{"action":"created","issue":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2153","repository_url":"https://api.github.com/repos/cuckoosandbox/cuckoo","labels_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2153/labels{/name}","comments_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2153/comments","events_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2153/events","html_url":"https://github.com/cuckoosandbox/cuckoo/issues/2153","id":303005033,"number":2153,"title":"Static Analysis: No exe file static information，Only string results","user":{"login":"w0r1dhe110","id":35865922,"avatar_url":"https://avatars0.githubusercontent.com/u/35865922?v=4","gravatar_id":"","url":"https://api.github.com/users/w0r1dhe110","html_url":"https://github.com/w0r1dhe110","followers_url":"https://api.github.com/users/w0r1dhe110/followers","following_url":"https://api.github.com/users/w0r1dhe110/following{/other_user}","gists_url":"https://api.github.com/users/w0r1dhe110/gists{/gist_id}","starred_url":"https://api.github.com/users/w0r1dhe110/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/w0r1dhe110/subscriptions","organizations_url":"https://api.github.com/users/w0r1dhe110/orgs","repos_url":"https://api.github.com/users/w0r1dhe110/repos","events_url":"https://api.github.com/users/w0r1dhe110/events{/privacy}","received_events_url":"https://api.github.com/users/w0r1dhe110/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2018-03-07T08:26:59Z","updated_at":"2018-03-07T18:27:20Z","closed_at":null,"author_association":"NONE","body":"##### My issue is:\r\nNo exe file static information\r\n![default](https://user-images.githubusercontent.com/35865922/37081011-1c63c70c-2223-11e8-9620-47650b0c1d57.PNG)\r\nOnly string results\r\n![default](https://user-images.githubusercontent.com/35865922/37081158-8d127d68-2223-11e8-8222-17c1aaaa878a.PNG)\r\nSome analysis, only the static information, no string results.\r\n##### My Cuckoo version and operating system are:\r\ncuckoo v2.0.5   os:Ubuntu16\r\n##### This can be reproduced by:\r\n\r\n##### The log, error, files etc can be found at:\r\n`\r\n2018-03-06 17:13:15,968 [cuckoo.core.scheduler] INFO: Task #1: acquired machine Windows7_1 (label=Windows7_1)\r\n2018-03-06 17:13:15,985 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 16327 (interface=vboxnet0, host=192.168.56.2)\r\n2018-03-06 17:13:15,986 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer\r\n2018-03-06 17:13:16,347 [cuckoo.machinery.virtualbox] DEBUG: Starting vm Windows7_1\r\n2018-03-06 17:13:16,480 [cuckoo.machinery.virtualbox] DEBUG: Restoring virtual machine Windows7_1 to Windows7_1_ss\r\n2018-03-06 17:13:20,419 [cuckoo.core.guest] INFO: Starting analysis on guest (id=Windows7_1, ip=192.168.56.2)\r\n2018-03-06 17:13:21,423 [cuckoo.core.guest] DEBUG: Windows7_1: not ready yet\r\n2018-03-06 17:13:22,428 [cuckoo.core.guest] DEBUG: Windows7_1: not ready yet\r\n2018-03-06 17:13:23,433 [cuckoo.core.guest] DEBUG: Windows7_1: not ready yet\r\n2018-03-06 17:13:24,438 [cuckoo.core.guest] DEBUG: Windows7_1: not ready yet\r\n2018-03-06 17:13:25,449 [cuckoo.core.guest] DEBUG: Windows7_1: not ready yet\r\n2018-03-06 17:13:26,456 [cuckoo.core.guest] DEBUG: Windows7_1: not ready yet\r\n2018-03-06 17:13:26,469 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.8 (id=Windows7_1, ip=192.168.56.2)\r\n2018-03-06 17:13:26,503 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=Windows7_1, ip=192.168.56.2, monitor=latest, size=3840773)\r\n2018-03-06 17:13:26,912 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:27,234 [cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized.\r\n2018-03-06 17:13:27,922 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:28,930 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:29,181 [cuckoo.core.resultserver] DEBUG: New process (pid=2064, ppid=2084, name=bot.exe)\r\n2018-03-06 17:13:29,896 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0001.jpg\r\n2018-03-06 17:13:29,906 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 53061\r\n2018-03-06 17:13:29,940 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:30,805 [cuckoo.core.resultserver] DEBUG: New process (pid=1664, ppid=2064, name=opag.exe)\r\n2018-03-06 17:13:30,968 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:31,024 [cuckoo.core.resultserver] DEBUG: New process (pid=1080, ppid=792, name=dwm.exe)\r\n2018-03-06 17:13:31,269 [cuckoo.core.resultserver] DEBUG: New process (pid=1108, ppid=1068, name=explorer.exe)\r\n2018-03-06 17:13:31,462 [cuckoo.core.resultserver] DEBUG: New process (pid=1176, ppid=448, name=taskhost.exe)\r\n2018-03-06 17:13:31,984 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:33,019 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:34,030 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:35,040 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:36,050 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:37,061 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:38,069 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:39,079 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:40,089 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:41,099 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:41,744 [cuckoo.core.resultserver] DEBUG: New process (pid=1400, ppid=1524, name=jusched.exe)\r\n2018-03-06 17:13:42,109 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:43,119 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:44,130 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:44,821 [cuckoo.core.resultserver] DEBUG: New process (pid=1500, ppid=1524, name=reader_sl.exe)\r\n2018-03-06 17:13:45,073 [cuckoo.core.resultserver] DEBUG: New process (pid=2092, ppid=1340, name=SearchProtocolHost.exe)\r\n2018-03-06 17:13:45,137 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:45,888 [cuckoo.core.resultserver] DEBUG: New process (pid=2584, ppid=2064, name=cmd.exe)\r\n2018-03-06 17:13:46,108 [cuckoo.core.resultserver] DEBUG: File upload request for files/23bac2f2dbe2b7a5_bot.exe\r\n2018-03-06 17:13:46,117 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 141312\r\n2018-03-06 17:13:46,292 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:50,958 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:53,559 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:13:56,244 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:02,254 [cuckoo.core.guest] INFO: Virtual Machine /status failed (ReadTimeout(ReadTimeoutError(\"HTTPConnectionPool(host='192.168.56.2', port=8000): Read timed out. (read timeout=5)\",),))\r\n2018-03-06 17:14:02,259 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:03,269 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:15,398 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:16,408 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:17,208 [cuckoo.core.resultserver] DEBUG: New process (pid=2880, ppid=356, name=conhost.exe)\r\n2018-03-06 17:14:17,418 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:32,588 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:36,638 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:37,647 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:38,393 [cuckoo.core.resultserver] DEBUG: File upload request for memory/2064-1.dmp\r\n2018-03-06 17:14:38,521 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 42240696\r\n2018-03-06 17:14:38,553 [cuckoo.core.resultserver] DEBUG: File upload request for files/b31bce0c315986fc_tmpabc66d98.bat\r\n2018-03-06 17:14:38,554 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 182\r\n2018-03-06 17:14:38,658 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:39,666 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:14:39,738 [cuckoo.core.resultserver] DEBUG: File upload request for memory/2584-1.dmp\r\n2018-03-06 17:14:39,950 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 50715464\r\n2018-03-06 17:14:40,675 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:15:40,374 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:15:41,386 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:15:41,817 [cuckoo.core.resultserver] DEBUG: File upload request for memory/1664-1.dmp\r\n2018-03-06 17:15:41,964 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 51838400\r\n2018-03-06 17:15:42,396 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:15:42,425 [cuckoo.core.resultserver] DEBUG: File upload request for memory/1080-1.dmp\r\n2018-03-06 17:15:42,488 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 34134976\r\n2018-03-06 17:15:43,407 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:15:44,418 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:15:45,428 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:15:45,624 [cuckoo.core.resultserver] DEBUG: File upload request for memory/1108-1.dmp\r\n2018-03-06 17:15:45,976 [cuckoo.core.resultserver] WARNING: Uploaded file length larger than upload_max_size, stopping upload.\r\n2018-03-06 17:15:45,977 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 134217743\r\n2018-03-06 17:15:46,424 [cuckoo.core.resultserver] DEBUG: File upload request for memory/1176-1.dmp\r\n2018-03-06 17:15:46,443 [cuckoo.core.guest] DEBUG: Windows7_1: analysis still processing\r\n2018-03-06 17:15:46,506 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 41056192\r\n2018-03-06 17:15:46,675 [cuckoo.core.resultserver] DEBUG: File upload request for memory/1400-1.dmp\r\n2018-03-06 17:15:46,819 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 46353032\r\n2018-03-06 17:15:46,999 [cuckoo.core.resultserver] DEBUG: File upload request for memory/1500-1.dmp\r\n2018-03-06 17:15:47,089 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 43708024\r\n2018-03-06 17:15:47,288 [cuckoo.core.resultserver] DEBUG: File upload request for memory/2092-1.dmp\r\n2018-03-06 17:15:47,377 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 46256720\r\n2018-03-06 17:15:47,388 [cuckoo.core.resultserver] DEBUG: File upload request for files/5697e87e93d2ecfc_opag.exe\r\n2018-03-06 17:15:47,394 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 141312\r\n2018-03-06 17:15:47,450 [cuckoo.core.guest] INFO: Windows7_1: analysis completed successfully\r\n2018-03-06 17:15:47,503 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer\r\n2018-03-06 17:15:52,624 [cuckoo.machinery.virtualbox] INFO: Successfully generated memory dump for virtual machine with label Windows7_1 to path /home/cs/.cuckoo/storage/analyses/1/memory.dmp\r\n2018-03-06 17:15:52,626 [cuckoo.machinery.virtualbox] DEBUG: Stopping vm Windows7_1\r\n2018-03-06 17:16:06,649 [cuckoo.core.scheduler] DEBUG: Released database task #1\r\n2018-03-06 17:16:06,750 [cuckoo.core.plugins] DEBUG: Executed processing module \"AnalysisInfo\" for task #1\r\n2018-03-06 17:16:16,726 [cuckoo.core.plugins] DEBUG: Executed processing module \"BehaviorAnalysis\" for task #1\r\n2018-03-06 17:16:16,727 [cuckoo.core.plugins] DEBUG: Executed processing module \"Droidmon\" for task #1\r\n2018-03-06 17:16:16,748 [cuckoo.core.plugins] DEBUG: Executed processing module \"Dropped\" for task #1\r\n2018-03-06 17:16:16,826 [cuckoo.core.plugins] DEBUG: Executed processing module \"DroppedBuffer\" for task #1\r\n2018-03-06 17:17:16,684 [cuckoo.processing.memory] ERROR: Error running Volatility on machine 'Windows7_1': An incorrect OS has been specified for this machine! Please provide the correct one or Cuckoo won't be able to provide Volatility-based results for analyses with this VM.\r\n2018-03-06 17:17:16,684 [cuckoo.core.plugins] DEBUG: Executed processing module \"Memory\" for task #1\r\n2018-03-06 17:17:23,474 [cuckoo.core.plugins] DEBUG: Executed processing module \"MetaInfo\" for task #1\r\n2018-03-06 17:17:28,375 [cuckoo.core.plugins] DEBUG: Executed processing module \"ProcessMemory\" for task #1\r\n2018-03-06 17:17:28,376 [cuckoo.core.plugins] DEBUG: Executed processing module \"Procmon\" for task #1\r\n2018-03-06 17:17:28,398 [cuckoo.core.plugins] DEBUG: Executed processing module \"Screenshots\" for task #1\r\n2018-03-06 17:17:28,735 [cuckoo.core.plugins] DEBUG: Executed processing module \"Static\" for task #1\r\n2018-03-06 17:17:28,747 [cuckoo.core.plugins] DEBUG: Executed processing module \"Strings\" for task #1\r\n2018-03-06 17:17:28,756 [cuckoo.core.plugins] DEBUG: Executed processing module \"TargetInfo\" for task #1\r\n2018-03-06 17:17:28,756 [cuckoo.processing.baseline] INFO: Could not find a baseline report for machine 'Windows7_1', skipping it.\r\n2018-03-06 17:17:28,756 [cuckoo.core.plugins] DEBUG: Executed processing module \"Baseline\" for task #1\r\n2018-03-06 17:17:28,823 [cuckoo.core.plugins] DEBUG: Executed processing module \"NetworkAnalysis\" for task #1\r\n2018-03-06 17:17:28,823 [cuckoo.core.plugins] DEBUG: Executed processing module \"Extracted\" for task #1\r\n2018-03-06 17:17:28,823 [cuckoo.core.plugins] DEBUG: Executed processing module \"TLSMasterSecrets\" for task #1\r\n2018-03-06 17:17:28,827 [cuckoo.core.plugins] DEBUG: Executed processing module \"Debug\" for task #1\r\n2018-03-06 17:17:28,830 [cuckoo.core.plugins] DEBUG: Running 473 signatures\r\n2018-03-06 17:17:44,531 [cuckoo.core.plugins] DEBUG: Analysis matched signature: dumped_buffer\r\n2018-03-06 17:17:44,532 [cuckoo.core.plugins] DEBUG: Analysis matched signature: dumped_buffer2\r\n2018-03-06 17:17:44,532 [cuckoo.core.plugins] DEBUG: Analysis matched signature: allocates_rwx\r\n2018-03-06 17:17:44,532 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antisandbox_foregroundwindows\r\n2018-03-06 17:17:44,532 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antisandbox_sleep\r\n2018-03-06 17:17:44,532 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_queries_computername\r\n2018-03-06 17:17:44,533 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_disk_size\r\n2018-03-06 17:17:44,533 [cuckoo.core.plugins] DEBUG: Analysis matched signature: persistence_autorun\r\n2018-03-06 17:17:44,533 [cuckoo.core.plugins] DEBUG: Analysis matched signature: suspicious_process\r\n2018-03-06 17:17:44,534 [cuckoo.core.plugins] DEBUG: Analysis matched signature: deletes_self\r\n2018-03-06 17:17:44,534 [cuckoo.core.plugins] DEBUG: Analysis matched signature: exploit_heapspray\r\n2018-03-06 17:17:44,534 [cuckoo.core.plugins] DEBUG: Analysis matched signature: recon_fingerprint\r\n2018-03-06 17:17:44,534 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_memory_available\r\n2018-03-06 17:17:44,535 [cuckoo.core.plugins] DEBUG: Analysis matched signature: antivm_network_adapters\r\n2018-03-06 17:17:44,535 [cuckoo.core.plugins] DEBUG: Analysis matched signature: packer_polymorphic\r\n2018-03-06 17:17:44,535 [cuckoo.core.plugins] DEBUG: Analysis matched signature: memdump_ip_urls\r\n2018-03-06 17:17:44,535 [cuckoo.core.plugins] DEBUG: Analysis matched signature: memdump_urls\r\n2018-03-06 17:17:44,536 [cuckoo.core.plugins] DEBUG: Analysis matched signature: self_delete_bat\r\n2018-03-06 17:17:44,536 [cuckoo.core.plugins] DEBUG: Analysis matched signature: banker_zeus_p2p\r\n2018-03-06 17:18:31,346 [cuckoo.core.plugins] DEBUG: Executed reporting module \"JsonDump\"\r\n2018-03-06 17:18:36,876 [cuckoo.core.plugins] DEBUG: Executed reporting module \"SingleFile\"\r\n2018-03-06 17:18:55,460 [cuckoo.core.plugins] DEBUG: Executed reporting module \"MongoDB\"\r\n2018-03-06 17:18:55,460 [cuckoo.core.scheduler] INFO: Task #1: reports generation completed\r\n2018-03-06 17:18:55,472 [cuckoo.core.scheduler] INFO: Task #1: analysis procedure completed\r\n`"},"comment":{"url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/comments/371235651","html_url":"https://github.com/cuckoosandbox/cuckoo/issues/2153#issuecomment-371235651","issue_url":"https://api.github.com/repos/cuckoosandbox/cuckoo/issues/2153","id":371235651,"user":{"login":"RicoVZ","id":8687431,"avatar_url":"https://avatars1.githubusercontent.com/u/8687431?v=4","gravatar_id":"","url":"https://api.github.com/users/RicoVZ","html_url":"https://github.com/RicoVZ","followers_url":"https://api.github.com/users/RicoVZ/followers","following_url":"https://api.github.com/users/RicoVZ/following{/other_user}","gists_url":"https://api.github.com/users/RicoVZ/gists{/gist_id}","starred_url":"https://api.github.com/users/RicoVZ/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/RicoVZ/subscriptions","organizations_url":"https://api.github.com/users/RicoVZ/orgs","repos_url":"https://api.github.com/users/RicoVZ/repos","events_url":"https://api.github.com/users/RicoVZ/events{/privacy}","received_events_url":"https://api.github.com/users/RicoVZ/received_events","type":"User","site_admin":false},"created_at":"2018-03-07T18:27:20Z","updated_at":"2018-03-07T18:27:20Z","author_association":"CONTRIBUTOR","body":"Hi w0r1dhe110,\r\n\r\nThanks for reporting this issue and the file.\r\nI have tried it and can indeed confirm this is missing. It appears that this is because the file type is `MS-DOS executable`. Before our web interface renders the static page, it starts by determining the type of file to render the static page for. This type is missing in there.\r\n\r\nI have created an issue for this to be added. Thanks for reporting it."}}
{"actor":{"display_login":"RicoVZ"}}