e[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e.zip
Size

244.4MB
MD5

36c08607e21db5a4238bac85305590d4
SHA1

55d4245fe9df37bd97b43980aae978ade4635cd9
SHA256

b561f38f4695d8445ecdcba2f1f290c73d90a6f8b48f2d4f319ab1d99a3d58c4
SHA512

224b0c3fd6fcaebe43101fc10ca3441d3239e6cedb015b014b10abb9e832cb9f405a1466bc5ae744ac44d2ba220bb8bc46730ba6ec2499cbe3de91fde90c1fc3
SSDEEP

6291456:aluk2gS5l2sMQhkDK/m0fsrrEEoS+6Hk3yTvmcdTG8gVSm:akxgS5laQ2p0E6SbTvmcVG8Nm

Score

1^/10

Malware Config

Signatures

Files

e.zip
.zip
JDownloader2Setup_windows-x64_jre17.exe
.exe windows x64

af821d56143037e8d6398d9923b87d41

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:98:95:82:3c:34:08:0d:c0:7d:c7:d4
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

21/04/2021, 13:58

Not After

13/10/2023, 13:49

Subject

SERIALNUMBER=HRB 11927,CN=Appwork GmbH,O=Appwork GmbH,STREET=Schwabacher Str. 117,L=Fuerth,ST=Bavaria,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1306467565727468,1.3.6.1.4.1.311.60.2.1.2=#130742617661726961,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

28/07/2020, 00:00

Not After

18/03/2029, 00:00

Subject

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

35:98:95:82:3c:34:08:0d:c0:7d:c7:d4
Certificate

Issuer

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Not Before

21/04/2021, 13:58

Not After

13/10/2023, 13:49

Subject

SERIALNUMBER=HRB 11927,CN=Appwork GmbH,O=Appwork GmbH,STREET=Schwabacher Str. 117,L=Fuerth,ST=Bavaria,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1306467565727468,1.3.6.1.4.1.311.60.2.1.2=#130742617661726961,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

Issuer

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

Not Before

28/07/2020, 00:00

Not After

28/07/2030, 00:00

Subject

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

Issuer

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Not Before

27/05/2021, 09:55

Not After

28/06/2032, 09:55

Subject

CN=Globalsign TSA for Advanced - G4,O=GlobalSign nv-sa,C=BE

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Not Before

20/06/2018, 00:00

Not After

10/12/2034, 00:00

Subject

CN=GlobalSign Timestamping CA - SHA384 - G4,O=GlobalSign nv-sa,C=BE

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

20/02/2019, 00:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R6,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

04:00:00:00:00:01:21:58:53:08:a2
Certificate

Issuer

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Not Before

18/03/2009, 10:00

Not After

18/03/2029, 10:00

Subject

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

53:50:0d:96:bb:1a:f0:b8:b1:d0:d8:42:8e:a2:13:86:9e:81:d8:49:6e:62:c7:a1:97:73:f6:c8:47:14:d9:d7
Signer

Actual PE Digest

53:50:0d:96:bb:1a:f0:b8:b1:d0:d8:42:8e:a2:13:86:9e:81:d8:49:6e:62:c7:a1:97:73:f6:c8:47:14:d9:d7

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=HRB 11927,CN=Appwork GmbH,O=Appwork GmbH,STREET=Schwabacher Str. 117,L=Fuerth,ST=Bavaria,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1306467565727468,1.3.6.1.4.1.311.60.2.1.2=#130742617661726961,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

22/03/2022, 16:47
Valid: true

Chain 1

SERIALNUMBER=HRB 11927,CN=Appwork GmbH,O=Appwork GmbH,STREET=Schwabacher Str. 117,L=Fuerth,ST=Bavaria,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1306467565727468,1.3.6.1.4.1.311.60.2.1.2=#130742617661726961,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

22:6e:a8:54:4c:dc:f1:00:d6:58:b6:73:4f:fd:f4:dc:30:ab:11:53
Signer

Actual PE Digest

22:6e:a8:54:4c:dc:f1:00:d6:58:b6:73:4f:fd:f4:dc:30:ab:11:53

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=HRB 11927,CN=Appwork GmbH,O=Appwork GmbH,STREET=Schwabacher Str. 117,L=Fuerth,ST=Bavaria,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1306467565727468,1.3.6.1.4.1.311.60.2.1.2=#130742617661726961,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

22/03/2022, 16:47
Valid: true

Chain 1

SERIALNUMBER=HRB 11927,CN=Appwork GmbH,O=Appwork GmbH,STREET=Schwabacher Str. 117,L=Fuerth,ST=Bavaria,C=DE,1.3.6.1.4.1.311.60.2.1.1=#1306467565727468,1.3.6.1.4.1.311.60.2.1.2=#130742617661726961,1.3.6.1.4.1.311.60.2.1.3=#13024445,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e

CN=GlobalSign GCC R45 EV CodeSigning CA 2020,O=GlobalSign nv-sa,C=BE

CN=GlobalSign Code Signing Root R45,O=GlobalSign nv-sa,C=BE

CN=GlobalSign,OU=GlobalSign Root CA - R3,O=GlobalSign

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

SetWindowPos
OffsetRect
CopyRect
GetWindowRect
GetDesktopWindow
GetParent
MonitorFromPoint
FindWindowA
GetWindowThreadProcessId
LookupIconIdFromDirectoryEx
CreateIconFromResourceEx
DestroyIcon
FlashWindow
MonitorFromWindow
GetMonitorInfoA
GetSystemMenu
GetWindowLongA
IsZoomed
SetMenuDefaultItem
TrackPopupMenu
PostMessageA
CallWindowProcA
SetWindowLongPtrA
SetMenuItemInfoA
SendMessageA
GetClientRect
FillRect
LoadIconW
RegisterClipboardFormatW
FindWindowW
GetWindowLongPtrW
GetClassNameW
GetWindow
GetWindowTextW
SendMessageTimeoutW
GetWindowPlacement
PostMessageW
wsprintfW
MessageBoxA
DialogBoxParamA
EndDialog
SetWindowTextW
SetDlgItemTextW
GetDlgItem
DefDlgProcW
LoadIconA
LoadCursorA
RegisterClassW
SendDlgItemMessageW
SendDlgItemMessageA
ExitWindowsEx
EnumWindows
IsIconic
ShowWindow
SetForegroundWindow
GetLastActivePopup
IsWindowVisible
MessageBoxW

advapi32

RegEnumValueW
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegRestoreKeyW
RegSaveKeyW
RegCreateKeyExW
LookupAccountSidW
ChangeServiceConfigW
ChangeServiceConfig2W
CreateServiceW
DeleteService
StartServiceW
ControlService
QueryServiceConfigW
OpenSCManagerW
OpenServiceW
QueryServiceStatus
CloseServiceHandle
LookupPrivilegeValueW
RegOpenKeyExW
RegQueryValueExW
LookupAccountNameW
AllocateAndInitializeSid
FreeSid
GetNamedSecurityInfoW
SetEntriesInAclW
SetNamedSecurityInfoW
RegDeleteValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegEnumKeyExA
RegOpenKeyExA
RegQueryValueExA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
RegGetValueA

ole32

CreateStreamOnHGlobal
CoCreateInstance
CoInitializeEx
GetHGlobalFromStream
CoInitialize
CoTaskMemFree
ReleaseStgMedium
CoUninitialize

oleaut32

SafeArrayAccessData
SafeArrayUnaccessData

kernel32

GetCommandLineA
HeapReAlloc
DebugBreak
HeapFree
HeapAlloc
RtlUnwindEx
RtlPcToFileHeader
RaiseException
GetStartupInfoA
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
DeleteCriticalSection
MoveFileExW
RemoveDirectoryW
LCMapStringA
LCMapStringW
GetCPInfo
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
GetCurrentThreadId
FlsAlloc
HeapSize
GetConsoleCP
GetConsoleMode
SetHandleCount
GetACP
GetOEMCP
IsValidCodePage
HeapSetInformation
HeapCreate
GetTimeZoneInformation
GetDriveTypeA
InitializeCriticalSectionAndSpinCount
SetStdHandle
SetEndOfFile
GetProcessHeap
QueryPerformanceCounter
GetLocaleInfoA
GetStringTypeA
GetStringTypeW
EnumSystemLocalesA
IsValidLocale
WriteConsoleA
CompareStringA
CompareStringW
RtlCaptureContext
CreatePipe
CreateSemaphoreW
GetTempFileNameW
CreateDirectoryW
SetLastError
FormatMessageW
GetCurrentThread
GlobalFree
DisconnectNamedPipe
WaitNamedPipeW
ConnectNamedPipe
CreateNamedPipeW
GetConsoleTitleW
GetLastError
CreateFileW
SetFilePointer
WriteFile
ReadFile
GetProcAddress
LoadLibraryA
GetUserDefaultLCID
CloseHandle
CreateFileA
CreateDirectoryA
FlushFileBuffers
WriteConsoleW
GetFileType
GetStdHandle
GetLongPathNameW
ExitProcess
RemoveDirectoryA
FindClose
FindNextFileA
DeleteFileA
FindFirstFileA
MultiByteToWideChar
AreFileApisANSI
FindFirstFileW
TerminateProcess
GetExitCodeProcess
CreateProcessW
GetWindowsDirectoryW
SetHandleInformation
GetLocaleInfoW
GetShortPathNameA
GetModuleFileNameA
GetShortPathNameW
GetModuleFileNameW
GetCurrentProcessId
GetLongPathNameA
FoldStringW
GetWindowsDirectoryA
GetEnvironmentVariableW
GetEnvironmentVariableA
GetTempPathW
GetTempPathA
GetTempFileNameA
GetFullPathNameW
GetFullPathNameA
GetModuleHandleA
FreeEnvironmentStringsW
GetEnvironmentStringsW
FreeEnvironmentStringsA
GetEnvironmentStrings
GetExitCodeThread
WaitForSingleObject
CreateThread
GetConsoleOutputCP
SetEnvironmentVariableA
SetCurrentDirectoryA
GetCurrentDirectoryA
GetVersionExA
CreateProcessA
SearchPathA
GetSystemTimeAsFileTime
DeleteFileW
EnterCriticalSection
InitializeCriticalSection
LeaveCriticalSection
Sleep
GetMailslotInfo
CreateMailslotA
GetCommandLineW
CreateSemaphoreA
SizeofResource
LockResource
LoadResource
FindResourceA
GlobalUnlock
GlobalSize
GlobalLock
SetConsoleTitleA
GetTickCount
GetConsoleTitleA
AllocConsole
GetCurrentProcess
LoadLibraryExA
SetEnvironmentVariableW
SetCurrentDirectoryW
SetThreadPriority
WideCharToMultiByte
LocalFree
LocalAlloc
GetModuleHandleW
LoadLibraryExW
LoadLibraryW
GetSystemDirectoryW
GetDriveTypeW
WaitForMultipleObjects
OpenProcess
GetProcessId
GlobalMemoryStatus
FreeLibrary
GetDiskFreeSpaceExW
GetModuleHandleExW
SetConsoleTitleW

Exports

Exports

Java_com_install4j_runtime_flatlaf_FlatWindowsNativeWindowBorder_00024WndProc_installImpl
Java_com_install4j_runtime_flatlaf_FlatWindowsNativeWindowBorder_00024WndProc_setWindowBackground
Java_com_install4j_runtime_flatlaf_FlatWindowsNativeWindowBorder_00024WndProc_showWindow
Java_com_install4j_runtime_flatlaf_FlatWindowsNativeWindowBorder_00024WndProc_uninstallImpl
Java_com_install4j_runtime_flatlaf_FlatWindowsNativeWindowBorder_00024WndProc_updateFrame
Java_com_install4j_runtime_flatlaf_FlatWindowsNativeWindowBorder_registryGetIntValue
Java_com_install4j_runtime_installer_platform_win32_ACLHandling_addACE
Java_com_install4j_runtime_installer_platform_win32_FileVersion_compare0
Java_com_install4j_runtime_installer_platform_win32_FolderInfo_getDriveType0
Java_com_install4j_runtime_installer_platform_win32_FolderInfo_getPathFromRegistry0
Java_com_install4j_runtime_installer_platform_win32_FolderInfo_getShortPathName0
Java_com_install4j_runtime_installer_platform_win32_FolderInfo_getSpecialFolder0
Java_com_install4j_runtime_installer_platform_win32_FolderInfo_getSystemDirectory0
Java_com_install4j_runtime_installer_platform_win32_FolderInfo_getUniversalPathName0
Java_com_install4j_runtime_installer_platform_win32_FolderInfo_getWindowsDirectory0
Java_com_install4j_runtime_installer_platform_win32_Misc_broadcastSettingChange0
Java_com_install4j_runtime_installer_platform_win32_Misc_getEnvVarPairs0
Java_com_install4j_runtime_installer_platform_win32_Misc_getFreeDiskSpace0
Java_com_install4j_runtime_installer_platform_win32_Misc_getPhysicalMemory0
Java_com_install4j_runtime_installer_platform_win32_Misc_getPidFromHandle0
Java_com_install4j_runtime_installer_platform_win32_Misc_getRunningModules0
Java_com_install4j_runtime_installer_platform_win32_Misc_getTopLevelWindows0
Java_com_install4j_runtime_installer_platform_win32_Misc_getWindowTitle0
Java_com_install4j_runtime_installer_platform_win32_Misc_moveWithDelayUntilReboot0
Java_com_install4j_runtime_installer_platform_win32_Misc_reboot0
Java_com_install4j_runtime_installer_platform_win32_Misc_registerExtensionFunctions0
Java_com_install4j_runtime_installer_platform_win32_Misc_setForegroundWindow0
Java_com_install4j_runtime_installer_platform_win32_Misc_terminateProcesses0
Java_com_install4j_runtime_installer_platform_win32_Misc_toFront0
Java_com_install4j_runtime_installer_platform_win32_ObjectPicker_show0
Java_com_install4j_runtime_installer_platform_win32_Registry_changeNotifyAssociations0
Java_com_install4j_runtime_installer_platform_win32_Registry_createKey0
Java_com_install4j_runtime_installer_platform_win32_Registry_deleteKey0
Java_com_install4j_runtime_installer_platform_win32_Registry_deleteValue0
Java_com_install4j_runtime_installer_platform_win32_Registry_enumSubKeys0
Java_com_install4j_runtime_installer_platform_win32_Registry_enumValues0
Java_com_install4j_runtime_installer_platform_win32_Registry_getValue0
Java_com_install4j_runtime_installer_platform_win32_Registry_keyExists0
Java_com_install4j_runtime_installer_platform_win32_Registry_restoreKey0
Java_com_install4j_runtime_installer_platform_win32_Registry_saveKey0
Java_com_install4j_runtime_installer_platform_win32_Registry_setValue0
Java_com_install4j_runtime_installer_platform_win32_ShellLink_changeNotify0
Java_com_install4j_runtime_installer_platform_win32_ShellLink_create0
Java_com_install4j_runtime_installer_platform_win32_ShellLink_createWide0
Java_com_install4j_runtime_installer_platform_win32_ShellLink_initialize0
Java_com_install4j_runtime_installer_platform_win32_ShellLink_uninitialize
Java_com_install4j_runtime_installer_platform_win32_VistaFileChooser_displayDialog0
Java_com_install4j_runtime_installer_platform_win32_VistaFileChooser_initialize0
Java_com_install4j_runtime_installer_platform_win32_VistaTaskDialog_init0
Java_com_install4j_runtime_installer_platform_win32_VistaTaskDialog_show0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_closeHandle0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_connectClient0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_connectNamedPipe0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_createListener0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_disconnectNamedPipe0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_getCurrentProcessId0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_getInvalidHandle0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_isProcessAlive0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_readDataBlock0
Java_com_install4j_runtime_installer_platform_win32_Win32CommunicationBackend_writeDataBlock0
Java_com_install4j_runtime_installer_platform_win32_Win32Exec_launch0
Java_com_install4j_runtime_installer_platform_win32_Win32Handle_close0
Java_com_install4j_runtime_installer_platform_win32_Win32Handle_getDeviceName0
Java_com_install4j_runtime_installer_platform_win32_Win32Handle_list0
Java_com_install4j_runtime_installer_platform_win32_Win32Proxy_getAutoProxyConfig0
Java_com_install4j_runtime_installer_platform_win32_Win32Proxy_getDefaultConfig0
Java_com_install4j_runtime_installer_platform_win32_Win32Proxy_getIEConfig0
Java_com_install4j_runtime_installer_platform_win32_Win32Proxy_loadFunctions0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_changeServiceConfig0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_getServiceBinary0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_getStartType0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_installService0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_queryStatus0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_setDelayedAutoStart0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_setRestartServiceConfig0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_startService0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_stopService0
Java_com_install4j_runtime_installer_platform_win32_Win32Services_uninstallService0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_addUser0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_deleteLocalGroup0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_deleteUser0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_executeElevated0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_getAccountName0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_getElevationType0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_getUserProfileDirectory0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_getUserSid0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_isMemberOfGroup0
Java_com_install4j_runtime_installer_platform_win32_Win32UserInfo_setLsaAccountRight0
Java_com_install4j_runtime_installer_platform_win32_WinGuiHelper_createHIcon0
Java_com_install4j_runtime_installer_platform_win32_WinGuiHelper_destroyHIcon0
Java_com_install4j_runtime_installer_platform_win32_WinGuiHelper_flashWindow0
Java_com_install4j_runtime_installer_platform_win32_WinGuiHelper_getHwnd0
Java_com_install4j_runtime_installer_platform_win32_WinGuiHelper_getPeer0
Java_com_install4j_runtime_installer_platform_win32_WinTaskBar_initTaskBar0
Java_com_install4j_runtime_installer_platform_win32_WinTaskBar_setOverlayIcon0
Java_com_install4j_runtime_installer_platform_win32_WinTaskBar_setProgress0
Java_com_install4j_runtime_installer_platform_win32_WinTaskBar_setState0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_clearError0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_connect0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_destroy0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_getErrorCode0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_getErrorLocation0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_getErrorMessage0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_getHeaders0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_init0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_internetErrorDlg0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_openRequest0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_read0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_sendRequest0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_setDwordOption0
Java_com_install4j_runtime_installer_platform_win32_wininet_WinInet_setOption0
registerNatives
registerNativesFlatlaf

Sections

.text
Size: 327KB - Virtual size: 327KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 148KB - Virtual size: 147KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
jdk-17.0.7_windows-x64_bin.exe
.exe windows x64

98b02fba2266899fcd949b38e1145b2f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

06:8b:e2:f5:34:52:c8:82:f1:8e:d4:1a:5d:d4:e7:a3
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

19/08/2021, 00:00

Not After

19/08/2023, 23:59

Subject

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c7:af:8f:e6:46:5e:42:1c:7a:06:76:f7:f7:f0:a0:ea:99:72:5a:fc:fd:44:e2:bf:46:23:29:b2:d4:14:a3:41
Signer

Actual PE Digest

c7:af:8f:e6:46:5e:42:1c:7a:06:76:f7:f7:f0:a0:ea:99:72:5a:fc:fd:44:e2:bf:46:23:29:b2:d4:14:a3:41

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

01/03/2023, 00:06
Valid: true

Chain 1

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Chain 2

CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

EqualSid
RegCloseKey
GetTokenInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
CopySid
OpenProcessToken
ConvertStringSidToSidW

kernel32

HeapReAlloc
GetTimeZoneInformation
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
HeapSize
CreateDirectoryW
GetModuleHandleExW
WaitForSingleObject
GetLastError
GetProcAddress
CreateProcessW
SetDllDirectoryW
GetExitCodeProcess
CloseHandle
SizeofResource
LockResource
LoadResource
FindResourceW
MultiByteToWideChar
WideCharToMultiByte
FindFirstFileW
SetLastError
FindNextFileW
RemoveDirectoryW
InitializeCriticalSectionAndSpinCount
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
DeleteFileW
RaiseException
DecodePointer
MoveFileExW
DeleteCriticalSection
CopyFileW
GetTickCount
GetDriveTypeW
LoadLibraryW
FreeLibrary
GetCurrentProcess
GetModuleFileNameW
GetTempPathW
GetSystemDirectoryW
GetNativeSystemInfo
GetCurrentThreadId
Sleep
FormatMessageW
GetLocalTime
LocalFree
GetCurrentProcessId
GetLocaleInfoW
QueryPerformanceCounter
RtlUnwind
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
EncodePointer
LCMapStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
OutputDebugStringW
GetCurrentDirectoryW
SetStdHandle
ReadConsoleW
ReadFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
LCMapStringW
CompareStringW
RtlUnwindEx
RtlPcToFileHeader
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
GetCommandLineA
GetCommandLineW
SetEndOfFile
WriteFile
GetConsoleOutputCP
GetConsoleMode
GetFileType
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
GetStdHandle
WriteConsoleW
ExitProcess
HeapFree
HeapAlloc
GetFileSizeEx
SetFilePointerEx
FlushFileBuffers

Sections

.text
Size: 260KB - Virtual size: 260KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 99KB - Virtual size: 98KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 152.9MB - Virtual size: 152.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af821d56143037e8d6398d9923b87d41

Code Sign

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

35:98:95:82:3c:34:08:0d:c0:7d:c7:d4Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54Certificate

Extended Key Usages

Key Usages

35:98:95:82:3c:34:08:0d:c0:7d:c7:d4Certificate

Extended Key Usages

Key Usages

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:edCertificate

Extended Key Usages

Key Usages

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9fCertificate

Extended Key Usages

Key Usages

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74Certificate

Key Usages

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fcCertificate

Key Usages

04:00:00:00:00:01:21:58:53:08:a2Certificate

Key Usages

53:50:0d:96:bb:1a:f0:b8:b1:d0:d8:42:8e:a2:13:86:9e:81:d8:49:6e:62:c7:a1:97:73:f6:c8:47:14:d9:d7Signer

Signature Validations

Verification

22/03/2022, 16:47 Valid: true

Chain 1

22:6e:a8:54:4c:dc:f1:00:d6:58:b6:73:4f:fd:f4:dc:30:ab:11:53Signer

Signature Validations

Verification

22/03/2022, 16:47 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

user32

advapi32

ole32

oleaut32

kernel32

Exports

Exports

Sections

.text Size: 327KB - Virtual size: 327KB

.rdata Size: 148KB - Virtual size: 147KB

.data Size: 10KB - Virtual size: 80KB

.pdata Size: 14KB - Virtual size: 14KB

.rsrc Size: 188KB - Virtual size: 188KB

.reloc Size: 3KB - Virtual size: 2KB

98b02fba2266899fcd949b38e1145b2f

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

06:8b:e2:f5:34:52:c8:82:f1:8e:d4:1a:5d:d4:e7:a3Certificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

35:98:95:82:3c:34:08:0d:c0:7d:c7:d4
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

78:03:18:42:45:70:8a:41:cf:6f:01:b8:ee:b4:a9:54
Certificate

35:98:95:82:3c:34:08:0d:c0:7d:c7:d4
Certificate

77:bd:0e:05:b7:59:0b:b6:1d:47:61:53:1e:3f:75:ed
Certificate

01:00:46:69:50:a6:04:a9:d9:70:e8:1d:d2:4d:41:9f
Certificate

01:ec:1c:92:40:de:fd:2e:40:5d:7c:47:74
Certificate

01:f2:40:42:40:ce:fd:22:db:e9:6c:71:fc
Certificate

04:00:00:00:00:01:21:58:53:08:a2
Certificate

53:50:0d:96:bb:1a:f0:b8:b1:d0:d8:42:8e:a2:13:86:9e:81:d8:49:6e:62:c7:a1:97:73:f6:c8:47:14:d9:d7
Signer

22/03/2022, 16:47
Valid: true

22:6e:a8:54:4c:dc:f1:00:d6:58:b6:73:4f:fd:f4:dc:30:ab:11:53
Signer

22/03/2022, 16:47
Valid: true

.text
Size: 327KB - Virtual size: 327KB

.rdata
Size: 148KB - Virtual size: 147KB

.data
Size: 10KB - Virtual size: 80KB

.pdata
Size: 14KB - Virtual size: 14KB

.rsrc
Size: 188KB - Virtual size: 188KB

.reloc
Size: 3KB - Virtual size: 2KB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

06:8b:e2:f5:34:52:c8:82:f1:8e:d4:1a:5d:d4:e7:a3
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

c7:af:8f:e6:46:5e:42:1c:7a:06:76:f7:f7:f0:a0:ea:99:72:5a:fc:fd:44:e2:bf:46:23:29:b2:d4:14:a3:41
Signer

01/03/2023, 00:06
Valid: true

.text
Size: 260KB - Virtual size: 260KB

.rdata
Size: 99KB - Virtual size: 98KB

.data
Size: 7KB - Virtual size: 13KB

.pdata
Size: 13KB - Virtual size: 13KB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 152.9MB - Virtual size: 152.9MB

.reloc
Size: 3KB - Virtual size: 2KB