shots/0001.jpg'
2026-05-17 12:56:20,863 [cuckoo.core.resultserver] DEBUG: Task #7556153 uploaded file length: 133509
2026-05-17 12:56:33,395 [cuckoo.core.guest] DEBUG: win7x6412: analysis #7556153 still processing
2026-05-17 12:56:48,498 [cuckoo.core.guest] DEBUG: win7x6412: analysis #7556153 still processing
2026-05-17 12:56:49,257 [cuckoo.core.resultserver] DEBUG: Task #7556153: File upload for 'curtain/1779011809.26.curtain.log'
2026-05-17 12:56:49,261 [cuckoo.core.resultserver] DEBUG: Task #7556153 uploaded file length: 36
2026-05-17 12:56:49,378 [cuckoo.core.resultserver] DEBUG: Task #7556153: File upload for 'sysmon/1779011809.38.sysmon.xml'
2026-05-17 12:56:49,382 [cuckoo.core.resultserver] DEBUG: Task #7556153 uploaded file length: 132944
2026-05-17 12:56:49,771 [cuckoo.core.resultserver] DEBUG: Task #7556153 had connection reset for <Context for LOG>
2026-05-17 12:56:51,511 [cuckoo.core.guest] INFO: win7x6412: analysis completed successfully
2026-05-17 12:56:51,525 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2026-05-17 12:56:51,552 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2026-05-17 12:56:53,012 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x6412 to path /srv/cuckoo/cwd/storage/analyses/7556153/memory.dmp
2026-05-17 12:56:53,014 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x6412
2026-05-17 12:57:01,242 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.212 for task #7556153
2026-05-17 12:57:01,575 [cuckoo.core.scheduler] DEBUG: Released database task #7556153
2026-05-17 12:57:01,589 [cuckoo.core.scheduler] INFO: Task #7556153: analysis procedure completed

Signatures

Yara rule detected for file (1 event)
description Run a keylogger rule keylogger
Allocates read-write-execute memory (usually to unpack itself) (23 events)
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71ff2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71ff2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1920
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x71ff2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00720000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00653000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00790000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00685000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0068b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00687000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0065d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0067a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00677000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 1638400
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04db0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04f00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0066d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00791000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 32768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00792000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0079a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0067b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0079b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1920
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0079c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
Checks if process is being debugged by a debugger (2 events)
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
The binary likely contains encrypted or compressed data indicative of a packer (2 events)
section {u'size_of_data': u'0x000f4e00', u'virtual_address': u'0x00002000', u'entropy': 7.064783548776407, u'name': u'.text', u'virtual_size': u'0x000f4cd4'} entropy 7.06478354878 description A section with a high entropy has been found
entropy 0.918855534709 description Overall entropy of this PE file is high
File has been identified by 13 AntiVirus engine on IRMA as malicious (13 events)
G Data Antivirus (Windows) Virus: Trojan.Ransom.Loki.DBZ (Engine A), MSIL.Trojan-Spy.Snake.XMTIRX (Engine B)
Avast Core Security (Linux) Win32:MalwareX-gen [Pws]
C4S ClamAV (Linux) Sanesecurity.Rogue.0hr.20220510-1546.UNOFFICIAL
Trellix (Linux) GenericRXSW-EH
WithSecure (Linux) Trojan.TR/W32.MalwareX
eScan Antivirus (Linux) Trojan.Ransom.Loki.DBZ(DB)
ESET Security (Windows) MSIL/Spy.Agent.AES trojan
Sophos Anti-Virus (Linux) Troj/Krypt-LX
DrWeb Antivirus (Linux) Trojan.PackedNET.331
ClamAV (Linux) Sanesecurity.Rogue.0hr.20220510-1546.UNOFFICIAL
Bitdefender Antivirus (Linux) Trojan.Ransom.Loki.DBZ
Kaspersky Standard (Windows) HEUR:Trojan.MSIL.Taskun.gen
Emsisoft Commandline Scanner (Windows) Trojan.Ransom.Loki.DBZ (B)
File has been identified by 61 AntiVirus engines on VirusTotal as malicious (50 out of 61 events)
Bkav W32.AIDetectMalware.CS
Lionic Trojan.Win32.Loki.4!c
CAT-QuickHeal Trojan.YakbeexMSIL.ZZ4
Skyhigh GenericRXSW-EH!411019BCB582
ALYac Trojan.Ransom.Loki.DBZ
Cylance Unsafe
Sangfor Spyware.Msil.Tnega.Vy2p
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Trojan.Ransom.Loki.DBZ
K7GW Trojan ( 00592bc01 )
K7AntiVirus Trojan ( 00592bc01 )
Arcabit Trojan.Ransom.Loki.DBZ
VirIT Trojan.Win32.MSIL.BUO
Symantec Trojan.Gen.MBT
Elastic malicious (high confidence)
ESET-NOD32 MSIL/Spy.Agent.AES trojan
Avast Win32:MalwareX-gen [Pws]
ClamAV Win.Dropper.LokiBot-10026309-0
Kaspersky HEUR:Trojan.MSIL.Taskun.gen
Alibaba Trojan:MSIL/Tnega.1403fd51
NANO-Antivirus Trojan.Win32.Taskun.jsflgf
SUPERAntiSpyware Trojan.Agent/GenericKDZ
MicroWorld-eScan Trojan.Ransom.Loki.DBZ
Rising Backdoor.Androm!8.113 (KTSE)
Emsisoft Trojan.Ransom.Loki.DBZ (B)
F-Secure Trojan.TR/AD.SnakeStealer.mpbph
DrWeb Trojan.PackedNET.331
VIPRE Trojan.Ransom.Loki.DBZ
TrendMicro TrojanSpy.MSIL.SNAKELOGGER.JPQ
McAfeeD ti!F381E3382120
Trapmine malicious.moderate.ml.score
CTX exe.trojan.msil
Sophos Troj/Krypt-LX
SentinelOne Static AI - Suspicious PE
Jiangmin Trojan.MSIL.amrha
Webroot W32.Trojan.Gen
Google Detected
Avira TR/AD.SnakeStealer.mpbph
Antiy-AVL Trojan/MSIL.Kryptik
Xcitium Malware@#1m1caykgusd8e
Microsoft Trojan:MSIL/Tnega.ST!MTB
ZoneAlarm Troj/Krypt-LX
GData MSIL.Trojan-Spy.Snake.XMTIRX
Varist W32/MSIL_Kryptik.HFI.gen!Eldorado
AhnLab-V3 Trojan/Win.Infostealer.R491212
VBA32 TScope.Trojan.MSIL
DeepInstinct MALICIOUS
Malwarebytes Neshta.Virus.FileInfector.DDS
Ikarus Trojan.MSIL.Crypt
Panda Trj/WLT.G
Screenshots
Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action VT Location
No hosts contacted.
Cuckoo

We're processing your submission... This could take a few seconds.