C:\BUILD_~1\jdk6_20\control\build\WINDOW~1\tmp\deploy\common\bin\deploy.pdb
Static task
static1
Behavioral task
behavioral1
Sample
227c63470d3ec6a68497e3fe6302aa40N.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
227c63470d3ec6a68497e3fe6302aa40N.dll
Resource
win10v2004-20240709-en
General
-
Target
227c63470d3ec6a68497e3fe6302aa40N.exe
-
Size
76KB
-
MD5
227c63470d3ec6a68497e3fe6302aa40
-
SHA1
a7658a7ee07be3b3fdad19843a51cf373495dfa3
-
SHA256
3dff22c85c184e09068478b80f43b11c9c06166aadd736377393282ecf63a4cc
-
SHA512
d5f5b51fd0ffe577557fb47e53cc39fc6e57e1a43d4d692cef9e906a5ea8e12a2b3c90da33f8f57a4dcac9ebf786491018171a5c62728b2c91c37fba9c9e5d0a
-
SSDEEP
1536:HNEvelsCOXqVMyW5dIahCUM+pFps/XPPsHuSJ1PvCdfxGXNEZl:H6UVMhKao+ls/XsHuoEZl
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 227c63470d3ec6a68497e3fe6302aa40N.exe
Files
-
227c63470d3ec6a68497e3fe6302aa40N.exe.dll windows:4 windows x86 arch:x86
69754dd867743eb233ba5bfa4360d81f
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
crypt32
CryptAcquireCertificatePrivateKey
CertGetPublicKeyLength
CertFreeCertificateChain
CertGetEnhancedKeyUsage
CertOpenSystemStoreA
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateChain
kernel32
LoadResource
FindResourceA
LoadLibraryExA
lstrcmpiA
lstrcpynA
IsDBCSLeadByte
FormatMessageA
ExpandEnvironmentStringsA
SystemTimeToFileTime
GetSystemTime
GetCurrentThreadId
QueryPerformanceCounter
ExitProcess
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSection
SizeofResource
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
GetVersionExA
MultiByteToWideChar
RaiseException
GetProcAddress
LoadLibraryA
GetModuleHandleA
lstrlenA
FreeLibrary
LocalFree
WideCharToMultiByte
GetModuleFileNameA
CloseHandle
GetLastError
lstrlenW
GetWindowsDirectoryA
GetSystemDirectoryA
GetSystemWindowsDirectoryA
GetCurrentProcessId
GetTempPathA
InterlockedDecrement
InterlockedIncrement
DisableThreadLibraryCalls
GetTickCount
DeleteCriticalSection
GetCurrentProcess
GetSystemTimeAsFileTime
user32
GetWindowThreadProcessId
GetForegroundWindow
wsprintfA
CharNextA
MessageBoxA
wsprintfW
ExitWindowsEx
DefWindowProcA
RegisterClassA
CreateWindowExA
GetWindowLongA
SetWindowLongA
TranslateMessage
DispatchMessageA
GetMessageA
ReleaseDC
GetDC
GetDesktopWindow
CreateIconIndirect
DestroyIcon
CreatePopupMenu
AppendMenuW
ModifyMenuW
SetMenuDefaultItem
PostMessageA
TrackPopupMenu
SetForegroundWindow
GetCursorPos
FindWindowExA
GetWindowRect
PostQuitMessage
ShowWindow
gdi32
GetStockObject
CreateDIBitmap
CreateDIBSection
CreateBitmap
DeleteObject
advapi32
RegDeleteKeyA
RegCloseKey
RegOpenKeyExA
RegQueryValueExA
RegDeleteValueA
RegCreateKeyExA
RegSetValueExA
RegEnumKeyExA
RegEnumValueA
RegFlushKey
RegOpenKeyA
RegCreateKeyA
CryptCreateHash
CryptSetHashParam
CryptSignHashA
CryptDestroyHash
CryptDestroyKey
CryptGetUserKey
CryptSetKeyParam
CryptGetKeyParam
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegQueryInfoKeyA
GetUserNameW
shell32
ShellExecuteA
Shell_NotifyIconW
ShellExecuteExA
FindExecutableA
ole32
CoInitialize
CLSIDFromProgID
CoTaskMemRealloc
CoTaskMemAlloc
CoTaskMemFree
CoCreateInstance
CoUninitialize
oleaut32
VarUI4FromStr
SysFreeString
VariantInit
VariantClear
wininet
InternetCloseHandle
InternetSetOptionA
InternetGoOnline
InternetGetCookieA
InternetSetCookieA
InternetOpenA
InternetConnectA
HttpOpenRequestA
HttpSendRequestA
InternetQueryOptionA
urlmon
FindMimeFromData
msvcr71
__dllonexit
??1type_info@@UAE@XZ
wcsncpy
_local_unwind2
strstr
realloc
??_U@YAPAXI@Z
_resetstkoflw
_dup
_dup2
_lseek
_tempnam
calloc
strrchr
strtok
atoi
fopen
fputs
fclose
remove
malloc
??_V@YAXPAX@Z
free
wcscmp
wcslen
_except_handler3
strncpy
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
_purecall
_initterm
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
_strdup
_stricmp
_close
__security_error_handler
memset
_open
_fstat
_read
_onexit
Exports
Exports
??0BasicPerfHelper@@QAE@ABV0@@Z
??0BasicPerfHelper@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0BasicPerfStore@@QAE@ABV0@@Z
??0BasicPerfStore@@QAE@ABVSystemTime@@AAVNativeLock@@@Z
??0DeployPerf@@QAE@ABV0@@Z
??0DeployPerf@@QAE@XZ
??0NativeLock@@IAE@XZ
??0NativeLocker@@QAE@PAVNativeLock@@@Z
??0PerfHelper@@QAE@ABV0@@Z
??0PerfHelper@@QAE@XZ
??0PerfLabel@@QAE@ABV0@@Z
??0PerfLabel@@QAE@XZ
??0PerfLabel@@QAE@_JPBD@Z
??0PerfStore@@QAE@ABV0@@Z
??0PerfStore@@QAE@XZ
??0SystemTime@@QAE@ABV0@@Z
??0SystemTime@@QAE@XZ
??0WinLock@@QAE@XZ
??0WinTime@@QAE@ABV0@@Z
??0WinTime@@QAE@XZ
??1BasicPerfHelper@@UAE@XZ
??1BasicPerfStore@@UAE@XZ
??1DeployPerf@@UAE@XZ
??1NativeLock@@MAE@XZ
??1NativeLocker@@QAE@XZ
??1PerfHelper@@UAE@XZ
??1PerfStore@@UAE@XZ
??1SystemTime@@UAE@XZ
??1WinLock@@UAE@XZ
??1WinTime@@UAE@XZ
??4DeployPerf@@QAEAAV0@ABV0@@Z
??4NativeLocker@@QAEAAV0@ABV0@@Z
??4PerfHelper@@QAEAAV0@ABV0@@Z
??4PerfLabel@@QAEAAV0@ABV0@@Z
??4PerfStore@@QAEAAV0@ABV0@@Z
??4SystemTime@@QAEAAV0@ABV0@@Z
??4WinTime@@QAEAAV0@ABV0@@Z
??_7BasicPerfHelper@@6B@
??_7BasicPerfStore@@6B@
??_7DeployPerf@@6B@
??_7NativeLock@@6B@
??_7PerfHelper@@6B@
??_7PerfStore@@6B@
??_7SystemTime@@6B@
??_7WinLock@@6B@
??_7WinTime@@6B@
?LABEL_BUFFER_SIZE@PerfLabel@@2IB
?MAX_LABEL_COUNT@BasicPerfStore@@0IB
?_get@BasicPerfStore@@ABE?AVPerfLabel@@I@Z
?acquire@WinLock@@UAEXXZ
?calculateJavaEpoch@WinTime@@CA_JXZ
?get@BasicPerfStore@@UBE?AVPerfLabel@@I@Z
?getCurrentTime@BasicPerfHelper@@UBE_JXZ
?getCurrentTime@WinTime@@UBE_JXZ
?getJavaObj@PerfLabel@@QBEPAV_jobject@@PAUJNIEnv_@@@Z
?initStore@BasicPerfHelper@@UAE_NXZ
?labelToString@PerfLabel@@QBEPAV_jstring@@PAUJNIEnv_@@@Z
?put@BasicPerfHelper@@UAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfHelper@@UAEXPBD@Z
?put@BasicPerfStore@@QAEXPAUJNIEnv_@@PAV_jstring@@@Z
?put@BasicPerfStore@@UAEXPBD@Z
?put@PerfHelper@@MAEXPAUJNIEnv_@@PAV_jstring@@@Z
?release@WinLock@@UAEXXZ
?size@BasicPerfStore@@UBEIXZ
?toArray@BasicPerfHelper@@UBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@BasicPerfStore@@QBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
?toArray@PerfHelper@@MBEPAV_jobjectArray@@PAUJNIEnv_@@@Z
GetDeployPerf
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_ExpandEnvironmentStrings@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_FindMimeFromData@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCloseKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegCreateKeyEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteKey@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegDeleteValue@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumKeyEx@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegEnumValue@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegFlushKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegOpenKey@20
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryInfoKey@12
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegQueryValueEx@16
_Java_com_sun_deploy_association_utility_WinRegistryWrapper_RegSetValueEx@20
_Java_com_sun_deploy_config_UnixConfig_getPlatformPID@8
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsAdd@36
_Java_com_sun_deploy_config_WinConfig_addRemoveProgramsRemove@16
_Java_com_sun_deploy_config_WinConfig_canDownloadJRE@8
_Java_com_sun_deploy_config_WinConfig_getBrowserHomePathImpl@8
_Java_com_sun_deploy_config_WinConfig_getBrowserPath@8
_Java_com_sun_deploy_config_WinConfig_getDesktopIconSize@8
_Java_com_sun_deploy_config_WinConfig_getPlatformMaxCommandLineLength@8
_Java_com_sun_deploy_config_WinConfig_getPlatformSystemHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getPlatformUserHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_getSysTickCount@8
_Java_com_sun_deploy_config_WinConfig_getSystemExecutableHomeImpl@8
_Java_com_sun_deploy_config_WinConfig_installShortcut@36
_Java_com_sun_deploy_config_WinConfig_isBrowserFireFox@8
_Java_com_sun_deploy_config_WinConfig_isNativeModalDialogUp@8
_Java_com_sun_deploy_config_WinConfig_isPlatformWindowsVista@8
_Java_com_sun_deploy_config_WinConfig_notifyJREInstalled@12
_Java_com_sun_deploy_config_WinConfig_sendJFXPingImpl@40
_Java_com_sun_deploy_config_WinConfig_showDocument@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_getCookieInfo@12
_Java_com_sun_deploy_net_cookie_IExplorerCookieHandler_setCookieInfo@16
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_askUserGoOnline@12
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_isGlobalOffline@8
_Java_com_sun_deploy_net_offline_WIExplorerOfflineHandler_setGlobalOffline@12
_Java_com_sun_deploy_net_proxy_WIExplorerAutoProxyHandler_evalScript@12
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_getBrowserProxySettings@8
_Java_com_sun_deploy_net_proxy_WIExplorerProxyConfig_performAutoDetection@8
_Java_com_sun_deploy_perf_NativePerfHelper_put@12
_Java_com_sun_deploy_perf_NativePerfHelper_toArray@8
_Java_com_sun_deploy_security_MSCredentialManager_decryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_encryptMSPassword@12
_Java_com_sun_deploy_security_MSCredentialManager_getLoginUID@8
_Java_com_sun_deploy_security_MSCredentialManager_isEncryptionAvailable@8
_Java_com_sun_deploy_security_MSCryptoDSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoNONEwithRSASignature_nativeSignHash@24
_Java_com_sun_deploy_security_MSCryptoRSAKey_cleanUp@16
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator14_getAuthentication@12
_Java_com_sun_deploy_security_WIExplorerBrowserAuthenticator_getAuthFromInet@28
_Java_com_sun_deploy_security_WIExplorerCertStore_loadCertificates@20
_Java_com_sun_deploy_security_WIExplorerMyKeyStore_loadKeysAndCertificateChains@16
_Java_com_sun_deploy_security_WSeedGenerator_generateSeed@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_appendMenu@32
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createNativeIcon@28
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createPopupMenu@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_createWindow@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_defWindowProc@36
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_destroyIcon@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_getCurrentProcessId@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_hasBalloonTooltipShown0@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_isBalloonClickInBounds@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_isEnabled0@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_mainLoop@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_modifyMenu@32
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_notifyShell@60
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_openControlPanel@8
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_postQuitMessage@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_registerClass@12
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setBalloonTooltipShown0@20
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setMenuDefaultItem@24
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_setUserData@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showPopupMenu@24
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showSysTray@16
_Java_com_sun_deploy_ui_WindowsJavaTrayIcon_showWindow@20
_Java_com_sun_deploy_util_ConsoleHelper_dumpAllStacksImpl@8
_Java_com_sun_deploy_util_ConsoleHelper_preMustangDumpAllStacksImpl@8
_Java_com_sun_deploy_util_WinRegistry_getWindowsDirectory@8
_Java_com_sun_deploy_util_WinRegistry_initIDs@8
_Java_com_sun_deploy_util_WinRegistry_sysCloseKey@12
_Java_com_sun_deploy_util_WinRegistry_sysCreateKey@20
_Java_com_sun_deploy_util_WinRegistry_sysDeleteKey@16
_Java_com_sun_deploy_util_WinRegistry_sysOpenKey@20
_Java_com_sun_deploy_util_WinRegistry_sysQueryKey@16
_Java_com_sun_deploy_util_WinRegistry_sysReboot@8
_Java_com_sun_deploy_util_WinRegistry_sysSetStringValue@20
Sections
.text Size: 40KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 824B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 976B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ