Analysis Report · CAPE Sandbox

Analysis Details

Category	Package	Started	Completed	Duration	Options	Logs
FILE	exe	2026-07-28 12:55:14	2026-07-28 13:07:00	706s
Reports	JSON

Options

syscall=0

Analysis Log

2026-03-12 02:35:53,049 [root] INFO: Date set to: 20260728T13:02:03, timeout set to: 200
2026-07-28 13:02:03,531 [root] DEBUG: Starting analyzer from: C:\ks0bd701
2026-07-28 13:02:04,124 [root] DEBUG: Storing results at: C:\pSvMuZaxdT
2026-07-28 13:02:05,109 [root] DEBUG: Pipe server name: \\.\PIPE\zXWCld
2026-07-28 13:02:05,171 [root] DEBUG: Python path: C:\Users\malware\AppData\Local\Programs\Python\Python310-32
2026-07-28 13:02:05,171 [root] INFO: analysis running as an admin
2026-07-28 13:02:05,171 [root] DEBUG: no analysis package configured, picking one for you
2026-07-28 13:02:22,640 [root] INFO: analysis package selected: "exe"
2026-07-28 13:02:22,796 [root] DEBUG: importing analysis package module: "modules.packages.exe"...
2026-07-28 13:02:23,046 [root] DEBUG: imported analysis package "exe"
2026-07-28 13:02:23,062 [root] DEBUG: initializing analysis package "exe"...
2026-07-28 13:02:23,062 [lib.common.common] INFO: wrapping
2026-07-28 13:02:23,093 [lib.core.compound] INFO: C:\Users\malware\AppData\Local\Temp already exists, skipping creation
2026-07-28 13:02:23,108 [root] DEBUG: New location of moved file: C:\Users\malware\AppData\Local\Temp\embeddinggemma-transf.gz
2026-07-28 13:02:23,108 [root] INFO: Analyzer: Package modules.packages.exe does not specify a dll option
2026-07-28 13:02:23,108 [root] INFO: Analyzer: Package modules.packages.exe does not specify a dll_64 option
2026-07-28 13:02:23,108 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader option
2026-07-28 13:02:23,108 [root] INFO: Analyzer: Package modules.packages.exe does not specify a loader_64 option
2026-07-28 13:02:30,061 [root] DEBUG: Imported auxiliary module "modules.auxiliary.browser"
2026-07-28 13:02:30,156 [root] DEBUG: Imported auxiliary module "modules.auxiliary.digisig"
2026-07-28 13:02:30,828 [root] DEBUG: Imported auxiliary module "modules.auxiliary.disguise"
2026-07-28 13:02:30,905 [root] DEBUG: Imported auxiliary module "modules.auxiliary.human"
2026-07-28 13:02:30,984 [lib.api.screenshot] DEBUG: Importing 'PIL.ImageChops'
2026-07-28 13:02:31,031 [lib.api.screenshot] ERROR: No module named 'PIL'
2026-07-28 13:02:31,031 [root] DEBUG: Imported auxiliary module "modules.auxiliary.screenshots"
2026-07-28 13:02:31,031 [root] DEBUG: Imported auxiliary module "modules.auxiliary.tlsdump"
2026-07-28 13:02:31,031 [root] DEBUG: Initialized auxiliary module "Browser"
2026-07-28 13:02:31,640 [root] DEBUG: attempting to configure 'Browser' from data
2026-07-28 13:02:32,062 [root] DEBUG: module Browser does not support data configuration, ignoring
2026-07-28 13:02:32,471 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.browser"...
2026-07-28 13:02:32,471 [root] DEBUG: Started auxiliary module modules.auxiliary.browser
2026-07-28 13:02:32,471 [root] DEBUG: Initialized auxiliary module "DigiSig"
2026-07-28 13:02:32,471 [root] DEBUG: attempting to configure 'DigiSig' from data
2026-07-28 13:02:32,471 [root] DEBUG: module DigiSig does not support data configuration, ignoring
2026-07-28 13:02:32,471 [root] DEBUG: Trying to start auxiliary module "modules.auxiliary.digisig"...
2026-07-28 13:02:32,471 [modules.auxiliary.digisig] DEBUG: Checking for a digital signature

Process Log

Pre-Script Log

During-Script Log

Machine Information

Name	Label	Manager	Started On	Shutdown On	Route
win10	win10	KVM	2026-07-28 12:55:14	2026-07-28 13:07:00	`none`

File Details

File Information

File Name	embeddinggemma-transf.gz
File Type	gzip compressed data, last modified: Thu Sep 4 05:52:58 2025, original size modulo 2^32 1269637120 gzip compressed data, reserved method, ASCII, encrypted, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 1269637120
File Size	1150701145 bytes
MD5	49ffe59ae896e38588195a4603cdba5d
SHA1	7fb534fa3972c47218adc14f96b73f7cd0b302bc
SHA256	647b4d84566dd28e838c9e96bd2c2210ebcc3b2b8287eb1b6ebc292e9fac8152 VT MWDB Bazaar
SHA3-384	d14e5d44c0ba8baf460a263c3afb796a3557ba9c2deaf1a4d37239bb64449d55ced4a7521ffc4eff39f43cc656dbcca6
CRC32	B8B9E737
TLSH	T1FAC933F548C865D763C6AD13D1F9763AC22224A16E165DCA42E02EC60F7FD81EA25F0F
Ssdeep	25165824:zkhQ86lGMfyOoNBYgV3eNDsEbB+aXVbR8Ik0cXHBuDT1D8UIksDz:zka86lZPkBwT+albRghSBgIsDz
Yara	embedded_macho - Contains an embedded Mach-O file (nex) vmdetect - Possibly employs anti-virtualization techniques (nex)

Tools: Extract: Strings Extract: BinGraph

Processing 97.59s

97.533s CAPE
0.054s AnalysisInfo
0.002s Debug
0.001s BehaviorAnalysis
0.001s script_log_processing

Signatures 0.05s

0.008s ransomware_files
0.005s ransomware_extensions_known
0.004s antiav_detectreg
0.003s antiav_detectfile
0.002s antianalysis_detectfile
0.002s disables_browser_warn
0.002s infostealer_bitcoin
0.002s infostealer_ftp
0.002s revil_mutexes
0.002s territorial_disputes_sigs
0.001s antianalysis_detectreg
0.001s antivm_vbox_files
0.001s antivm_vbox_keys
0.001s antivm_vmware_files
0.001s geodo_banking_trojan
0.001s browser_addon
0.001s browser_security
0.001s uac_bypass_cmstpcom
0.001s disables_backups
0.001s disables_power_options
0.001s azorult_mutexes
0.001s echelon_files
0.001s infostealer_im
0.001s infostealer_mail
0.001s poullight_files
0.001s masquerade_process_name
0.001s satan_mutexes
0.001s modirat_behavior
0.001s rat_spynet
0.001s tampers_etw
0.001s ursnif_behavior

Reporting 0.00s

0.001s JsonDump

Signatures

Binary file triggered multiple YARA rules

Binary triggered YARA rule: embedded_macho

Binary triggered YARA rule: vmdetect

No behavioral analysis data available.

Sorry! No strace.

Sorry! No tracee.

Hosts (0)
DNS (0)

Hosts

No hosts contacted.

TCP Connections

No TCP connections recorded.

UDP Connections

No UDP connections recorded.

DNS Requests

No domains contacted.

HTTP Requests

No HTTP(s) requests performed.

SMTP Traffic

No SMTP traffic performed.

IRC Traffic

No IRC requests performed.

ICMP Traffic

No ICMP traffic performed.

CIF Results

No CIF Results

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Suricata HTTP

No Suricata HTTP

Sorry! No Suricata Extracted files.

No dropped files found.

Sorry! No process dumps.