wrapper_jre_offline[.]exe | Triage

Sharing

General

Target

wrapper_jre_offline.exe
Size

19.2MB
MD5

641d6655a3e29cc7614c8b957862e1c4
SHA1

62e64aa2c9350b595d464a9b86b7523c908b89f5
SHA256

c059b783b68ef84c1743e29fc176231e88de977eddb9b78a92c2327a811875c6
SHA512

3f1036bcbb51ce7881ba87d9e92a12e7c3488640233205eb2f51e6af8b31906bf939a303b339b915f59cace99171a4688c755207d0c9640511b7d6b804ab200c
SSDEEP

393216:Tlss9NuVHhMhFq4h5kC9h/gx4R+l5iq8SI1uIb:X9ghIfh5kCPIKiL8W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

wrapper_jre_offline.exe

Files

wrapper_jre_offline.exe
.exe windows:6 windows x86 arch:x86

27cb3dd4b0c01d19e67be2c0b03afa13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FindFirstFileA
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

advapi32

RegOpenKeyExA

ole32

CoInitialize

Sections

.text
Size: - Virtual size: 63KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls0
Size: - Virtual size: 10.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.tls1
Size: 1024B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls2
Size: 19.2MB - Virtual size: 19.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 31KB - Virtual size: 31KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ