SupplierRemittance.jar

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 7, 2021, 7:02 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Sept. 7, 2021, 7:02 p.m.	process_identifier: 2768 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 2555904 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002620000 process_handle: 0xffffffffffffffff	1	0	0

File has been identified by 10 AntiVirus engines on VirusTotal as malicious (10 events)

MicroWorld-eScan	Java.Trojan.GenericGBA.30531
FireEye	Java.Trojan.GenericGBA.30531
Arcabit	Java.Trojan.GenericGBA.D7743
ESET-NOD32	a variant of Java/Spy.Agent.Y
BitDefender	Java.Trojan.GenericGBA.30531
Ad-Aware	Java.Trojan.GenericGBA.30531
Emsisoft	Java.Trojan.GenericGBA.30531 (B)
GData	Java.Trojan.GenericGBA.30531
MAX	malware (ai score=80)
Ikarus	Trojan.Java.Spy

A potential heapspray has been detected. 924 megabytes was sprayed onto the heap of the java.exe process (1 event)

count

3696

name

heapspray

process

java.exe

total_mb

924

length

262144

protection

PAGE_READWRITE