20210616docusign.jar

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx June 17, 2021, 5:48 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory June 17, 2021, 5:48 p.m.	process_identifier: 1520 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 2555904 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023e0000 process_handle: 0xffffffffffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host	172.217.25.14

File has been identified by 20 AntiVirus engines on VirusTotal as malicious (20 events)

MicroWorld-eScan	Java.Trojan.GenericGBA.29493
FireEye	Java.Trojan.GenericGBA.29493
Cyren	Java/Kryptik.F.gen!Eldorado
ESET-NOD32	multiple detections
Kaspersky	HEUR:Trojan.Java.Agent.gen
BitDefender	Java.Trojan.GenericGBA.29493
AegisLab	Trojan.Script.Generic.4!c
Ad-Aware	Java.Trojan.GenericGBA.29493
Emsisoft	Java.Trojan.GenericGBA.29493 (B)
DrWeb	Java.Siggen.491
McAfee-GW-Edition	Java/Agent!4ACE236CAE14
Avira	EXP/JAVA.SpyAgent.VPB.Gen
MAX	malware (ai score=84)
Microsoft	Trojan:Java/StrRat.B!MTB
ZoneAlarm	HEUR:Trojan.Java.Agent.gen
GData	Java.Trojan.Agent.FJYIC2
Cynet	Malicious (score: 99)
Yandex	Trojan.Etecer.bVydoM.32
Ikarus	Trojan.Java.GenericGBA
Fortinet	Java/Agent.R!tr.spy

A potential heapspray has been detected. 869 megabytes was sprayed onto the heap of the java.exe process (1 event)

count

3478

name

heapspray

process

java.exe

total_mb

869

length

262144

protection

PAGE_READWRITE