analyze malware
- Huge database of samples and IOCs
- Custom VM setup
- Unlimited submissions
- Interactive approach
| File name: | Comprobante_2020CD2.jar |
| Full analysis: | https://app.any.run/tasks/2f0ea629-5083-48a6-98fb-ace946b986a9 |
| Verdict: | No threats detected |
| Analysis date: | September 21, 2020, 18:00:36 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| MIME: | application/java-archive |
| File info: | Java archive data (JAR) |
| MD5: | C691398ED85CF156E447C86A88259667 |
| SHA1: | A43CCAD37F8E584CB7263E7F492741AF0B3222F1 |
| SHA256: | 03DCF034305C3F0613546E11755ADAD5B7A2902C00CBF66F0AA30E441EFBF717 |
| SSDEEP: | 192:WxyjfRXAy7R/FEvUrQlyiHXDZWr1fwampeo:WxifpAMEvUeRZuVspJ |
MALICIOUS
No malicious indicators.SUSPICIOUS
Creates files in the user directory
- javaw.exe (PID: 2560)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
TRiD
| .jar | | | Java Archive (78.3) |
|---|---|---|
| .zip | | | ZIP compressed archive (21.6) |
EXIF
ZIP
| ZipFileName: | Microsoft_Secure_Document_Viewer.class |
|---|---|
| ZipUncompressedSize: | 2527 |
| ZipCompressedSize: | 1195 |
| ZipCRC: | 0x535ab973 |
| ZipModifyDate: | 2020:09:11 05:56:26 |
| ZipCompression: | Deflated |
| ZipBitFlag: | 0x0808 |
| ZipRequiredVersion: | 20 |
Total processes
34
Monitored processes
1
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 2560 | "C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\Comprobante_2020CD2.jar" | C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe | explorer.exe | |
User: admin Company: Oracle Corporation Integrity Level: MEDIUM Description: Java(TM) Platform SE binary Exit code: 0 Version: 8.0.920.14 | ||||
Total events
7
Read events
7
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
0
Text files
1
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 2560 | javaw.exe | C:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamp | text | |
MD5:CEA7628C18CBB58AAE33386D3C268C45 | SHA256:4CFFF2BA396D3D539C6F70E0C2419DD4EEC8EC55FF5BC701476DFD8AF58F8379 | |||
| 2560 | javaw.exe | C:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1302019708-1500728564-335382590-1000\83aa4cc77f591dfc2374580bbd95f6ba_90059c37-1320-41a4-b58d-2b75a9850d2f | dbf | |
MD5:C8366AE350E7019AEFC9D1E6E6A498C6 | SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
3
DNS requests
7
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
2560 | javaw.exe | 45.141.84.230:80 | secure-dns-resolve.com | — | — | unknown |
2560 | javaw.exe | 162.213.253.56:443 | imagenes-facturasmx.xyz | Namecheap, Inc. | US | suspicious |
DNS requests
Domain | IP | Reputation |
|---|---|---|
imagenes-facturasmx.xyz |
| unknown |
facturacionmx.net |
| unknown |
secure-dns-resolve.com |
| unknown |
dns.msftncsi.com |
| shared |