analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

AWB#68564359.pdf.jar

Full analysis: https://app.any.run/tasks/2361a8a1-8551-4ce3-a70f-0f188e164e06
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 01, 2023, 07:30:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 64 bit)
Tags:
rat
strrat
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

C7FDB46A741BA2277CB4680BE0C2D562

SHA1:

7B2094D46AF6BE7CADA6CA8AEA5FCF58B5F0339B

SHA256:

EA6BB902953E6C6B871D4E46A25982C1F891DF418C9AAFFD986641EBFEC1D803

SSDEEP:

3072:X8/j3/CXlO3oV6tzN5E3D/rzZzW169G+iASV0njRTO+UmL77IthB97yWKcf:X8T/Coo8B5IxwAJTxp0Vx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • StrRat is detected

      • javaw.exe (PID: 1720)

    • Create files in the Startup directory

      • java.exe (PID: 1896)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 1216)

    • STRRAT detected by memory dumps

      • java.exe (PID: 2040)

    • STRRAT was detected

      • java.exe (PID: 2040)

    • Connects to the CnC server

      • java.exe (PID: 2040)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • java.exe (PID: 1896)
      • java.exe (PID: 2040)

    • Application launched itself

      • java.exe (PID: 1896)

    • Executable content was dropped or overwritten

      • java.exe (PID: 2040)

    • Reads the Internet Settings

      • WMIC.exe (PID: 2308)
      • WMIC.exe (PID: 928)
      • WMIC.exe (PID: 2776)
      • WMIC.exe (PID: 2152)

    • Uses WMIC.EXE to obtain volume information

      • cmd.exe (PID: 1376)

    • Uses WMIC.EXE to obtain operating system information

      • cmd.exe (PID: 2644)
      • cmd.exe (PID: 2180)

    • Checks for external IP

      • java.exe (PID: 2040)

    • Uses WMIC.EXE to obtain Windows Installer data

      • cmd.exe (PID: 3036)

    • Connects to unusual port

      • java.exe (PID: 2040)

  • INFO

    • The process checks LSA protection

      • javaw.exe (PID: 1720)
      • java.exe (PID: 2040)
      • WMIC.exe (PID: 2308)
      • WMIC.exe (PID: 928)
      • WMIC.exe (PID: 2776)
      • WMIC.exe (PID: 2152)

    • Checks supported languages

      • javaw.exe (PID: 1720)
      • java.exe (PID: 1896)
      • java.exe (PID: 2040)

    • Reads the computer name

      • javaw.exe (PID: 1720)
      • java.exe (PID: 1896)
      • java.exe (PID: 2040)

    • Creates files or folders in the user directory

      • javaw.exe (PID: 1720)
      • java.exe (PID: 1896)

    • Create files in a temporary directory

      • javaw.exe (PID: 1720)
      • java.exe (PID: 1896)
      • java.exe (PID: 2040)

    • Reads the machine GUID from the registry

      • javaw.exe (PID: 1720)
      • java.exe (PID: 2040)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.jar | Java Archive (78.3)
.zip | ZIP compressed archive (21.6)

EXIF

ZIP

ZipFileName: META-INF/MANIFEST.MF
ZipUncompressedSize: -
ZipCompressedSize: -
ZipCRC: 0x00000000
ZipModifyDate: 2023:03:31 00:49:58
ZipCompression: Deflated
ZipBitFlag: 0x0808
ZipRequiredVersion: 20
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
48
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #STRRAT javaw.exe java.exe cmd.exe no specs #STRRAT java.exe schtasks.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs wmic.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1720"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe" -jar "C:\Users\admin\AppData\Local\Temp\AWB#68564359.pdf.jar"C:\Program Files\Java\jre1.8.0_92\bin\javaw.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\javaw.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
1896"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar "C:\Users\admin\AWB#68564359.pdf.jar"C:\Program Files\Java\jre1.8.0_92\bin\java.exe
javaw.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Exit code:
0
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
1216cmd /c schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\AWB#68564359.pdf.jar"C:\Windows\System32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
2040"C:\Program Files\Java\jre1.8.0_92\bin\java.exe" -jar "C:\Users\admin\AppData\Roaming\AWB#68564359.pdf.jar"C:\Program Files\Java\jre1.8.0_92\bin\java.exe
java.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java(TM) Platform SE binary
Version:
8.0.920.14
Modules
Images
c:\program files\java\jre1.8.0_92\bin\java.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
308schtasks /create /sc minute /mo 30 /tn Skype /tr "C:\Users\admin\AppData\Roaming\AWB#68564359.pdf.jar"C:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\rpcrt4.dll
1376cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:list"C:\Windows\System32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
928wmic /node:. /namespace:'\\root\cimv2' path win32_logicaldisk get volumeserialnumber /format:listC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2180cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:list"C:\Windows\System32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2308wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get caption,OSArchitecture /format:listC:\Windows\System32\wbem\WMIC.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
WMI Commandline Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2644cmd.exe /c "wmic /node:. /namespace:'\\root\cimv2' path win32_operatingsystem get version /format:list"C:\Windows\System32\cmd.exe—java.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 686
Read events
2 686
Write events
0
Delete events
0

Modification events

No data
Executable files
14
Suspicious files
18
Text files
2
Unknown types
2

Dropped files

PID
Process
Filename
Type
1720javaw.exeC:\Users\admin\.oracle_jre_usage\90737d32e3abaa4.timestamptext
MD5:DFF96E25EFCDC841C4D1750F9898B4F4
SHA256:149336807F37086967A0591B324686E3F3BE37EE78B720F18663803D8002D559
1720javaw.exeC:\Users\admin\lib\system-hook-3.5.jardcompressed
MD5:E1AA38A1E78A76A6DE73EFAE136CDB3A
SHA256:2DDDA8AF6FAEF8BDE46ACF43EC546603180BCF8DCB2E5591FFF8AC9CD30B5609
1896java.exeC:\Users\admin\AppData\Roaming\AWB#68564359.pdf.jarcompressed
MD5:C7FDB46A741BA2277CB4680BE0C2D562
SHA256:EA6BB902953E6C6B871D4E46A25982C1F891DF418C9AAFFD986641EBFEC1D803
1720javaw.exeC:\Users\admin\AWB#68564359.pdf.jarcompressed
MD5:C7FDB46A741BA2277CB4680BE0C2D562
SHA256:EA6BB902953E6C6B871D4E46A25982C1F891DF418C9AAFFD986641EBFEC1D803
1896java.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AWB#68564359.pdf.jarcompressed
MD5:C7FDB46A741BA2277CB4680BE0C2D562
SHA256:EA6BB902953E6C6B871D4E46A25982C1F891DF418C9AAFFD986641EBFEC1D803
1720javaw.exeC:\Users\admin\lib\jna-5.5.0.jardjava
MD5:ACFB5B5FD9EE10BF69497792FD469F85
SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E
1720javaw.exeC:\Users\admin\lib\jna-5.5.0.jarjava
MD5:ACFB5B5FD9EE10BF69497792FD469F85
SHA256:B308FAEBFE4ED409DE8410E0A632D164B2126B035F6EACFF968D3908CAFB4D9E
1720javaw.exeC:\Users\admin\lib\jna-platform-5.5.0.jarjava
MD5:2F4A99C2758E72EE2B59A73586A2322F
SHA256:24D81621F82AC29FCDD9A74116031F5907A2343158E616F4573BBFA2434AE0D5
1720javaw.exeC:\Users\admin\lib\sqlite-jdbc-3.14.2.1.jarcompressed
MD5:B33387E15AB150A7BF560ABDC73C3BEC
SHA256:2EAE3DEA1C3DDE6104C49F9601074B6038FF6ABCF3BE23F4B56F6720A4F6A491
1720javaw.exeC:\Users\admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3896776584-4254864009-862391680-1000\83aa4cc77f591dfc2374580bbd95f6ba_eeeb5d54-7880-42a7-b542-739bbc26cf4bdbf
MD5:C8366AE350E7019AEFC9D1E6E6A498C6
SHA256:11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
7
DNS requests
5
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2040
java.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
binary
264 b
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2040
java.exe
208.95.112.1:80
ip-api.com
TUT-AS
US
malicious
2040
java.exe
193.42.32.233:1780
ebuleakonangookpala.dynamic-dns.net
Enes Koken
US
suspicious
1720
javaw.exe
199.232.192.209:443
repo1.maven.org
FASTLY
US
suspicious
1720
javaw.exe
185.199.108.133:443
objects.githubusercontent.com
FASTLY
US
malicious
1720
javaw.exe
140.82.121.3:443
github.com
GITHUB
US
suspicious

DNS requests

Domain
IP
Reputation
repo1.maven.org
  • 199.232.192.209
  • 199.232.196.209
whitelisted
github.com
  • 140.82.121.3
shared
objects.githubusercontent.com
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
  • 185.199.111.133
shared
ebuleakonangookpala.dynamic-dns.net
  • 193.42.32.233
suspicious
ip-api.com
  • 208.95.112.1
shared

Threats

PID
Process
Class
Message
2040
java.exe
Potential Corporate Privacy Violation
AV POLICY Internal Host Retrieving External IP Address (ip-api. com)
2040
java.exe
Device Retrieving External IP Address Detected
ET POLICY External IP Lookup ip-api.com
2040
java.exe
Unknown Classtype
ET MALWARE STRRAT CnC Checkin
2040
java.exe
Unknown Classtype
ET MALWARE STRRAT CnC Checkin
2040
java.exe
Unknown Classtype
ET MALWARE STRRAT CnC Checkin
2040
java.exe
Unknown Classtype
ET MALWARE STRRAT CnC Checkin
2040
java.exe
Unknown Classtype
ET MALWARE STRRAT CnC Checkin
2040
java.exe
Unknown Classtype
ET MALWARE STRRAT CnC Checkin
2040
java.exe
Unknown Classtype
ET MALWARE STRRAT CnC Checkin
2040
java.exe
Unknown Classtype
ET MALWARE STRRAT CnC Checkin
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AWB#68564359.pdf.jar