adal.jar

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 29, 2021, 6:10 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 29, 2021, 6:10 p.m.	process_identifier: 1016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 2555904 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002580000 process_handle: 0xffffffffffffffff	1	0	0

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

Lionic	Trojan.AndroidOS.Jocker.C!c
CAT-QuickHeal	Android.Jocker.GEN43293
McAfee	Artemis!D703F9D11DC6
Alibaba	Trojan:Android/Jocker.928220dd
K7GW	Trojan ( 00570c961 )
SymantecMobileInsight	AppRisk:Generisk
Symantec	Trojan.Gen.NPE
ESET-NOD32	a variant of Android/Agent.CBG
Kaspersky	HEUR:Trojan.AndroidOS.Jocker.fb
Tencent	Dos.Trojan.Jocker.Ajlm
DrWeb	Android.Joker.207.origin
McAfee-GW-Edition	Artemis!Trojan
Jiangmin	Trojan.AndroidOS.iooo
Avira	ANDROID/Joker.IBEX.Gen
Microsoft	Program:Win32/Uwamson.A!ml
Cynet	Malicious (score: 99)
Ikarus	Trojan-Spy.AndroidOS.Joker
MaxSecure	Trojan.SMS.AndroidOS.Agent.a3
Fortinet	Android/Agent.CBG!tr

A potential heapspray has been detected. 893 megabytes was sprayed onto the heap of the java.exe process (1 event)

count

3574

name

heapspray

process

java.exe

total_mb

893

length

262144

protection

PAGE_READWRITE