www.malwr.ee
Open in
urlscan Pro
185.31.242.37
Public Scan
Submitted URL: http://www.malwr.ee/analysis/4506864/summary
Effective URL: https://www.malwr.ee/analysis/4506864/summary
Submission: On August 03 via api from US — Scanned from DE
Effective URL: https://www.malwr.ee/analysis/4506864/summary
Submission: On August 03 via api from US — Scanned from DE
Form analysis 1 forms found in the DOM
<form class="modal-dialog">
<div class="modal-content">
<div class="modal-header">
<h4><i class="fa fa-bug"></i> Feedback</h4>
</div>
<p class="modal-section arrow">Expecting different results? Share this analysis report with us and we’ll investigate it. Please include a brief message of what you had expected to see and what you got instead.</p>
<div class="modal-section modal-form arrow">
<div class="form-col">
<fieldset>
<input type="text" name="name" id="feedback-name" required="">
<label for="feedback-name">Your name</label>
</fieldset>
<fieldset>
<input type="text" name="email" id="feedback-email" required="">
<label for="feedback-email">Your email</label>
</fieldset>
</div>
<div class="form-col">
<fieldset>
<input type="text" name="company" id="feedback-company" required="">
<label for="feedback-company">Your company</label>
</fieldset>
</div>
</div>
<div class="modal-section modal-form arrow">
<textarea name="message" id="feedback-message" placeholder="Describe to us what does not seem to work properly."></textarea>
</div>
<div class="modal-section modal-form arrow arrow-center" id="feedback-includes">
<div class="modal-form__checkbox">
<input type="checkbox" name="include_analysis" id="feedback-analysis" disabled="">
<label for="feedback-analysis"><span></span> Include analysis</label>
</div>
<div class="modal-form__checkbox">
<input type="checkbox" name="include_memdump" id="feedback-memdump" disabled="">
<label for="feedback-memdump"><span></span> Include memory dump</label>
</div>
</div>
<div class="modal-section modal-form no-flex center">
<p id="feedback-size">Estimated report size: <strong class="file-estimation">estimating...</strong></p>
<button class="modal-submit" type="submit" formnovalidate="">Send feedback report</button>
<p>or <a href="modal:cancel">cancel</a></p>
</div>
<div class="modal-section modal-footer center"></div>
</div>
</form>Text Content
* Dashboard
* Recent
* Pending
* Search
* Submit
* Import
* SELECT THEME
* Default
* Cyborg
* Night
BROWSER RECOMMENDATION
Hello, we noticed that you are using . For the best performance of this
application, we recommend to use Chrome, Firefox or any browser that supports
WebKit.
Dismiss Don't show again
* Summary
* Static Analysis
* Extracted Artifacts
* Behavioral Analysis 0
* Network Analysis
* Dropped Files 0
* Dropped Buffers
* MISP 1
* Process Memory
* Compare Analysis
* Export Analysis
* Reboot Analysis
* Options
* Feedback
*
SUMMARY
x64.dll
FILE X64.DLL
SUMMARY
DOWNLOAD RESUBMIT SAMPLE
Size 19.5KB Type PE32+ executable (DLL) (native) x86-64, for MS Windows MD5
2914300a6e0cdf7ed242505958ac0bb5 SHA1 684103f5c312ae956e66a02b965d9aad59710745
SHA256 29ae6f149e581f8dbdc01eed2d5d20b82b597c4b4c7e102cab6d012b168df4d8 SHA512
Show SHA512
6fa6b773275e61596f1d4885fa3089ff24a2f72166dc0a2c40667f0bd03de26b032f2a39aa05e74077ada96bbb6b0785424bfe387b995c147fd74860a11948c9
CRC32 EFDE77F2 ssdeep None Yara None matched
SCORE
This file is very suspicious, with a score of 10 out of 10!
Please notice: The scoring system is currently still in development and should
be considered an alpha feature.
--------------------------------------------------------------------------------
FEEDBACK
Expecting different results? Send us this analysis and we will inspect it. Click
here
INFORMATION ON EXECUTION
Analysis
Category Started Completed Duration Routing Logs FILE Feb. 11, 2024, 5:55 a.m.
Feb. 11, 2024, 6:48 a.m. 3180 seconds internet Show Analyzer Log
Show Cuckoo Log
ANALYZER LOG
2024-02-11 04:50:40,015 [analyzer] DEBUG: Starting analyzer from: C:\tmpl4240h
2024-02-11 04:50:40,015 [analyzer] DEBUG: Pipe server name: \??\PIPE\jsDHJDjOzurOVPMtYODJGdeXEn
2024-02-11 04:50:40,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\hfelOdKUOBGCjHbmNjyZbQmu
2024-02-11 04:50:40,217 [analyzer] DEBUG: Started auxiliary module Curtain
2024-02-11 04:50:40,217 [analyzer] DEBUG: Started auxiliary module DbgView
2024-02-11 04:50:40,546 [analyzer] DEBUG: Started auxiliary module Disguise
2024-02-11 04:50:40,750 [analyzer] DEBUG: Loaded monitor into process with pid 508
2024-02-11 04:50:40,750 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets
2024-02-11 04:50:40,750 [analyzer] DEBUG: Started auxiliary module Human
2024-02-11 04:50:40,750 [analyzer] DEBUG: Started auxiliary module InstallCertificate
2024-02-11 04:50:40,750 [analyzer] DEBUG: Started auxiliary module Reboot
2024-02-11 04:50:40,796 [analyzer] DEBUG: Started auxiliary module RecentFiles
2024-02-11 04:50:40,796 [analyzer] DEBUG: Started auxiliary module Screenshots
2024-02-11 04:50:40,796 [analyzer] DEBUG: Started auxiliary module Sysmon
2024-02-11 04:50:40,812 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n
2024-02-11 04:50:40,842 [lib.api.process] ERROR: Failed to execute process from path u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\x64.dll' with arguments ['bin\\inject-x64.exe', '--app', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\x64.dll', '--only-start', '--curdir', 'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp'] (Error: Command '['bin\\inject-x64.exe', '--app', u'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp\\x64.dll', '--only-start', '--curdir', 'C:\\Users\\ADMINI~1\\AppData\\Local\\Temp']' returned non-zero exit status 1)
CUCKOO LOG
2024-02-11 05:55:41,918 [cuckoo.core.scheduler] INFO: Task #4506864: acquired machine win7x649 (label=win7x649)
2024-02-11 05:55:41,919 [cuckoo.core.resultserver] DEBUG: Now tracking machine 192.168.168.209 for task #4506864
2024-02-11 05:56:59,830 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 336711 (interface=vboxnet0, host=192.168.168.209)
2024-02-11 05:57:00,137 [cuckoo.machinery.virtualbox] DEBUG: Starting vm win7x649
2024-02-11 05:58:20,372 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine win7x649 to vmcloak
2024-02-11 06:22:42,957 [cuckoo.core.guest] INFO: Starting analysis #4506864 on guest (id=win7x649, ip=192.168.168.209)
2024-02-11 06:22:42,972 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.10 (id=win7x649, ip=192.168.168.209)
2024-02-11 06:22:43,031 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7x649, ip=192.168.168.209, monitor=latest, size=6660546)
2024-02-11 06:22:43,969 [cuckoo.core.resultserver] DEBUG: Task #4506864: live log analysis.log initialized.
2024-02-11 06:22:44,648 [cuckoo.core.resultserver] DEBUG: Task #4506864 is sending a BSON stream
2024-02-11 06:22:45,859 [cuckoo.core.resultserver] DEBUG: Task #4506864: File upload for 'shots/0001.jpg'
2024-02-11 06:22:45,871 [cuckoo.core.resultserver] DEBUG: Task #4506864 uploaded file length: 133469
2024-02-11 06:22:46,656 [cuckoo.core.guest] WARNING: win7x649: analysis #4506864 caught an exception
Traceback (most recent call last):
File "C:/tmpl4240h/analyzer.py", line 824, in <module>
success = analyzer.run()
File "C:/tmpl4240h/analyzer.py", line 673, in run
pids = self.package.start(self.target)
File "C:\tmpl4240h\modules\packages\exe.py", line 34, in start
return self.execute(path, args=shlex.split(args))
File "C:\tmpl4240h\lib\common\abstracts.py", line 205, in execute
"Unable to execute the initial process, analysis aborted."
CuckooPackageError: Unable to execute the initial process, analysis aborted.
2024-02-11 06:22:46,668 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Redsocks
2024-02-11 06:22:46,720 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer
2024-02-11 06:25:21,625 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label win7x649 to path /srv/cuckoo/cwd/storage/analyses/4506864/memory.dmp
2024-02-11 06:25:21,628 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm win7x649
2024-02-11 06:41:53,909 [cuckoo.core.resultserver] DEBUG: Task #4506864: File upload for 'shots/0002.jpg'
2024-02-11 06:41:53,933 [cuckoo.core.resultserver] DEBUG: Task #4506864 uploaded file length: 140005
2024-02-11 06:48:41,497 [cuckoo.core.resultserver] DEBUG: Stopped tracking machine 192.168.168.209 for task #4506864
2024-02-11 06:48:41,498 [cuckoo.core.resultserver] DEBUG: Cancel <Context for LOG> for task 4506864
2024-02-11 06:48:41,656 [cuckoo.core.scheduler] DEBUG: Released database task #4506864
2024-02-11 06:48:41,671 [cuckoo.core.scheduler] INFO: Task #4506864: analysis procedure completed
SIGNATURES
File has been identified by 6 AntiVirus engine on IRMA as malicious (6 events)
G Data Antivirus (Windows) Virus: Application.Hacktool.BBJ (Engine A) Windows
Defender (Windows) HackTool:Win64/AutoKMS!MSR Microsoft Defender ATP (Linux)
HackTool:Win64/AutoKms eScan Antivirus (Linux) Application.Hacktool.BBJ(DB)
Bitdefender Antivirus (Linux) Application.Hacktool.BBJ Kaspersky Standard
(Windows) HackTool.Win64.KMSAuto.ac
File has been identified by 35 AntiVirus engines on VirusTotal as malicious (35
events)
Bkav W64.AIDetectMalware Lionic Hacktool.Win32.KMSAuto.3!c Cynet Malicious
(score: 100) CAT-QuickHeal HackTool.Win64CiR Skyhigh Generic pup.cpe ALYac
Application.Hacktool.BBJ Cylance unsafe VIPRE Application.Hacktool.BBJ
CrowdStrike win/grayware_confidence_100% (W) BitDefender
Application.Hacktool.BBJ K7GW Riskware ( 00584baa1 ) K7AntiVirus Riskware (
00584baa1 ) Arcabit Application.Hacktool.BBJ McAfee Generic pup.cpe Kaspersky
HackTool.Win64.KMSAuto.ac Alibaba HackTool:Win64/KMSAuto.4ecb8b1b
MicroWorld-eScan Application.Hacktool.BBJ Rising Hacktool.KMSAuto!8.3AE (CLOUD)
Emsisoft Application.Hacktool.BBJ (B) Zillya Tool.KMSAuto.Win64.203 TrendMicro
HackTool.Win64.AutoKMS.GAR.component FireEye Application.Hacktool.BBJ Sophos KMS
Activator (PUA) Ikarus PUA.Hacktool.KMS Jiangmin HackTool.KMSAuto.agi Webroot
W32.Malware.Gen Google Detected Microsoft HackTool:Win64/AutoKMS!MSR ZoneAlarm
HackTool.Win64.KMSAuto.ac GData Application.Hacktool.BBJ Varist
W64/ABApplication.PPWM-2423 DeepInstinct MALICIOUS Panda HackingTool/AutoKMS
TrendMicro-HouseCall HackTool.Win64.AutoKMS.GAR.component MaxSecure
Trojan.Malware.106413943.susgen
Screenshots
Name Response Post-Analysis Lookup No hosts contacted.
IP Address Status Action VT Location No hosts contacted.
©2010-2018 Cuckoo Sandbox
Back to Top
Back to the top
©2010-2018 Cuckoo Sandbox
FEEDBACK
Expecting different results? Share this analysis report with us and we’ll
investigate it. Please include a brief message of what you had expected to see
and what you got instead.
Your name Your email
Your company
Include analysis
Include memory dump
Estimated report size: estimating...
Send feedback report
or cancel
We're processing your submission... This could take a few seconds.
Close