Windows Analysis Report
alloydb-auth-proxy-x64.exe

ID:	1543750
Product:	CloudBasic
Start time:	11:25:37
Start date:	28.10.2024
Sample:	alloydb-auth-proxy-x64.exe
Cookbook:	defaultwindowsinteractivecookbook.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	f276d90ff5a58f12099afcc830730562
SHA1:	435ff502ee8089e9c3a4655fa0770c3426143f88
SHA256:	95ed30d202d505e4f0be5ca984b19c25c82eed454f4f1cdf1ff33c574351e490
Filetype:	Win64 Executable Console (202006/5) 92.65%

Name	Type	MD5	SHA1	SHA256

Compliance

Source: alloydb-auth-proxy-x64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

System Summary

Source: alloydb-auth-proxy-x64.exe

Static PE information: Number of sections : 15 > 10

Source: alloydb-auth-proxy-x64.exe	Static PE information: Section: /19 ZLIB complexity 0.9998790953243333
Source: alloydb-auth-proxy-x64.exe	Static PE information: Section: /32 ZLIB complexity 0.9904288657082749
Source: alloydb-auth-proxy-x64.exe	Static PE information: Section: /78 ZLIB complexity 0.9913004380761931

Source: classification engine

Classification label: clean2.winEXE@2/0@0/0

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03

Source: alloydb-auth-proxy-x64.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe

File read: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe

Source: unknown	Process created: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe "C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe"
Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe	Section loaded: umpdc.dll

Source: alloydb-auth-proxy-x64.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: alloydb-auth-proxy-x64.exe

Static file information: File size 33052160 > 1048576

Source: alloydb-auth-proxy-x64.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x997400
Source: alloydb-auth-proxy-x64.exe	Static PE information: Raw size of .rdata is bigger than: 0x100000 < 0xb97c00
Source: alloydb-auth-proxy-x64.exe	Static PE information: Raw size of /19 is bigger than: 0x100000 < 0x17ba00
Source: alloydb-auth-proxy-x64.exe	Static PE information: Raw size of /65 is bigger than: 0x100000 < 0x2a6600
Source: alloydb-auth-proxy-x64.exe	Static PE information: Raw size of /78 is bigger than: 0x100000 < 0x1cd000
Source: alloydb-auth-proxy-x64.exe	Static PE information: Raw size of .symtab is bigger than: 0x100000 < 0x27f400

Source: alloydb-auth-proxy-x64.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Data Obfuscation

Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: .xdata
Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: /4
Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: /19
Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: /32
Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: /46
Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: /65
Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: /78
Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: /90
Source: alloydb-auth-proxy-x64.exe	Static PE information: section name: .symtab

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe

Process information queried: ProcessInformation

Anti Debugging

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Language, Device and Operating System Detection

Source: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe

Queries volume information: C:\Users\user\Desktop\alloydb-auth-proxy-x64.exe VolumeInformation