search

cuckoosandbox / cuckoo

Cuckoo Sandbox is an automated dynamic malware analysis system
http://www.cuckoosandbox.org
Other
5.55k stars 1.71k forks source link

inconstitency of url analysis #2397

Open Hemorragie opened 6 years ago

Hemorragie commented 6 years ago

Thanks for creating an issue! But first: did you read our community guidelines? https://cuckoo.sh/docs/introduction/community.html

My issue is:

Hi everyone, I have the following issue, when I run several times an analysis on some URL, it doesn't shows me the same output. Sometimes it can't reach the website and sometimes, it works perfectly. I tried to recreate the issue manually on the VM but it works everytime. I already checked the log files, but nothing special shows up. Have you ever experiment something like that ?

My Cuckoo version and operating system are:

Cuckoo 2.0.6, Ubuntu 16.04.4 LTS

notreached reached
doomedraven commented 6 years ago

without logs impossible

Hemorragie commented 6 years ago

Here they are, but nothing seems to happened.

Analyzer Log

2018-07-26 10:27:22,000 [analyzer] DEBUG: Starting analyzer from: C:\tmpf8hjn4 2018-07-26 10:27:22,000 [analyzer] DEBUG: Pipe server name: \??\PIPE\LfguOzGBLTnSObUsGNGZqqbNaa 2018-07-26 10:27:22,015 [analyzer] DEBUG: Log pipe server name: \??\PIPE\PPPbYKtJpxSoDqVCj 2018-07-26 10:27:22,015 [analyzer] DEBUG: No analysis package specified, trying to detect it automagically. 2018-07-26 10:27:22,015 [analyzer] INFO: Automatically selected analysis package "ie" 2018-07-26 10:27:22,140 [analyzer] DEBUG: Started auxiliary module DbgView 2018-07-26 10:27:22,562 [analyzer] DEBUG: Started auxiliary module Disguise 2018-07-26 10:27:22,733 [analyzer] DEBUG: Loaded monitor into process with pid 484 2018-07-26 10:27:22,750 [analyzer] DEBUG: Started auxiliary module DumpTLSMasterSecrets

2018-07-26 10:27:22,750 [analyzer] DEBUG: Started auxiliary module Human 2018-07-26 10:27:22,750 [analyzer] DEBUG: Started auxiliary module InstallCertificate 2018-07-26 10:27:22,750 [analyzer] DEBUG: Started auxiliary module Reboot 2018-07-26 10:27:22,796 [analyzer] DEBUG: Started auxiliary module RecentFiles 2018-07-26 10:27:22,796 [analyzer] DEBUG: Started auxiliary module Screenshots 2018-07-26 10:27:22,796 [analyzer] DEBUG: Started auxiliary module LoadZer0m0n 2018-07-26 10:27:22,842 [lib.api.process] INFO: Successfully executed process from path 'C:\Program Files\Internet Explorer\iexplore.exe' with arguments ['qwertee.com'] and pid 2072 2018-07-26 10:29:22,046 [analyzer] INFO: Analysis timeout hit, terminating analysis. 2018-07-26 10:29:22,046 [analyzer] INFO: Analysis completed.

Cuckoo log

2018-07-26 10:31:38,134 [cuckoo.core.scheduler] INFO: Task #35: acquired machine win7-64bit-sandbox-02 (label=win7-64bit-sandbox-02) 2018-07-26 10:31:38,150 [cuckoo.auxiliary.sniffer] INFO: Started sniffer with PID 1383 (interface=virbr1, host=192.168.124.99) 2018-07-26 10:31:38,150 [cuckoo.core.plugins] DEBUG: Started auxiliary module: Sniffer 2018-07-26 10:31:38,165 [cuckoo.common.abstracts] DEBUG: Starting machine win7-64bit-sandbox-02 2018-07-26 10:31:38,166 [cuckoo.common.abstracts] DEBUG: Getting status for win7-64bit-sandbox-02 2018-07-26 10:31:38,180 [cuckoo.common.abstracts] DEBUG: Using snapshot cuckoo_windows7_64bits for virtual machine win7-64bit-sandbox-02 2018-07-26 10:31:42,010 [cuckoo.common.abstracts] DEBUG: Getting status for win7-64bit-sandbox-02 2018-07-26 10:31:42,033 [cuckoo.core.guest] INFO: Starting analysis on guest (id=win7-64bit-sandbox-02, ip=192.168.124.99) 2018-07-26 10:31:43,043 [cuckoo.core.guest] INFO: Guest is running Cuckoo Agent 0.8 (id=win7-64bit-sandbox-02, ip=192.168.124.99) 2018-07-26 10:31:43,067 [cuckoo.core.guest] DEBUG: Uploading analyzer to guest (id=win7-64bit-sandbox-02, ip=192.168.124.99, monitor=latest, size=3852348) 2018-07-26 10:31:43,395 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:43,564 [cuckoo.core.resultserver] DEBUG: LogHandler for live analysis.log initialized. 2018-07-26 10:31:44,403 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:45,412 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:45,500 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0001.jpg 2018-07-26 10:31:45,545 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 56585 2018-07-26 10:31:46,422 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:47,432 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:48,442 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:49,453 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:50,466 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:51,478 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:52,490 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:53,500 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:54,514 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:55,526 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:56,541 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:57,551 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:58,567 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:31:59,579 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:00,590 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:01,600 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:02,612 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:02,615 [cuckoo.core.resultserver] DEBUG: File upload request for shots/0002.jpg 2018-07-26 10:32:02,658 [cuckoo.core.resultserver] DEBUG: Uploaded file length: 79763 2018-07-26 10:32:03,623 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:04,637 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:05,665 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:06,681 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:07,697 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:08,707 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:09,719 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:10,729 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:11,741 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:12,751 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:13,762 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:14,773 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:15,785 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:16,795 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:17,805 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:18,817 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:19,827 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:20,839 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:21,852 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:22,862 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:23,872 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:24,882 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:25,892 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:26,903 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:27,914 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:28,929 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:29,941 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:30,952 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:31,964 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:32,975 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:33,984 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:34,995 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:36,003 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:37,015 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:38,025 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:39,033 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:40,050 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:41,069 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:42,082 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:43,091 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:44,104 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:45,114 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:46,123 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:47,136 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:48,146 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:49,154 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:50,165 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:51,183 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:52,194 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:53,209 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:54,220 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:55,235 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:56,246 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:57,261 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:58,269 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:32:59,282 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:00,290 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:01,307 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:02,318 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:03,331 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:04,341 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:05,359 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:06,370 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:07,380 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:08,392 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:09,404 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:10,415 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:11,426 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:12,436 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:13,452 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:14,463 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:15,478 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:16,489 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:17,504 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:18,520 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:19,537 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:20,545 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:21,556 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:22,567 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:23,579 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:24,591 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:25,604 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:26,615 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:27,627 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:28,638 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:29,648 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:30,658 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:31,672 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:32,684 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:33,700 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:34,710 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:35,723 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:36,733 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:37,746 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:38,757 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:39,773 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:40,782 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:41,794 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:42,825 [cuckoo.core.guest] DEBUG: win7-64bit-sandbox-02: analysis still processing 2018-07-26 10:33:43,840 [cuckoo.core.guest] INFO: win7-64bit-sandbox-02: analysis completed successfully 2018-07-26 10:33:43,878 [cuckoo.core.plugins] DEBUG: Stopped auxiliary module: Sniffer 2018-07-26 10:33:43,880 [cuckoo.common.abstracts] DEBUG: Stopping machine win7-64bit-sandbox-02 2018-07-26 10:33:43,880 [cuckoo.common.abstracts] DEBUG: Getting status for win7-64bit-sandbox-02 2018-07-26 10:33:44,770 [cuckoo.common.abstracts] DEBUG: Getting status for win7-64bit-sandbox-02 2018-07-26 10:33:46,417 [cuckoo.core.scheduler] DEBUG: Released database task #35 2018-07-26 10:33:46,435 [cuckoo.core.scheduler] INFO: Task #35: analysis procedure completed

doomedraven commented 6 years ago

what about rooter?

Hemorragie commented 6 years ago

I tried it, but apparently it does not change anything. I'm wondering if it could not be the fault of IE, i will try to launch the same analysis with Firefox if I can.