JAVA.zip
- SHA256 1bcb967657d6bd93ec53d7225a7feb1615903e08a8b66500e648ec7fa57d6540
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
JAVA/jre-8u202-windows-i586.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
JAVA/jre-8u202-windows-i586.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target JAVA.zip
- Size 63.6MB
- Sample260729-k2faqafd53
- SHA256 1bcb967657d6bd93ec53d7225a7feb1615903e08a8b66500e648ec7fa57d6540
- MD5 0cd086bf0286faa6405b76c730e0ad20
- SHA1 32ef2f01998478bdf7a5a06f8310392b0bb918f6
- SHA512 8562147fe9530d2addfee1f76772ca49855a968321492db1054ed5a294f99b73ae087b0a9c47a8217ec42805b520b12ab5fa6aa2418e35a7d38ed36b47b5c612
- SSDEEP 1572864:Povveu80vdVCWBT/inYM9iOsBe8G6LQtHptYTL/SqqK:QvvemdV3TEYAiOsI8pLQFYLaqqK
- TLSH T126E733EB0D5C2419D7EC7473BD88A46C304641AA7F4953E111ABC7D28D227E92BD8FB2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Insecure Codesign Algorithm 1 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/JAVA/jre-8u202-windows-i586.exe
File Explorer
-
JAVA.zip.zip 63.6MB
-
JAVA/jre-8u202-windows-i586.exe.exe 65.7MB
JAVA/jre-8u202-windows-i586.exe
- IMPHASH 1ca0524118d0fda0a70479ae0d39af0f
- SHA256 842fb523b72866a97a9b299e7e4c23dd72fd63f7ea827c770c1151eb021f448b
- MD5 7602a766f45af60272b6c6eb6231b4f3
- SHA1 14efd8251f6899a901a36a69a73d2ca040c8c507
- SHA512 3a2f9857021d8425ca6eb65cdbb7a63e58acbff40ff649482ae21135752511a7049362557f9f295442657ed430e1c754c14702e9e5e5d1872e8a777fe9ec8649
- SSDEEP 1572864:fYrX1AKcOHOuGk27/yHQKcgqar6AX6rZHTZIJX4Gq8daBi:CX1AIOu07awLgqar/XQZzA4GqoaBi
- TLSH T16CE7331A7AD4C032D5B7963199AD933855B5BCB18932805B73DDB30D4FB02928F31BBA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
Digest
0b:2c:33:7c:3f:89:48:45:c1:b5:32:d2:74:a7:7f:68:f6:5f:b2:27
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
Chains
Dec 16, 2018
CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Subject
CN=Oracle America\, Inc.,OU=Software Engineering,O=Oracle America\, Inc.,L=Redwood City,ST=California,C=US
Serial Number
59:7e:4e:45:cb:c1:15:bb:a6:40:26:02:e8:9c:bf:45
Issuer
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 26, 2018 - Feb 27, 2020
Subject
CN=Symantec Class 3 SHA256 Code Signing CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
3d:78:d7:f9:76:49:60:b2:61:7d:f4:f0:1e:ca:86:2a
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 10, 2013 - Dec 9, 2023
Subject
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
7b:05:b1:d4:49:68:51:44:f7:c9:89:d2:9c:19:9d:12
Issuer
CN=VeriSign Universal Root Certification Authority,OU=VeriSign Trust Network+OU=(c) 2008 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 12, 2016 - Jan 11, 2031
Subject
CN=Symantec SHA256 TimeStamping Signer - G2,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Serial Number
54:58:f2:aa:d7:41:d6:44:bc:84:a9:7b:a0:96:52:e6
Issuer
CN=Symantec SHA256 TimeStamping CA,OU=Symantec Trust Network,O=Symantec Corporation,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jan 2, 2017 - Apr 1, 2028
Minor OS version
1
Major OS version
5
Entry point
57864
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetCurrentProcess
GetModuleHandleExW
GetSystemDirectoryA
GetModuleFileNameA
GetTempPathA
LocalFree
CreateFileA
MoveFileExA
GetTickCount
GetFileAttributesA
FindFirstFileA
SetLastError
RemoveDirectoryA
SetFileAttributesA
FindClose
FindNextFileA
CloseHandle
DeleteFileA
Sleep
FormatMessageW
GetLocalTime
GetCurrentThreadId
GetCurrentProcessId
FindResourceA
LoadResource
SizeofResource
LockResource
WideCharToMultiByte
MultiByteToWideChar
InterlockedDecrement
FreeLibrary
LoadLibraryW
InterlockedIncrement
InterlockedExchange
GetStringTypeW
DecodePointer
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleHandleW
ExitProcess
HeapFree
GetCommandLineA
HeapSetInformation
GetStartupInfoW
GetFileType
WriteFile
GetConsoleCP
GetConsoleMode
GetModuleHandleA
RtlUnwind
HeapAlloc
LCMapStringW
GetCPInfo
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
GetLocaleInfoW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetModuleFileNameW
HeapCreate
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
QueryPerformanceCounter
GetSystemTimeAsFileTime
ReadFile
SetFilePointer
FlushFileBuffers
HeapSize
SetStdHandle
SetEndOfFile
GetProcessHeap
WriteConsoleW
GetACP
GetOEMCP
IsValidCodePage
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
HeapReAlloc
CreateFileW
GetProcAddress
GetLastError
CreateDirectoryA
CreateProcessA
SetDllDirectoryA
GetExitCodeProcess
WaitForSingleObject
GetModuleHandleExA
EncodePointer
RaiseException
advapi32
ConvertStringSecurityDescriptorToSecurityDescriptorA
Name
.text
Size
133KB
Virtual Size
133KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
65.5MB
Virtual Size
65.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=171, productName=VS2010 build 30319, version=30319,
count=22, id=158, productName=VS2010 SP1 build 40219, version=40219,
count=57, id=171, productName=VS2010 SP1 build 40219, version=40219,
count=155, id=170, productName=VS2010 SP1 build 40219, version=40219,
count=1, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=19, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=166, id=1, productName=Unmarked objects,
count=16, id=175, version=40219,
count=1, id=154, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=151,
count=1, id=157, productName=VS2010 SP1 build 40219, version=40219,