Compare this analysis to...

#### Analysis

Category | Started | Completed | Duration | Options | Log
--- | --- | --- | --- | --- | ---
FILE | 2019-05-27 00:18:15 | 2019-05-27 00:18:37 | 22 seconds | Show Options | Show Log

    vpn = disabled
    submit_all = yes

    2019-05-26 15:18:20,000 [root] INFO: Date set to: 05-26-19, time set to: 22:18:20
    2019-05-26 15:18:20,062 [root] DEBUG: Starting analyzer from: C:\kifyhf
    2019-05-26 15:18:20,062 [root] DEBUG: Storing results at: C:\gMCUkcGED
    2019-05-26 15:18:20,062 [root] DEBUG: Pipe server name: \\.\PIPE\grkTRUFN
    2019-05-26 15:18:20,405 [root] DEBUG: Started auxiliary module Browser
    2019-05-26 15:18:20,405 [root] DEBUG: Started auxiliary module Decoy
    2019-05-26 15:18:20,405 [modules.auxiliary.digisig] INFO: Skipping authenticode validation, signtool.exe was not found in bin/
    2019-05-26 15:18:20,405 [root] DEBUG: Started auxiliary module DigiSig
    2019-05-26 15:18:20,437 [root] DEBUG: Started auxiliary module Disguise
    2019-05-26 15:18:20,437 [root] DEBUG: Started auxiliary module Human
    2019-05-26 15:18:20,453 [root] DEBUG: Started auxiliary module Screenshots
    2019-05-26 15:18:20,467 [root] DEBUG: Started auxiliary module Usage
    2019-05-26 15:18:20,515 [lib.api.process] INFO: Successfully executed process from path "C:\Users\John\AppData\Local\Temp\hhwwCozu.exe" with arguments "" with pid 1424
    2019-05-26 15:18:20,546 [lib.api.process] DEBUG: Using QueueUserAPC injection.
    2019-05-26 15:18:20,687 [lib.api.process] INFO: Injected into suspended 32-bit process with pid 1424
    2019-05-26 15:18:22,733 [lib.api.process] INFO: Successfully resumed process with pid 1424
    2019-05-26 15:18:22,733 [root] INFO: Added new process to list with pid: 1424
    2019-05-26 15:18:22,858 [root] WARNING: Unable to place hook on CryptReleaseContext
    2019-05-26 15:18:22,858 [root] WARNING: Unable to hook CryptReleaseContext
    2019-05-26 15:18:22,858 [root] INFO: Cuckoomon successfully loaded in process with pid 1424.
    2019-05-26 15:18:24,546 [root] INFO: command: CRYPT_DECRYPT:1424::1::4134960::C:\Users\John\AppData\Local\Temp\_CryptDecrypt_0_
    2019-05-26 15:18:24,546 [root] INFO: command: CRYPT_DECRYPT:1424::2::4134960::C:\Users\John\AppData\Local\Temp\_CryptDecrypt_1_
    2019-05-26 15:18:24,562 [root] INFO: command: CRYPT_DECRYPT:1424::3::4134960::C:\Users\John\AppData\Local\Temp\_CryptDecrypt_2_
    2019-05-26 15:18:24,890 [root] INFO: Added new file to list with path: C:\Users\John\AppData\Local\Temp\handles.txt
    2019-05-26 15:18:24,890 [root] INFO: Notified of termination of process with pid 1424.
    2019-05-26 15:18:25,750 [root] INFO: Process with pid 1424 has terminated
    2019-05-26 15:18:30,750 [root] INFO: Process list is empty, terminating analysis.
    2019-05-26 15:18:31,750 [root] INFO: Created shutdown mutex.
    2019-05-26 15:18:32,750 [root] INFO: Shutting down package.
    2019-05-26 15:18:32,765 [root] INFO: Stopping auxiliary modules.
    2019-05-26 15:18:32,765 [root] INFO: Finishing auxiliary modules.
    2019-05-26 15:18:32,780 [root] INFO: Shutting down pipe server and dumping dropped files.
    2019-05-26 15:18:32,796 [root] INFO: Analysis completed.

#### MalScore

## 2.0

##### Benign

#### Machine

Name | Label | Manager | Started On | Shutdown On
--- | --- | --- | --- | ---
win7-x86-1-101 | 11101,default | Proxmox | 2019-05-27 00:18:16 | 2019-05-27 00:18:37

#### File Details

File Name | Sigtest.exe
File Size | 232448 bytes
File Type | PE32 executable (console) Intel 80386, for MS Windows
MD5 | 7a1dc4a2f70259a7b034cdf4de1bcda9
SHA1 | aa7984270f0a30f6dd0fece8b6cda71acaaee7ee
SHA256 | 6888950c6d32a16e2fc3ee378097f524f9397a0d1df866c787bab377057573de
SHA512 | 1ad886eaaac3fde88fb4aa19e07127082a2eb106eea9f4c28bcb1ca303ea7debaef5a62c5f80b38a18c452d6ae78446d4b3e85b994f9d1d7e137688e6a58502f
CRC32 | A79DEA15
Ssdeep | None
ClamAV | None matched
Yara | None matched
| Download

#### Signatures

Uses Microsoft Crypto API keys or hashes

Process: hhwwCozu.exe (1424)
Hash 0x003eec40-0 | Handle: 0x003eec40 Source: CryptCreateHash Algorithm: SHA-256 Input buffer: This\x20is\x20a\x20testing\x20string\x20of\x20only\x20ASCII\x20chars:\x20!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{|}~
Hash 0x003f0420-0 | Handle: 0x003f0420 Source: CryptDuplicateHash of hash 0x003eec40-0 Algorithm: SHA-256 Input buffer: This\x20is\x20a\x20testing\x20string\x20of\x20only\x20ASCII\x20chars:\x20!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{|}~This\x20is\x20a\x20testing\x20string\x20of\x20only\x20ASCII\x20chars:\x20!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{|}~
Hash 0x003f1e30-0 | Handle: 0x003f1e30 Source: CryptCreateHash Algorithm: SHA-256 Input buffer: This\x20is\x20a\x20testing\x20string\x20of\x20only\x20ASCII\x20chars:\x20!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{|}~
Asymmetric key 0x003f1730-0 | Handle: 0x003f1730 Key origin: CryptGenKey Algorithm: RSA Public Key Exchange (2048 bit)
Asymmetric key 0x003f1770-0 | Handle: 0x003f1770 Key origin: CryptImportKey of unrecognized key blob PRIVATEKEYBLOB: \x07\x02\x00\x00\x00\xa4\x00\x00RSA2\x00\x04\x00\x00\x01\x00\x01\x00\x15\x80\xa8\xa2\x87\xce\xef\x19\xdf\xb5\xeb\xc5%M\xf4\x82I\xd6\xd6\x83\xc7\xb8\x03\1`1\x1b\x9cn8\xb8\x02 4\x14J\xf3\x02\xa9\xcf\x98N8\xd6W\x95\xd5\x11\xff,\xa8\xbaz,\x1c\x90V\xef\xb0s\xb1l\xcbM4\x0fs\x00\xc2\xf9Ye\x19\xaa\xee\xa8o\xa3'\xae4\xa6:\xb3\xc9\x17\xe4\xe3\xb5 \x19V\x8b\xb4%\xb0\x95$\xd9va\x88\xe7\xc68\x06\x83\x8aO\x8c?+Z\xca\xe0=\xf4\xcd\xac\x0b\xdfc\x1f\xae\x91\x89\xbfK\xe9\xc7.Cno9\xae\xe0\xdd&\xd7\xf9\xf6\xdf\xd5gw\x11\xdck\x01\xa6\\x0e8\xb3)\xda\x0b\xdb\xa0\xeb\xc4@M\xd8N\x9e\xe3N/\xa0\xb6\x01p\xcc:\xedU\xdcM\x07\x8e\xce\xcf \xf5&(6\x9e\xe1\x1f\xc0\x91\xf2\xc1by$\x1dh\xc88^\xc7\xa2\xe3\xb2Ke\x17\x02p\x96\xef i\xd1v\x83\\xd8M\xb8\x99\xe6\x80\x8b\xabu\xee\x17\xb0u\xf2{!\xe6+e\xdd\xe2\x84i/`\xf0\xd4\x19\x17\x92\xa7|T\xd9\xfb#\xe5h\x05\xe5s\xdca\x1d\xf5\xcbt5\x0br\x05\xac\xcd\xac8\x9a\x9a\xd6P\xa5 \x9a\xde.\xb8\x7f\xe7u*\x89\xe0\xcf\x188S\x8eE\xae,\xaf\xf1\xf2e\x9aO\x9d\xf8].\xe8\x0b}Ff|\xcd\x86\x9bG>\x86\xb5\x167d\xc1\xd3\x9a\xa0\x0eT\xf1v\x19\xcc\x01\x07y\xa09\xda\xf6\xf9\xca\x01\x1e\xec\x90\xbd\xfe5p{w\xb9|72\x87M\x9c\x17\xa5\x16\xf6%\x80\x13/\xba\xf8\x02\xcf\xa4\x95\x1fp\xb3\xfe\x0c\xfeh\xf7\xd4&\xb1\xcdj\xed\xd3\xe6l\xd7c:\x15\x1b\x99|\x07\xb07 \x03s+\x85\xfc\xcb\x07?\xa0\x19n0\x0b8KBt\x9e\xc3\x96\x0c\x13\xf2 \xa8\x04j\x14v\xcf\xf5\x9d\x1d\xc6T\xe1\xec\x13\xd1\x12e\x14\x11\xfd\x11\xc3\xfa/'\xe45\x05\x8d#y\x1f;H\x17:\x94}X\xbeJ\x07\xb7\x00\x0e\xba\x1c\x075\x88\xbb\xa1\x01fGO`\xa7\xf2d\x04\xa2\xdf\x94?\xa1 cQ\x05E\x19\x03\x11\xe4E\xac\xa4Y\xd0\xb4z\xb5\x1b#XL\xbe\xd9\x15;\xc1/\x1c\xd1\x1f\x14\\x7f\xd6~\xb4\xf5\xca\x8d\xea\x1e2W\x11\xfdq\xc3V\xe8\x04R-\x01m\x01\x8a\xe7\xa4J\x9f\x84\xd8,<eu-\xe1I\x13\xfbvz=`\xa1\x94\xd1\xca\xed\xb3, Exponent: 0x10001, Modulus: 0xbf8991ae1f63df0baccdf43de0ca5a2b3f8c4f8a830638c6e7886176d92495b025b48b561909b5e3e417c9b33aa634ae27a36fa8eeaa196559f9c200730f344dcb6cb173b0ef56901c2c7abaa82cff11d59557d6384e98cfa902f34a14340a02b8386e9c1b3160315c03b8c783d6d64982f44d25c5ebb5df19efce87a2a88015, Key hash: 24e530e98e8c4b1bcce3dffaa6fa11fc5f5795d80e9cc5fd36a6c4160c40e0e4 Algorithm: RSA Public Key Exchange (1024 bit)
Asymmetric key 0x003f17f0-0 | Handle: 0x003f17f0 Key origin: CryptImportKey of unrecognized key blob PUBLICKEYBLOB: \x06\x02\x00\x00\x00\xa4\x00\x00RSA1\x00\x04\x00\x00\x01\x00\x01\x00\x15\x80\xa8\xa2\x87\xce\xef\x19\xdf\xb5\xeb\xc5%M\xf4\x82I\xd6\xd6\x83\xc7\xb8\x03\1`1\x1b\x9cn8\xb8\x02 4\x14J\xf3\x02\xa9\xcf\x98N8\xd6W\x95\xd5\x11\xff,\xa8\xbaz,\x1c\x90V\xef\xb0s\xb1l\xcbM4\x0fs\x00\xc2\xf9Ye\x19\xaa\xee\xa8o\xa3'\xae4\xa6:\xb3\xc9\x17\xe4\xe3\xb5 \x19V\x8b\xb4%\xb0\x95$\xd9va\x88\xe7\xc68\x06\x83\x8aO\x8c?+Z\xca\xe0=\xf4\xcd\xac\x0b\xdfc\x1f\xae\x91\x89\xbf, Exponent: 0x10001, Modulus: 0xbf8991ae1f63df0baccdf43de0ca5a2b3f8c4f8a830638c6e7886176d92495b025b48b561909b5e3e417c9b33aa634ae27a36fa8eeaa196559f9c200730f344dcb6cb173b0ef56901c2c7abaa82cff11d59557d6384e98cfa902f34a14340a02b8386e9c1b3160315c03b8c783d6d64982f44d25c5ebb5df19efce87a2a88015, Key hash: 24e530e98e8c4b1bcce3dffaa6fa11fc5f5795d80e9cc5fd36a6c4160c40e0e4 Algorithm: RSA Public Key Exchange (1024 bit) Export 1 as Public Key Info: 0\x81\x89\x02\x81\x81\x00\xbf\x89\x91\xae\x1fc\xdf\x0b\xac\xcd\xf4=\xe0\xcaZ+?\x8cO\x8a\x83\x068\xc6\xe7\x88av\xd9$\x95\xb0%\xb4\x8bV\x19\x09\xb5\xe3\xe4\x17\xc9\xb3:\xa64\xae'\xa3o\xa8\xee\xaa\x19eY\xf9\xc2\x00s\x0f4M\xcbl\xb1s\xb0\xefV\x90\x1c,z\xba\xa8,\xff\x11\xd5\x95W\xd68N\x98\xcf\xa9\x02\xf3J\x144\x0a\x02\xb88n\x9c\x1b1`1\\x03\xb8\xc7\x83\xd6\xd6I\x82\xf4M%\xc5\xeb\xb5\xdf\x19\xef\xce\x87\xa2\xa8\x80\x15\x02\x03\x01\x00\x01
Asymmetric key 0x003f1870-0 | Handle: 0x003f1870 Key origin: CryptImportPublicKeyInfo of unrecognized public key, Exponent: 0x10001, Modulus: 0xd42e510b82ce9651675ac4b44a992fa899c748205f9ac03fa08c14bd287122eacbfb2f31a862f42a7e0dc79f33743f2928456f9badce4145995ac9525aa5e0e3d5452a104250abd57e4c04e2a61c6baff372ffcc8110297b7054f18e011cef10be1483b3206527852247a4b4aa25335b3011dcfaa137b3f34f7262b04af10b4a452b4ba6533646f7d561a0ea0e232007d035e15c15e6171c768b6c5f4c240216c9817129713115b8aef4c1431a8cb66ca56b6cc2f609c0fb90aa356710a7c21f1f759111f66b387459573c7fcb06e19bfda10efdfe2427b45a587967f7797b97887176776647548ecb44baa270324db42ab0884d8e7619da0c78dcfb7f100131, Key hash: 14a418186af7db844a37357e87c92187cc51c2b9727be8b37f753f2b9dc57f90 Algorithm: RSA Public Key Exchange (2048 bit)
Asymmetric key 0x003f1930-0 | Handle: 0x003f1930 Key origin: CryptImportPublicKeyInfo of previous export of key 0x003f17f0-0 (RSA Public Key Exchange (1024 bit) CryptImportKey of unrecognized key blob PUBLICKEYBLOB: \x06\x02\x00\x00\x00\xa4\x00\x00RSA1\x00\x04\x00\x00\x01\x00\x01\x00\x15\x80\xa8\xa2\x87\xce\xef\x19\xdf\xb5\xeb\xc5%M\xf4\x82I\xd6\xd6\x83\xc7\xb8\x03\1`1\x1b\x9cn8\xb8\x02 4\x14J\xf3\x02\xa9\xcf\x98N8\xd6W\x95\xd5\x11\xff,\xa8\xbaz,\x1c\x90V\xef\xb0s\xb1l\xcbM4\x0fs\x00\xc2\xf9Ye\x19\xaa\xee\xa8o\xa3'\xae4\xa6:\xb3\xc9\x17\xe4\xe3\xb5 \x19V\x8b\xb4%\xb0\x95$\xd9va\x88\xe7\xc68\x06\x83\x8aO\x8c?+Z\xca\xe0=\xf4\xcd\xac\x0b\xdfc\x1f\xae\x91\x89\xbf, Exponent: 0x10001, Modulus: 0xbf8991ae1f63df0baccdf43de0ca5a2b3f8c4f8a830638c6e7886176d92495b025b48b561909b5e3e417c9b33aa634ae27a36fa8eeaa196559f9c200730f344dcb6cb173b0ef56901c2c7abaa82cff11d59557d6384e98cfa902f34a14340a02b8386e9c1b3160315c03b8c783d6d64982f44d25c5ebb5df19efce87a2a88015, Key hash: 24e530e98e8c4b1bcce3dffaa6fa11fc5f5795d80e9cc5fd36a6c4160c40e0e4) as Public Key Info Algorithm: RSA Public Key Exchange (1024 bit)
Asymmetric key 0x003f1eb0-0 | Handle: 0x003f1eb0 Key origin: CryptGenKey Algorithm: RSA Public Key Exchange (1024 bit)
Asymmetric key 0x003f1f30-0 | Handle: 0x003f1f30 Key origin: CryptGenKey Algorithm: RSA Public Key Signature (1024 bit)
Asymmetric key 0x003f1f30-1 | Handle: 0x003f1f30 Key origin: CryptGenKey Algorithm: RSA Public Key Exchange (1024 bit)
Asymmetric key 0x003f1f70-0 | Handle: 0x003f1f70 Key origin: CryptGenKey Algorithm: RSA Public Key Signature (1024 bit)
Symmetric key 0x003f16f0-0 | Handle: 0x003f16f0 Key origin: CryptGenKey Algorithm: AES-256 (256 bit) ECB mode
Symmetric key 0x003f17b0-0 | Handle: 0x003f17b0 Key origin: CryptImportKey of unrecognized key blob SIMPLEBLOB (wrapping asymmetric key GUID: 0x003f1770-0): \x01\x02\x00\x00\x10f\x00\x00\x00\xa4\x00\x00==\xd9\x1a\x8a\xc8\x18L\xfe\xee%#\xcf_\xb6wV\xab\xddH\x02\xc2\xd02\xd1\x85_\xe4X\xde)\x98\xca\x0c\x10a\xa2bl\xe6S;\xab\x0f~\xfc\xb6\xee2(\\x89!V\xe6\x12\x83\xc1\x00&\xfa\xf0\x814\x05Z\x85?\xa5\xd8\xe5A\x98\x90\xec\xf0\xcc\x9d\xe9\x8b\x0cAI\x17\x04\x82\xeb\x8e\x0e(z\x7f\xbf\x08\xac$\x88h,\x82\x16\xe1\x00\xb1\x95=\x8epj3\xfa \xa9\x0fy\x14\xd5\xb8M\xd9b\xa5}\xbd[\xe0.q Algorithm: AES-256 (256 bit) CBC mode
Symmetric key 0x003f1830-0 | Handle: 0x003f1830 Key origin: CryptImportKey of unrecognized key blob PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00 \x00\x00\x00\x0c\xbc\x82\xc8`)0M\xd5,\xb0\xb6;@\xdc\x8d\xb1\xf1h\x9f\x1c6:\xdb!u\x03\x11\xf9\xe6\xc8\xde Algorithm: AES-256 (256 bit) CBC mode Encrypted data 1: (Unrecognized data) This\x20is\x20a\x20testing\x20string\x20of\x20only\x20ASCII\x20chars:\x20!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{|}~ Encrypted data 2: (Unrecognized likely PRIVATEKEYBLOB) \x07\x02\x00\x00\x00\xa4\x00\x00RSA2\x00\x04\x00\x00\x01\x00\x01\x00\x15\x80\xa8\xa2\x87\xce\xef\x19\xdf\xb5\xeb\xc5%M\xf4\x82I\xd6\xd6\x83\xc7\xb8\x03\1`1\x1b\x9cn8\xb8\x02\x0a4\x14J\xf3\x02\xa9\xcf\x98N8\xd6W\x95\xd5\x11\xff,\xa8\xbaz,\x1c\x90V\xef\xb0s\xb1l\xcbM4\x0fs\x00\xc2\xf9Ye\x19\xaa\xee\xa8o\xa3'\xae4\xa6:\xb3\xc9\x17\xe4\xe3\xb5\x09\x19V\x8b\xb4%\xb0\x95$\xd9va\x88\xe7\xc68\x06\x83\x8aO\x8c?+Z\xca\xe0=\xf4\xcd\xac\x0b\xdfc\x1f\xae\x91\x89\xbfK\xe9\xc7.Cno9\xae\xe0\xdd&\xd7\xf9\xf6\xdf\xd5gw\x11\x (1251 more characters) Encrypted data 3: (Likely PE file) MZThis_should_match_a_PE_file_signature Encrypted data 4: (Exported AES-256 (256 bit) key 0x003f1830-0 exported as PLAINTEXTKEYBLOB, used 6 times, from CryptImportKey of unrecognized key blob PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00 \x00\x00\x00\x0c\xbc\x82\xc8`)0M\xd5,\xb0\xb6;@\xdc\x8d\xb1\xf1h\x9f\x1c6:\xdb!u\x03\x11\xf9\xe6\xc8\xde) \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x0c\xbc\x82\xc8`)0M\xd5,\xb0\xb6;@\xdc\x8d\xb1\xf1h\x9f\x1c6:\xdb!u\x03\x11\xf9\xe6\xc8\xde Decrypted data 1: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x0c\xbc\x82\xc8`)0M\xd5,\xb0\xb6;@\xdc\x8d\xb1\xf1h\x9f\x1c6:\xdb!u\x03\x11\xf9\xe6\xc8\xde Decrypted data 2: \x07\x02\x00\x00\x00\xa4\x00\x00RSA2\x00\x04\x00\x00\x01\x00\x01\x00\x15\x80\xa8\xa2\x87\xce\xef\x19\xdf\xb5\xeb\xc5%M\xf4\x82I\xd6\xd6\x83\xc7\xb8\x03\1`1\x1b\x9cn8\xb8\x02\x0a4\x14J\xf3\x02\xa9\xcf\x98N8\xd6W\x95\xd5\x11\xff,\xa8\xbaz,\x1c\x90V\xef\xb0s\xb1l\xcbM4\x0fs\x00\xc2\xf9Ye\x19\xaa\xee\xa8o\xa3'\xae4\xa6:\xb3\xc9\x17\xe4\xe3\xb5\x09\x19V\x8b\xb4%\xb0\x95$\xd9va\x88\xe7\xc68\x06\x83\x8aO\x8c?+Z\xca\xe0=\xf4\xcd\xac\x0b\xdfc\x1f\xae\x91\x89\xbfK\xe9\xc7.Cno9\xae\xe0\xdd&\xd7\xf9\xf6\xdf\xd5gw\x11\x (1251 more characters) Export 1 as PLAINTEXTKEYBLOB: \x08\x02\x00\x00\x10f\x00\x00\x20\x00\x00\x00\x0c\xbc\x82\xc8`)0M\xd5,\xb0\xb6;@\xdc\x8d\xb1\xf1h\x9f\x1c6:\xdb!u\x03\x11\xf9\xe6\xc8\xde
Symmetric key 0x003f18b0-0 | Handle: 0x003f18b0 Key origin: CryptImportKey of previous export of key 0x003f1830-0 (AES-256 (256 bit) CryptImportKey of unrecognized key blob) as PLAINTEXTKEYBLOB Algorithm: AES-256 (256 bit) CBC mode
Symmetric key 0x003f1e70-0 | Handle: 0x003f1e70 Key origin: CryptDeriveKey from hash object SHA-256 GUID: 0x003f1e30-0 Algorithm: AES-256 (256 bit) CBC mode
Symmetric key 0x003f1e30-0 | Handle: 0x003f1e30 Key origin: CryptDuplicateKey of key object AES-256 (256 bit) (from CryptGenKey) GUID: 0x003f16f0-0 Algorithm: AES-256 (256 bit) CBC mode

Encrypts exported Crypto API key
Key handle-index 0x003f1830-0: 1 previously exported keys encrypted
Performs Crypto API operations with keys or hashes

Network activity detected but not expressed in API logs

#### Screenshots

#### Hosts

Direct | IP | Country Name
--- | --- | ---
Y | 8.8.8.8 [VT] | United States
N | 51.140.127.197 [VT] | United Kingdom

#### DNS

Name | Response | Post-Analysis Lookup
--- | --- | ---
time.windows.com [VT] | A 51.140.127.197 [VT] CNAME time.microsoft.akadns.net [VT] |

#### PE Information

Image Base | 0x00400000
Entry Point | 0x00408ff6
Reported Checksum | 0x00000000
Actual Checksum | 0x0003c262
Minimum OS Version | 6.0
PDB Path | D:\baka\SignatureTest\Release\Sigtest.pdb
Compile Time | 2019-05-26 22:18:00
Import Hash | 78a437bc5272bade2ebae8805b0e8391

#### Sections

Name | Virtual Address | Virtual Size | Size of Raw Data | Characteristics | Entropy
--- | --- | --- | --- | --- | ---
.text | 0x00001000 | 0x00024baf | 0x00024c00 | IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ | 6.65
.rdata | 0x00026000 | 0x000105e4 | 0x00010600 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 5.50
.data | 0x00037000 | 0x00001c80 | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE | 3.25
.rsrc | 0x00039000 | 0x000001e0 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ | 4.72
.reloc | 0x0003a000 | 0x0000227c | 0x00002400 | IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ | 6.45

#### Resources

Name | Offset | Size | Language | Sub-language | Entropy | File type
--- | --- | --- | --- | --- | --- | ---
RT_MANIFEST | 0x00039060 | 0x0000017d | LANG_ENGLISH | SUBLANG_ENGLISH_US | 4.91 | XML 1.0 document text

#### Imports

Library CRYPT32.dll:
• 0x42604c CryptExportPublicKeyInfo
• 0x426050 CryptStringToBinaryA
• 0x426054 CryptImportPublicKeyInfo
• 0x426058 CryptDecodeObjectEx
Library KERNEL32.dll:
• 0x426060 GetLastError
• 0x426064 WriteConsoleW
• 0x426068 LocalFree
• 0x42606c WideCharToMultiByte
• 0x426070 MultiByteToWideChar
• 0x426074 CreateFileW
• 0x426078 FindClose
• 0x42607c FindFirstFileExW
• 0x426080 FindNextFileW
• 0x426084 CloseHandle
• 0x426088 SetLastError
• 0x42608c GetModuleHandleW
• 0x426090 GetProcAddress
• 0x426094 GetStringTypeW
• 0x426098 EnterCriticalSection
• 0x42609c LeaveCriticalSection
• 0x4260a0 DeleteCriticalSection
• 0x4260a4 InitializeCriticalSectionAndSpinCount
• 0x4260a8 SwitchToThread
• 0x4260ac TlsAlloc
• 0x4260b0 TlsGetValue
• 0x4260b4 TlsSetValue
• 0x4260b8 TlsFree
• 0x4260bc GetSystemTimeAsFileTime
• 0x4260c0 EncodePointer
• 0x4260c4 DecodePointer
• 0x4260c8 CompareStringW
• 0x4260cc LCMapStringW
• 0x4260d0 GetLocaleInfoW
• 0x4260d4 GetCPInfo
• 0x4260d8 UnhandledExceptionFilter
• 0x4260dc SetUnhandledExceptionFilter
• 0x4260e0 GetCurrentProcess
• 0x4260e4 TerminateProcess
• 0x4260e8 IsProcessorFeaturePresent
• 0x4260ec QueryPerformanceCounter
• 0x4260f0 GetCurrentProcessId
• 0x4260f4 GetCurrentThreadId
• 0x4260f8 InitializeSListHead
• 0x4260fc IsDebuggerPresent
• 0x426100 GetStartupInfoW
• 0x426104 RtlUnwind
• 0x426108 RaiseException
• 0x42610c FreeLibrary
• 0x426110 LoadLibraryExW
• 0x426114 GetStdHandle
• 0x426118 WriteFile
• 0x42611c GetModuleFileNameW
• 0x426120 ExitProcess
• 0x426124 GetModuleHandleExW
• 0x426128 GetCommandLineA
• 0x42612c GetCommandLineW
• 0x426130 HeapAlloc
• 0x426134 HeapFree
• 0x426138 GetFileType
• 0x42613c FlushFileBuffers
• 0x426140 GetConsoleCP
• 0x426144 GetConsoleMode
• 0x426148 IsValidLocale
• 0x42614c GetUserDefaultLCID
• 0x426150 EnumSystemLocalesW
• 0x426154 ReadFile
• 0x426158 ReadConsoleW
• 0x42615c SetFilePointerEx
• 0x426160 HeapReAlloc
• 0x426164 IsValidCodePage
• 0x426168 GetACP
• 0x42616c GetOEMCP
• 0x426170 GetEnvironmentStringsW
• 0x426174 FreeEnvironmentStringsW
• 0x426178 SetEnvironmentVariableW
• 0x42617c SetStdHandle
• 0x426180 GetProcessHeap
• 0x426184 HeapSize
• 0x426188 SetEndOfFile
Library ADVAPI32.dll:
• 0x426000 CryptDestroyKey
• 0x426004 CryptEncrypt
• 0x426008 CryptDuplicateKey
• 0x42600c CryptDecrypt
• 0x426010 CryptExportKey
• 0x426014 CryptDeriveKey
• 0x426018 CryptSetKeyParam
• 0x42601c CryptImportKey
• 0x426020 CryptDuplicateHash
• 0x426024 CryptReleaseContext
• 0x426028 CryptGenKey
• 0x42602c CryptAcquireContextW
• 0x426030 CryptAcquireContextA
• 0x426034 CryptGetUserKey
• 0x426038 CryptHashData
• 0x42603c CryptGetHashParam
• 0x426040 CryptDestroyHash
• 0x426044 CryptCreateHash

.text
`.rdata
@.data
.rsrc
@.reloc
PhD4C
YYhTbB
35hpC
35hpC
35hpC
SVWUj
QhhpC
j,hpVC
QhhpC
7ARPRQh
35hpC
@HxtC
3=hpC
35hpC
3=hpC
xHxtC
@hh*C
bad allocation
address family not supported
address in use
address not available
already connected
argument list too long
argument out of domain
bad address
bad file descriptor
bad message
broken pipe
connection aborted
connection already in progress
connection refused
connection reset
cross device link
destination address required
device or resource busy
directory not empty
executable format error
file exists
file too large
filename too long
function not supported
host unreachable
identifier removed
illegal byte sequence
inappropriate io control operation
interrupted
invalid argument
invalid seek
io error
is a directory
message size
network down
network reset
network unreachable
no buffer space
no child process
no link
no lock available
no message available
no message
no protocol option
no space on device
no stream resources
no such device or address
no such device
no such file or directory
no such process
not a directory
not a socket
not a stream
not connected
not enough memory
not supported
operation canceled
operation in progress
operation not permitted
operation not supported
operation would block
owner dead
permission denied
protocol error
protocol not supported
read only file system
resource deadlock would occur
resource unavailable try again
result out of range
state not recoverable
stream timeout
text file busy
timed out
too many files open in system
too many files open
too many links
too many symbolic link levels
value too large
wrong protocol type
CreateSymbolicLinkW
GetFileInformationByHandleEx
SetFileInformationByHandle
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
InitializeCriticalSectionEx
InitOnceExecuteOnce
CreateEventExW
CreateSemaphoreW
CreateSemaphoreExW
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
CreateThreadpoolWait
SetThreadpoolWait
CloseThreadpoolWait
FlushProcessWriteBuffers
FreeLibraryWhenCallbackReturns
GetCurrentProcessorNumber
GetCurrentPackageId
GetTickCount64
GetSystemTimePreciseAsFileTime
InitializeConditionVariable
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
InitializeSRWLock
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
ReleaseSRWLockExclusive
SleepConditionVariableSRW
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolWork
CompareStringEx
GetLocaleInfoEx
LCMapStringEx
0123456789abcdefghijklmnopqrstuvwxyz
0123456789abcdefghijklmnopqrstuvwxyz
bad array new length
bad exception
__based(
__cdecl
__pascal
__stdcall
__thiscall
__fastcall
__vectorcall
__clrcall
__eabi
__swift_1
__swift_2
__ptr64
__restrict
__unaligned
restrict(
delete
operator
`vftable'
`vbtable'
`vcall'
`typeof'
`local static guard'
`string'
`vbase destructor'
`vector deleting destructor'
`default constructor closure'
`scalar deleting destructor'
`vector constructor iterator'
`vector destructor iterator'
`vector vbase constructor iterator'
`virtual displacement map'
`eh vector constructor iterator'
`eh vector destructor iterator'
`eh vector vbase constructor iterator'
`copy constructor closure'
`udt returning'
`RTTI
`local vftable'
`local vftable constructor closure'
new[]
delete[]
`omni callsig'
`placement delete closure'
`placement delete[] closure'
`managed vector constructor iterator'
`managed vector destructor iterator'
`eh vector copy constructor iterator'
`eh vector vbase copy constructor iterator'
`dynamic initializer for '
`dynamic atexit destructor for '
`vector copy constructor iterator'
`vector vbase copy constructor iterator'
`managed vector copy constructor iterator'
`local static thread guard'
operator ""
operator co_await
Type Descriptor'
Base Class Descriptor at (
Base Class Array'
Class Hierarchy Descriptor'
Complete Object Locator'
(null)
CorExitProcess
NAN(SNAN)
nan(snan)
NAN(IND)
nan(ind)
e+000
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
March
April
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
log10
atan2
floor
ldexp
_cabs
_hypot
frexp
_logb
_nextafter
AreFileApisANSI
CompareStringEx
EnumSystemLocalesEx
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
GetDateFormatEx
GetLocaleInfoEx
GetTimeFormatEx
GetUserDefaultLocaleName
InitializeCriticalSectionEx
IsValidLocaleName
LCMapStringEx
LCIDToLocaleName
LocaleNameToLCID
AppPolicyGetProcessTerminationMethod
UTF-8
UTF-16LEUNICODE
1#INF
1#QNAN
1#SNAN
1#IND
=\uI=
Eb2]A=
2ieO=
|W8A=
V%A+=
>,'1D=
?g)([|X>=
r7Yr7=
.K="=
b<log10
BC .=
"B <1=
#.X'=
?Unknown exception
bad locale name
false
iostream
iostream stream error
ios_base::badbit set
ios_base::failbit set
ios_base::eofbit set
TestContainer1
hProvA:
ProvA keyEx:
ProvA keySg:
hProvW:
userkeyEx:
userkeySg:
invalid string position
string too long
This is a testing string of only ASCII chars: !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]^_`abcdefghijklmnopqrstuvwxyz{|}~
main:
duplicate:
vector<T> too long
MZThis_should_match_a_PE_file_signature
random sym:
random asym:
import private:
import simple:
import public:
import plaintext:
import pki:
imported export:
imported export PKI:
hash:
derived key:
duplicate key:
unknown error
handles.txt
D:\baka\SignatureTest\Release\Sigtest.pdb
.text$di
.text$mn
.text$x
.text$yd
.idata$5
.00cfg
.CRT$XCA
.CRT$XCAA
.CRT$XCC
.CRT$XCL
.CRT$XCZ
.CRT$XIA
.CRT$XIAA
.CRT$XIAC
.CRT$XIC
.CRT$XIZ
.CRT$XPA
.CRT$XPX
.CRT$XPXA
.CRT$XPZ
.CRT$XTA
.CRT$XTZ
.rdata
.rdata$r
.rdata$sxdata
.rdata$zzzdbg
.rtc$IAA
.rtc$IZZ
.rtc$TAA
.rtc$TZZ
.xdata$x
.idata$2
.idata$3
.idata$4
.idata$6
.data
.data$r
.rsrc$01
.rsrc$02
CryptDecodeObjectEx
CryptExportPublicKeyInfo
CryptStringToBinaryA
CryptImportPublicKeyInfo
CRYPT32.dll
LocalFree
GetLastError
KERNEL32.dll
CryptReleaseContext
CryptGenKey
CryptAcquireContextW
CryptAcquireContextA
CryptGetUserKey
CryptDestroyKey
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptDuplicateHash
CryptImportKey
CryptSetKeyParam
CryptDeriveKey
CryptExportKey
CryptDecrypt
CryptDuplicateKey
CryptEncrypt
ADVAPI32.dll
WideCharToMultiByte
MultiByteToWideChar
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
CloseHandle
SetLastError
GetModuleHandleW
GetProcAddress
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
RaiseException
FreeLibrary
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
ReadFile
ReadConsoleW
SetFilePointerEx
HeapReAlloc
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
HeapSize
WriteConsoleW
SetEndOfFile
Copyright (c) by P.J. Plauger, licensed by Dinkumware, Ltd. ALL RIGHTS RESERVED.
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
abcdefghijklmnopqrstuvwxyz
ABCDEFGHIJKLMNOPQRSTUVWXYZ
.?AV_Locimp@locale@std@@
.?AVbad_alloc@std@@
.?AVlogic_error@std@@
.?AVlength_error@std@@
.?AVout_of_range@std@@
.?AVtype_info@@
.?AVbad_array_new_length@std@@
.?AVbad_exception@std@@
.?AVfailure@ios_base@std@@
.?AVruntime_error@std@@
.?AVerror_category@std@@
.?AV?$ctype@D@std@@
.?AVsystem_error@std@@
.?AV_Facet_base@std@@
.?AV_Generic_error_category@std@@
.?AU_Crt_new_delete@std@@
.?AV?$numpunct@D@std@@
.?AV_Iostream_error_category@std@@
.?AUctype_base@std@@
.?AVfacet@locale@std@@
.?AV_System_error@std@@
.?AVexception@std@@
.?AV?$num_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@
.?AV?$basic_filebuf@DU?$char_traits@D@std@@@std@@
.?AV?$codecvt@DDU_Mbstatet@@@std@@
.?AVios_base@std@@
.?AVcodecvt_base@std@@
.?AV?$_Iosb@H@std@@
.?AV?$basic_ofstream@DU?$char_traits@D@std@@@std@@
.?AV?$basic_streambuf@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ios@DU?$char_traits@D@std@@@std@@
.?AV?$basic_ostream@DU?$char_traits@D@std@@@std@@
=2>6>:>>>B>F>J>N>
?/?z?
<A>^>
> >$>(>,>0>4>8><>
1 1(10181@1H1P1X1`1h1p1
Z2^2b2f2
7(747@7L7X7
8$8,848<8
9 9(90989@9H9P9X9
Wkernel32.dll
zh-CHS
ar-SA
bg-BG
ca-ES
zh-TW
cs-CZ
da-DK
de-DE
el-GR
en-US
fi-FI
fr-FR
he-IL
hu-HU
is-IS
it-IT
ja-JP
ko-KR
nl-NL
nb-NO
pl-PL
pt-BR
ro-RO
ru-RU
hr-HR
sk-SK
sq-AL
sv-SE
th-TH
tr-TR
ur-PK
id-ID
uk-UA
be-BY
sl-SI
et-EE
lv-LV
lt-LT
fa-IR
vi-VN
hy-AM
az-AZ-Latn
eu-ES
mk-MK
tn-ZA
xh-ZA
zu-ZA
af-ZA
ka-GE
fo-FO
hi-IN
mt-MT
se-NO
ms-MY
kk-KZ
ky-KG
sw-KE
uz-UZ-Latn
tt-RU
bn-IN
pa-IN
gu-IN
ta-IN
te-IN
kn-IN
ml-IN
mr-IN
sa-IN
mn-MN
cy-GB
gl-ES
kok-IN
syr-SY
div-MV
quz-BO
ns-ZA
mi-NZ
ar-IQ
zh-CN
de-CH
en-GB
es-MX
fr-BE
it-CH
nl-BE
nn-NO
pt-PT
sr-SP-Latn
sv-FI
az-AZ-Cyrl
se-SE
ms-BN
uz-UZ-Cyrl
quz-EC
ar-EG
zh-HK
de-AT
en-AU
es-ES
fr-CA
sr-SP-Cyrl
se-FI
quz-PE
ar-LY
zh-SG
de-LU
en-CA
es-GT
fr-CH
hr-BA
smj-NO
ar-DZ
zh-MO
de-LI
en-NZ
es-CR
fr-LU
bs-BA-Latn
smj-SE
ar-MA
en-IE
es-PA
fr-MC
sr-BA-Latn
sma-NO
ar-TN
en-ZA
es-DO
sr-BA-Cyrl
sma-SE
ar-OM
en-JM
es-VE
sms-FI
ar-YE
en-CB
es-CO
smn-FI
ar-SY
en-BZ
es-PE
ar-JO
en-TT
es-AR
ar-LB
en-ZW
es-EC
ar-KW
en-PH
es-CL
ar-AE
es-UY
ar-BH
es-PY
ar-QA
es-BO
es-SV
es-HN
es-NI
es-PR
zh-CHT
af-za
ar-ae
ar-bh
ar-dz
ar-eg
ar-iq
ar-jo
ar-kw
ar-lb
ar-ly
ar-ma
ar-om
ar-qa
ar-sa
ar-sy
ar-tn
ar-ye
az-az-cyrl
az-az-latn
be-by
bg-bg
bn-in
bs-ba-latn
ca-es
cs-cz
cy-gb
da-dk
de-at
de-ch
de-de
de-li
de-lu
div-mv
el-gr
en-au
en-bz
en-ca
en-cb
en-gb
en-ie
en-jm
en-nz
en-ph
en-tt
en-us
en-za
en-zw
es-ar
es-bo
es-cl
es-co
es-cr
es-do
es-ec
es-es
es-gt
es-hn
es-mx
es-ni
es-pa
es-pe
es-pr
es-py
es-sv
es-uy
es-ve
et-ee
eu-es
fa-ir
fi-fi
fo-fo
fr-be
fr-ca
fr-ch
fr-fr
fr-lu
fr-mc
gl-es
gu-in
he-il
hi-in
hr-ba
hr-hr
hu-hu
hy-am
id-id
is-is
it-ch
it-it
ja-jp
ka-ge
kk-kz
kn-in
ko-kr
kok-in
ky-kg
lt-lt
lv-lv
mi-nz
mk-mk
ml-in
mn-mn
mr-in
ms-bn
ms-my
mt-mt
nb-no
nl-be
nl-nl
nn-no
ns-za
pa-in
pl-pl
pt-br
pt-pt
quz-bo
quz-ec
quz-pe
ro-ro
ru-ru
sa-in
se-fi
se-no
se-se
sk-sk
sl-si
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sq-al
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
sv-fi
sv-se
sw-ke
syr-sy
ta-in
te-in
th-th
tn-za
tr-tr
tt-ru
uk-ua
ur-pk
uz-uz-cyrl
uz-uz-latn
vi-vn
xh-za
zh-chs
zh-cht
zh-cn
zh-hk
zh-mo
zh-sg
zh-tw
zu-za
Bapi-ms-win-core-fibers-l1-1-1
api-ms-win-core-synch-l1-2-0
kernel32
api-ms-
ext-ms-
(null)
mscoree.dll
ALC_ALL
LC_COLLATE
LC_CTYPE
LC_MONETARY
LC_NUMERIC
LC_TIME
utf-8
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
March
April
August
September
October
November
December
MM/dd/yy
dddd, MMMM dd, yyyy
HH:mm:ss
en-US
Bapi-ms-win-core-datetime-l1-1-1
api-ms-win-core-fibers-l1-1-1
api-ms-win-core-file-l1-2-2
api-ms-win-core-localization-l1-2-1
api-ms-win-core-localization-obsolete-l1-2-0
api-ms-win-core-processthreads-l1-1-2
api-ms-win-core-string-l1-1-0
api-ms-win-core-synch-l1-2-0
api-ms-win-core-sysinfo-l1-2-1
api-ms-win-core-winrt-l1-1-0
api-ms-win-core-xstate-l2-1-0
api-ms-win-rtcore-ntuser-window-l1-1-0
api-ms-win-security-systemfunctions-l1-1-0
ext-ms-win-ntuser-dialogbox-l1-1-0
ext-ms-win-ntuser-windowstation-l1-1-0
advapi32
kernel32
ntdll
api-ms-win-appmodel-runtime-l1-1-2
user32
api-ms-
ext-ms-
Bja-JP
zh-CN
ko-KR
zh-TW
american
american english
american-english
australian
belgian
canadian
chinese
chinese-hongkong
chinese-simplified
chinese-singapore
chinese-traditional
dutch-belgian
english-american
english-aus
english-belize
english-can
english-caribbean
english-ire
english-jamaica
english-nz
english-south africa
english-trinidad y tobago
english-uk
english-us
english-usa
french-belgian
french-canadian
french-luxembourg
french-swiss
german-austrian
german-lichtenstein
german-luxembourg
german-swiss
irish-english
italian-swiss
norwegian
norwegian-bokmal
norwegian-nynorsk
portuguese-brazilian
spanish-argentina
spanish-bolivia
spanish-chile
spanish-colombia
spanish-costa rica
spanish-dominican republic
spanish-ecuador
spanish-el salvador
spanish-guatemala
spanish-honduras
spanish-mexican
spanish-modern
spanish-nicaragua
spanish-panama
spanish-paraguay
spanish-peru
spanish-puerto rico
spanish-uruguay
spanish-venezuela
swedish-finland
swiss
america
britain
china
czech
england
great britain
holland
hong-kong
new-zealand
pr china
pr-china
puerto-rico
slovak
south africa
south korea
south-africa
south-korea
trinidad & tobago
united-kingdom
united-states
zh-CHS
ar-SA
bg-BG
ca-ES
cs-CZ
da-DK
de-DE
el-GR
fi-FI
fr-FR
he-IL
hu-HU
is-IS
it-IT
nl-NL
nb-NO
pl-PL
pt-BR
ro-RO
ru-RU
hr-HR
sk-SK
sq-AL
sv-SE
th-TH
tr-TR
ur-PK
id-ID
uk-UA
be-BY
sl-SI
et-EE
lv-LV
lt-LT
fa-IR
vi-VN
hy-AM
az-AZ-Latn
eu-ES
mk-MK
tn-ZA
xh-ZA
zu-ZA
af-ZA
ka-GE
fo-FO
hi-IN
mt-MT
se-NO
ms-MY
kk-KZ
ky-KG
sw-KE
uz-UZ-Latn
tt-RU
bn-IN
pa-IN
gu-IN
ta-IN
te-IN
kn-IN
ml-IN
mr-IN
sa-IN
mn-MN
cy-GB
gl-ES
kok-IN
syr-SY
div-MV
quz-BO
ns-ZA
mi-NZ
ar-IQ
de-CH
en-GB
es-MX
fr-BE
it-CH
nl-BE
nn-NO
pt-PT
sr-SP-Latn
sv-FI
az-AZ-Cyrl
se-SE
ms-BN
uz-UZ-Cyrl
quz-EC
ar-EG
zh-HK
de-AT
en-AU
es-ES
fr-CA
sr-SP-Cyrl
se-FI
quz-PE
ar-LY
zh-SG
de-LU
en-CA
es-GT
fr-CH
hr-BA
smj-NO
ar-DZ
zh-MO
de-LI
en-NZ
es-CR
fr-LU
bs-BA-Latn
smj-SE
ar-MA
en-IE
es-PA
fr-MC
sr-BA-Latn
sma-NO
ar-TN
en-ZA
es-DO
sr-BA-Cyrl
sma-SE
ar-OM
en-JM
es-VE
sms-FI
ar-YE
en-CB
es-CO
smn-FI
ar-SY
en-BZ
es-PE
ar-JO
en-TT
es-AR
ar-LB
en-ZW
es-EC
ar-KW
en-PH
es-CL
ar-AE
es-UY
ar-BH
es-PY
ar-QA
es-BO
es-SV
es-HN
es-NI
es-PR
zh-CHT
af-za
ar-ae
ar-bh
ar-dz
ar-eg
ar-iq
ar-jo
ar-kw
ar-lb
ar-ly
ar-ma
ar-om
ar-qa
ar-sa
ar-sy
ar-tn
ar-ye
az-az-cyrl
az-az-latn
be-by
bg-bg
bn-in
bs-ba-latn
ca-es
cs-cz
cy-gb
da-dk
de-at
de-ch
de-de
de-li
de-lu
div-mv
el-gr
en-au
en-bz
en-ca
en-cb
en-gb
en-ie
en-jm
en-nz
en-ph
en-tt
en-us
en-za
en-zw
es-ar
es-bo
es-cl
es-co
es-cr
es-do
es-ec
es-es
es-gt
es-hn
es-mx
es-ni
es-pa
es-pe
es-pr
es-py
es-sv
es-uy
es-ve
et-ee
eu-es
fa-ir
fi-fi
fo-fo
fr-be
fr-ca
fr-ch
fr-fr
fr-lu
fr-mc
gl-es
gu-in
he-il
hi-in
hr-ba
hr-hr
hu-hu
hy-am
id-id
is-is
it-ch
it-it
ja-jp
ka-ge
kk-kz
kn-in
kok-in
ko-kr
ky-kg
lt-lt
lv-lv
mi-nz
mk-mk
ml-in
mn-mn
mr-in
ms-bn
ms-my
mt-mt
nb-no
nl-be
nl-nl
nn-no
ns-za
pa-in
pl-pl
pt-br
pt-pt
quz-bo
quz-ec
quz-pe
ro-ro
ru-ru
sa-in
se-fi
se-no
se-se
sk-sk
sl-si
sma-no
sma-se
smj-no
smj-se
smn-fi
sms-fi
sq-al
sr-ba-cyrl
sr-ba-latn
sr-sp-cyrl
sr-sp-latn
sv-fi
sv-se
sw-ke
syr-sy
ta-in
te-in
th-th
tn-za
tr-tr
tt-ru
uk-ua
ur-pk
uz-uz-cyrl
uz-uz-latn
vi-vn
xh-za
zh-chs
zh-cht
zh-cn
zh-hk
zh-mo
zh-sg
zh-tw
zu-za
CONOUT$
TestContainer1

#### Process Tree

- hhwwCozu.exe 1424

Search term
hhwwCozu.exe, PID: 1424, Parent PID: 2008
Full Path: C:\Users\John\AppData\Local\Temp\hhwwCozu.exe
Command Line: "C:\Users\John\AppData\Local\Temp\hhwwCozu.exe"
default registry filesystem network process threading services device synchronization crypto browser all
API Filter

- 1
- 2

Error loading data. Please reload the page and if the error persists contact us.

- 1
- 2

Download PCAP

#### Hosts

Direct | IP | Country Name
--- | --- | ---
Y | 8.8.8.8 [VT] | United States
N | 51.140.127.197 [VT] | United Kingdom

#### TCP

No TCP connections recorded.

#### UDP

Source | Source Port | Destination | Destination Port
--- | --- | --- | ---
192.168.1.101 | 123 | 51.140.127.197 time.windows.com | 123
192.168.1.101 | 61816 | 8.8.8.8 | 53

- 192.168.1.101:123 → 51.140.127.197:123

      00000000: db00 11fa 0000 0000 0001 0400 0000 0000  ................
      00000010: e095 8f16 0818 9374 0000 0000 0000 0000  .......t........
      00000020: 0000 0000 0000 0000 e095 8f2e 4400 0000  ............D...

- 51.140.127.197:123 → 192.168.1.101:123

      00000000: 1c02 11e9 0000 13e0 0000 0386 8106 0f1e  ................
      00000010: e095 8f24 9c46 a784 e095 8f2e 4400 0000  ...$.F......D...
      00000020: e095 8f30 8059 6927 e095 8f30 805f fbe9  ...0.Yi'...0._..

#### DNS

Name | Response | Post-Analysis Lookup
--- | --- | ---
time.windows.com [VT] | A 51.140.127.197 [VT] CNAME time.microsoft.akadns.net [VT] |

#### HTTP Requests

No HTTP requests performed.

#### SMTP traffic

No SMTP traffic performed.

#### IRC traffic

No IRC requests performed.

#### ICMP traffic

No ICMP traffic performed.

#### CIF Results

No CIF Results

#### Suricata Alerts

No Suricata Alerts

#### Suricata TLS

No Suricata TLS

#### Suricata HTTP

No Suricata HTTP

Sorry! No dropped Suricata Extracted files.

File name | handles.txt
Associated Filenames | C:\Users\John\AppData\Local\Temp\handles.txt
File Size | 410 bytes
File Type | ASCII text, with CRLF line terminators
MD5 | bd414a2b0c4d2fa6f6ccd0e81805539c
SHA1 | 006127ef5efb45172449f27125c4c12eff836e9e
SHA256 | 6bef6ef25f95b56d60b477d51648da93f5d927fe523caed6d26c1c1b578555ec
CRC32 | B53302CD
Ssdeep | None
ClamAV | None
Yara | None matched
VirusTotal | Search for Analysis
| Download Display Text
    hashes:
    main:3eec40
    duplicate:3f0420
    keys:
    random sym:3f16f0
    random asym:3f1730
    import private:3f1770
    import simple:3f17b0
    import public:3f17f0
    import plaintext:3f1830
    import pki:3f1870
    imported export:3f18b0
    imported export PKI:3f1930
    hash:3f1e30
    derived key:3f1e70
    duplicate key:3f1e30
    hProvA:3e8738
    ProvA keyEx:3f1eb0
    ProvA keySg:3f1f30
    hProvW:3f2e30
    userkeyEx:3f1f30
    userkeySg:3f1f70

Sorry! No decompressed files.
Sorry! No CryptDecrypt drops.
Sorry! No reconstructed memory writes.
Sorry! No reconstructed memory writes.
Sorry! No reconstructed memory protects.

JSON Report | Download
HTML Report | Download
Summary HTML Report | Download

#### Comments

No comments posted

#### Processing ( 1.504 seconds )

- 0.661 Static
- 0.364 AnalysisInfo
- 0.321 peid
- 0.077 BehaviorAnalysis
- 0.026 NetworkAnalysis
- 0.025 Dropped
- 0.008 TargetInfo
- 0.006 config_decoder
- 0.006 Strings
- 0.005 Memory
- 0.004 Debug
- 0.001 CryptDecrypt

#### Signatures ( 0.041 seconds )

- 0.009 crypto_analysis_signature
- 0.005 antiav_detectreg
- 0.003 antiav_detectfile
- 0.003 ransomware_extensions
- 0.003 ransomware_files
- 0.002 persistence_autorun
- 0.002 infostealer_bitcoin
- 0.002 infostealer_ftp
- 0.001 tinba_behavior
- 0.001 api_spamming
- 0.001 decoy_document
- 0.001 stealth_timeout
- 0.001 antianalysis_detectfile
- 0.001 antianalysis_detectreg
- 0.001 antivm_vbox_files
- 0.001 geodo_banking_trojan
- 0.001 browser_security
- 0.001 disables_browser_warn
- 0.001 infostealer_im
- 0.001 infostealer_mail

#### Reporting ( 2.281 seconds )

- 0.907 ReportHTML
- 0.489 ReportHTMLSummary
- 0.051 JsonDump

Task ID | 735
Mongo ID | 5ceb10c6959c4558a8930388
Cuckoo release | 1.3-NG
| Delete