javacpl[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

javacpl.exe
Size

85KB
MD5

72399db316da9f06cec9a313e23ce485
SHA1

c6985592a6c803b2eb39ddb3a86d39d0fbbc7137
SHA256

d510c5a1e56522d3afed7e069bde4ad480061b45374b54c51144f40cc8aec237
SHA512

02481176fa2293357160f2ecc14eb588ffa7ca048c874b1c9be4b2ebeb41750225520f3b4698b422f2d18d9c956f21729282145be6dc9be0fd3cda8a49dab1b1
SSDEEP

1536:xvK5vtNC9wvfSPKJr3eN8m18yTOqST7qjh3rmKPN3nGTr3her:BK5vnY4Nm18yTOqSqjZqMN3nGTor

Score

1^/10

Malware Config

Signatures

Files

javacpl.exe
.exe windows x64

e748b2ea5edacc281942683e01c23d1c

Code Sign

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Certificate

Issuer

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

14/04/2015, 00:00

Not After

13/04/2018, 23:59

Subject

CN=Oracle America\, Inc.,OU=Code Signing Bureau,O=Oracle America\, Inc.,L=Redwood Shores,ST=California,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

Issuer

CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

10/12/2013, 00:00

Not After

09/12/2023, 23:59

Subject

CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageClientAuth
ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

Issuer

CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US

Not Before

12/01/2016, 00:00

Not After

11/01/2031, 23:59

Subject

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

Issuer

CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Not Before

23/12/2017, 00:00

Not After

22/03/2029, 23:59

Subject

CN=Symantec SHA256 TimeStamping Signer - G3,OU=Symantec Trust Network,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

45:3c:ff:0c:16:ac:12:ef:eb:23:27:32:50:e7:01:c4:e5:47:ad:ad
Signer

Actual PE Digest

45:3c:ff:0c:16:ac:12:ef:eb:23:27:32:50:e7:01:c4:e5:47:ad:ad

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

wsprintfA
OpenInputDesktop
CloseDesktop
GetShellWindow
GetWindowThreadProcessId

deploy

?SetMainModule@LauncherArgs@@QEAAXPEBD@Z
?AddMainArg@LauncherArgs@@QEAAXPEBD@Z
?AddJVMArg@LauncherArgs@@QEAAXPEBD@Z
?SetJREPath@LauncherArgs@@QEAAXPEBD@Z
??1LauncherArgs@@QEAA@XZ
??0LauncherArgs@@QEAA@XZ
?SetAddDeployModuleArgs@LauncherArgs@@QEAAX_N@Z
?jliclient_main@@YAHAEAVLauncherArgs@@@Z
?SetMainClass@LauncherArgs@@QEAAXPEBD@Z

msvcp120

?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAPEBDH@Z
?_Xlength_error@std@@YAXPEBD@Z

msvcr120

_lock
_unlock
_calloc_crt
__dllonexit
__C_specific_handler
_stat64i32
?terminate@@YAXXZ
__crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
__crtCaptureCurrentContext
__crtCapturePreviousContext
_XcptFilter
__crtGetShowWindowMode
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_wstat64i32
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
_ftime64_s
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
__crtSetUnhandledExceptionFilter
sprintf_s
fprintf_s
fopen_s
fclose
strncpy_s
_stricmp
strcat_s
strcpy_s
memcpy_s
_splitpath_s
_putenv
_dupenv_s
atoi
memset
memcpy
__CxxFrameHandler3
_CxxThrowException
free
calloc
??_V@YAXPEAX@Z
strrchr
memmove
??3@YAXPEAX@Z
??2@YAPEAX_K@Z
_purecall
_localtime64_s
strftime
_vsnprintf_s
_snprintf_s
strcmp
malloc
_onexit
_configthreadlocale

kernel32

OutputDebugStringW
GetSystemTimeAsFileTime
QueryPerformanceCounter
LoadLibraryExA
MultiByteToWideChar
GetTempPathA
LoadLibraryA
lstrlenA
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
GetCurrentThreadId
GetCurrentProcessId
FormatMessageA
GetShortPathNameA
LocalAlloc
GlobalFree
GlobalAlloc
GetProcAddress
GetModuleHandleA
FreeLibrary
GetNativeSystemInfo
GetWindowsDirectoryA
GetSystemDirectoryA
GetLocalTime
GlobalMemoryStatusEx
OpenProcess
CreateProcessA
GetCurrentProcess
WaitForSingleObject
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetLastError
RaiseException
CloseHandle
DecodePointer
CreateFileA
VerSetConditionMask
WideCharToMultiByte
LocalFree
GetModuleFileNameA
GetLongPathNameA
SetEnvironmentVariableA
GetEnvironmentVariableA
GetCommandLineW
OutputDebugStringA
VerifyVersionInfoA

ole32

CoTaskMemFree
StringFromCLSID

oleaut32

SysAllocString
SysFreeString
SysStringLen
SysAllocStringByteLen
VariantClear

Sections

.text
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 176B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e748b2ea5edacc281942683e01c23d1c

Code Sign

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52Certificate

Extended Key Usages

Key Usages

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2aCertificate

Extended Key Usages

Key Usages

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12Certificate

Extended Key Usages

Key Usages

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12Certificate

Extended Key Usages

Key Usages

45:3c:ff:0c:16:ac:12:ef:eb:23:27:32:50:e7:01:c4:e5:47:ad:adSigner

Headers

DLL Characteristics

File Characteristics

Imports

user32

deploy

msvcp120

msvcr120

kernel32

ole32

oleaut32

Sections

.text Size: 25KB - Virtual size: 25KB

.rdata Size: 16KB - Virtual size: 15KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 32KB - Virtual size: 32KB

.reloc Size: 512B - Virtual size: 176B

12:f0:27:7e:0f:23:3b:39:f9:41:9b:06:e8:cd:e3:52
Certificate

3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Certificate

7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Certificate

7b:d4:e5:af:ba:cc:07:3f:a1:01:23:04:22:41:4d:12
Certificate

45:3c:ff:0c:16:ac:12:ef:eb:23:27:32:50:e7:01:c4:e5:47:ad:ad
Signer

.text
Size: 25KB - Virtual size: 25KB

.rdata
Size: 16KB - Virtual size: 15KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 32KB - Virtual size: 32KB

.reloc
Size: 512B - Virtual size: 176B