File name:

jdk-1_1_8_010-windows-i586.exe

Full analysis: https://app.any.run/tasks/0292f8f7-2325-47c0-a4e3-1889a064dd77
Verdict: Malicious activity
Analysis date: June 25, 2025, 09:39:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
arch-exec
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 6 sections
MD5:

5C78E2102F73DA5A9E11E88D3A74238D

SHA1:

851114F1E396F7B2C05A2F73AA3094B80FCF0868

SHA256:

876D5BD394281B8E20E922FD3EEB56FD082EF6E7BDAC440F0F4F330777599CB7

SSDEEP:

98304:u49JsrOtuMWd6dbREAjv8KmxVe2IVvBfq5lnVCj0n0fSl5/gAClztVLjgphH6MP7:TS1AURHO5qnfj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • jdk-1_1_8_010-windows-i586.exe (PID: 3104)
      • ntvdm.exe (PID: 1116)
      • _INS0432._MP (PID: 3672)

    • Creates file in the systems drive root

      • ntvdm.exe (PID: 1116)

    • Starts application with an unusual extension

      • ntvdm.exe (PID: 1116)

    • Process drops legitimate windows executable

      • _INS0432._MP (PID: 3672)

    • There is functionality for taking screenshot (YARA)

      • _INS0432._MP (PID: 3672)

    • Creates a software uninstall entry

      • _INS0432._MP (PID: 3672)

    • Start notepad (likely ransomware note)

      • _INS0432._MP (PID: 3672)

  • INFO

    • Create files in a temporary directory

      • jdk-1_1_8_010-windows-i586.exe (PID: 3104)
      • ntvdm.exe (PID: 1116)
      • _INS0432._MP (PID: 3672)

    • Checks supported languages

      • jdk-1_1_8_010-windows-i586.exe (PID: 3104)
      • _INS0432._MP (PID: 3672)

    • The sample compiled with english language support

      • jdk-1_1_8_010-windows-i586.exe (PID: 3104)
      • ntvdm.exe (PID: 1116)
      • _INS0432._MP (PID: 3672)

    • Reads the computer name

      • _INS0432._MP (PID: 3672)

    • Manual execution by a user

      • explorer.exe (PID: 2612)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ 4.x (50.4)
.exe | InstallShield setup (16.1)
.exe | Win32 Executable MS Visual C++ (generic) (11.6)
.exe | Win64 Executable (generic) (10.3)
.scr | Windows screen saver (4.9)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1996:12:06 20:17:50+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 4.2
CodeSize: 75264
InitializedDataSize: 35328
UninitializedDataSize: -
EntryPoint: 0xc960
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
6
Malicious processes
1
Suspicious processes
2

Behavior graph

Click at the process to see the details
start jdk-1_1_8_010-windows-i586.exe ntvdm.exe _ins0432._mp notepad.exe no specs explorer.exe no specs jdk-1_1_8_010-windows-i586.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328NOTEPAD.EXE C:\JDK11~1.8\README. C:\Windows\System32\notepad.exe—_INS0432._MP
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1116"C:\Windows\system32\ntvdm.exe" -i1 -wsC:\Windows\System32\ntvdm.exe
jdk-1_1_8_010-windows-i586.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
NTVDM.EXE
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\ntvdm.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2612"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
3104"C:\Users\admin\Downloads\jdk-1_1_8_010-windows-i586.exe" C:\Users\admin\Downloads\jdk-1_1_8_010-windows-i586.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\downloads\jdk-1_1_8_010-windows-i586.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
3232"C:\Users\admin\Downloads\jdk-1_1_8_010-windows-i586.exe" C:\Users\admin\Downloads\jdk-1_1_8_010-windows-i586.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\downloads\jdk-1_1_8_010-windows-i586.exe
c:\windows\system32\ntdll.dll
3672C:\Users\admin\AppData\Local\Temp\_INS0432._MP C:\Users\admin\AppData\Local\Temp\_INS0432._MP
ntvdm.exe
User:
admin
Company:
InstallShield Corporation, Inc.
Integrity Level:
HIGH
Description:
InstallShield Engine EXE
Exit code:
0
Version:
3.00.118.0
Modules
Images
c:\users\admin\appdata\local\temp\_ins0432._mp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\version.dll
Total events
459
Read events
453
Write events
6
Delete events
0

Modification events

(PID) Process:(3672) _INS0432._MPKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\java.exe
Operation:writeName:Path
Value:
C:\jdk1.1.8\bin
(PID) Process:(3672) _INS0432._MPKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JDK 1.1
Operation:writeName:UninstallString
Value:
C:\Windows\uninst.exe -fC:\jdk1.1.8\lib\DeIsL1.isu
(PID) Process:(3672) _INS0432._MPKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\JDK 1.1
Operation:writeName:DisplayName
Value:
Java Development Kit 1.1
(PID) Process:(3672) _INS0432._MPKey:HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit
Operation:writeName:CurrentVersion
Value:
1.1
(PID) Process:(3672) _INS0432._MPKey:HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\1.1
Operation:writeName:JavaHome
Value:
C:\jdk1.1.8
(PID) Process:(3672) _INS0432._MPKey:HKEY_LOCAL_MACHINE\SOFTWARE\JavaSoft\Java Development Kit\1.1
Operation:writeName:MicroVersion
Value:
8
Executable files
111
Suspicious files
25
Text files
959
Unknown types
182

Dropped files

PID
Process
Filename
Type
3104jdk-1_1_8_010-windows-i586.exeC:\Users\admin\AppData\Local\Temp\~EXB0000\java.z —
MD5:—
SHA256:—
3104jdk-1_1_8_010-windows-i586.exeC:\Users\admin\AppData\Local\Temp\~EXB0000\src.z —
MD5:—
SHA256:—
3104jdk-1_1_8_010-windows-i586.exeC:\Users\admin\AppData\Local\Temp\~EXB0000\_INST32I.EX_??_
MD5:AC76C9D10E6912D40813DC412D29A29E
SHA256:D1FA52F6DD4C3D445D725B1733AC937C7026AEF10143B83B5CD0A98F7181F26E
3104jdk-1_1_8_010-windows-i586.exeC:\Users\admin\AppData\Local\Temp\~EXB0000\~IS_CMPX.~~~compressed
MD5:3CE774BBC0A6A52AE3D60725599C9EAA
SHA256:63F70C2A43A251462BDF21C19BF1134DFD7AD7D414685C851619AD44BF074E9C
1116ntvdm.exeC:\Windows\_delis43.initext
MD5:5062F5FA8190E16CFEEE0EA83B181503
SHA256:DA178F3DDF751CC92F840BDB21F2F8C3E3CA751419E23C886C73E9617AB417F5
3104jdk-1_1_8_010-windows-i586.exeC:\Users\admin\AppData\Local\Temp\~EXB0000\setup.insins
MD5:7F495D17CA49E5CA39255ADB5934EA6D
SHA256:EACF0DAEF8193C8384D993480BC5F6BEDC2F4BF607FD023F929EC21D346062E9
3104jdk-1_1_8_010-windows-i586.exeC:\Users\admin\AppData\Local\Temp\~EXB0000\_setup.dllexecutable
MD5:599962CB4BA292AA1E8E12E9CE4AE3E3
SHA256:EDB2F8953C41F5EBDBC89F33C3EF356564D901CF6DAB36A11487AF00F4893334
3104jdk-1_1_8_010-windows-i586.exeC:\Users\admin\AppData\Local\Temp\~EXB0000\setup.exeexecutable
MD5:0473995F121CFAFB72E6B8CE96E3F13A
SHA256:64D55B0367ABF8456498CFCAD956F642972B720B116F829C54F3251513C1EF2F
1116ntvdm.exeC:\Users\admin\AppData\Local\Temp\_INS0432.INItext
MD5:19A33EC42761A85E21874BD4AE7D9231
SHA256:668562A8CD2DF02995A83981C6E59FBC16956FAB6124695113429733EE64BE8D
3104jdk-1_1_8_010-windows-i586.exeC:\Users\admin\AppData\Local\Temp\~EXB0000\lib.zcompressed
MD5:CB7EE44FF061A1295A65BFD115D8FEC0
SHA256:8F20BF12F94064D66DC8588913BB92CD938EF405649CA7B45051894F3B17E500
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
6
DNS requests
1
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.16.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
jdk-1_1_8_010-windows-i586.exe