Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Nov. 1, 2021, 2:12 p.m.	Nov. 1, 2021, 2:14 p.m.

Size	25.3KB
Type	Java archive data (JAR)
MD5	`e83ec42ad9c282b28e4561dc5fec346d`
SHA256	`dd80828efc70d1f89d2fadd70c4707247450723697313b582b5c6d2244f0624c`
CRC32	`44B4DDF0`
ssdeep	`384:zVyOLhkTisJzGOZw21E2zNDbFFmtjrKtl2TCRYgeEBFFckQlI3HnVW3Ud147:5w9oOZf2ON3vm5q6wBF+lsn+UfO`
Yara	None matched

java.exe "C:\Program Files (x86)\Java\jre1.8.0_131\bin\java.exe" -jar C:\Users\test22\AppData\Local\Temp\adal.jar
2424

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 1, 2021, 2:12 p.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ Nov. 1, 2021, 2:12 p.m.	stacktrace: exception.instruction_r: 8b 06 8d b5 f8 00 00 00 c5 fe 7f 06 c5 fe 7f 7e exception.instruction: mov eax, dword ptr [esi] exception.exception_code: 0xc0000005 exception.symbol: exception.address: 0x2630202 registers.esp: 12908048 registers.edi: 1 registers.eax: 6 registers.ebp: 1946801344 registers.edx: 0 registers.ebx: 16910336 registers.esi: 0 registers.ecx: 3405691582	1	0	0
__exception__ Nov. 1, 2021, 2:12 p.m.	stacktrace: _JVM_SetVmMemoryPressure@4-0x128cd jvm+0x7273 @ 0x73d17273 _JVM_SetVmMemoryPressure@4-0x1285c jvm+0x72e4 @ 0x73d172e4 JVM_GetThreadStateNames+0x4edb5 _JVM_EnqueueOperation@20-0x5fefb jvm+0x15c965 @ 0x73e6c965 JVM_GetThreadStateNames+0x4f147 _JVM_EnqueueOperation@20-0x5fb69 jvm+0x15ccf7 @ 0x73e6ccf7 JVM_GetThreadStateNames+0x6fb3f _JVM_EnqueueOperation@20-0x3f171 jvm+0x17d6ef @ 0x73e8d6ef JVM_GetThreadStateNames+0x70098 _JVM_EnqueueOperation@20-0x3ec18 jvm+0x17dc48 @ 0x73e8dc48 JVM_GetThreadStateNames+0x708fa _JVM_EnqueueOperation@20-0x3e3b6 jvm+0x17e4aa @ 0x73e8e4aa _JVM_FindSignal@4+0x5b46 ??_7DCmdFactory@@6B@-0x1011ee jvm+0x1c2ec6 @ 0x73ed2ec6 _endthreadex+0x3a _beginthreadex-0xab msvcr100+0x5c556 @ 0x7413c556 _endthreadex+0xe4 _beginthreadex-0x1 msvcr100+0x5c600 @ 0x7413c600 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5 exception.instruction_r: c7 04 08 01 00 00 00 5d c3 cc cc 83 3d 68 80 09 exception.instruction: mov dword ptr [eax + ecx], 1 exception.exception_code: 0xc0000005 exception.symbol: _JVM_SetVmMemoryPressure@4-0x1293b jvm+0x7205 exception.address: 0x73d17205 registers.esp: 363526232 registers.edi: 10985200 registers.eax: 1408 registers.ebp: 363526232 registers.edx: 1946203604 registers.ebx: 11 registers.esi: 10300416 registers.ecx: 11010048	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

Nov. 1, 2021, 2:12 p.m.

stacktrace:

exception.instruction_r: 8b 06 8d b5 f8 00 00 00 c5 fe 7f 06 c5 fe 7f 7e
exception.instruction: mov eax, dword ptr [esi]
exception.exception_code: 0xc0000005
exception.symbol:
exception.address: 0x2630202
registers.esp: 12908048
registers.edi: 1
registers.eax: 6
registers.ebp: 1946801344
registers.edx: 0
registers.ebx: 16910336
registers.esi: 0
registers.ecx: 3405691582

__exception__

Nov. 1, 2021, 2:12 p.m.

stacktrace:

_JVM_SetVmMemoryPressure@4-0x128cd jvm+0x7273 @ 0x73d17273
_JVM_SetVmMemoryPressure@4-0x1285c jvm+0x72e4 @ 0x73d172e4
JVM_GetThreadStateNames+0x4edb5 _JVM_EnqueueOperation@20-0x5fefb jvm+0x15c965 @ 0x73e6c965
JVM_GetThreadStateNames+0x4f147 _JVM_EnqueueOperation@20-0x5fb69 jvm+0x15ccf7 @ 0x73e6ccf7
JVM_GetThreadStateNames+0x6fb3f _JVM_EnqueueOperation@20-0x3f171 jvm+0x17d6ef @ 0x73e8d6ef
JVM_GetThreadStateNames+0x70098 _JVM_EnqueueOperation@20-0x3ec18 jvm+0x17dc48 @ 0x73e8dc48
JVM_GetThreadStateNames+0x708fa _JVM_EnqueueOperation@20-0x3e3b6 jvm+0x17e4aa @ 0x73e8e4aa
_JVM_FindSignal@4+0x5b46 ??_7DCmdFactory@@6B@-0x1011ee jvm+0x1c2ec6 @ 0x73ed2ec6
_endthreadex+0x3a _beginthreadex-0xab msvcr100+0x5c556 @ 0x7413c556
_endthreadex+0xe4 _beginthreadex-0x1 msvcr100+0x5c600 @ 0x7413c600
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x763733ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x77579ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x77579ea5

exception.instruction_r: c7 04 08 01 00 00 00 5d c3 cc cc 83 3d 68 80 09
exception.instruction: mov dword ptr [eax + ecx], 1
exception.exception_code: 0xc0000005
exception.symbol: _JVM_SetVmMemoryPressure@4-0x1293b jvm+0x7205
exception.address: 0x73d17205
registers.esp: 363526232
registers.edi: 10985200
registers.eax: 1408
registers.ebp: 363526232
registers.edx: 1946203604
registers.ebx: 11
registers.esi: 10300416
registers.ecx: 11010048

Allocates read-write-execute memory (usually to unpack itself) (18 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 163840 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02630000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02658000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02668000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02670000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02678000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02680000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02688000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02690000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02698000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026a8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026b8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d0000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 32768 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x026d8000 process_handle: 0xffffffff	1

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 1, 2021, 2:12 p.m.	process_identifier: 2424 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 65536 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x16200000 process_handle: 0xffffffff	1	0	0

File has been identified by 19 AntiVirus engines on VirusTotal as malicious (19 events)

Lionic	Trojan.AndroidOS.Jocker.C!c
CAT-QuickHeal	Android.Jocker.GEN43293
McAfee	Artemis!D703F9D11DC6
Alibaba	Trojan:Android/Jocker.928220dd
K7GW	Trojan ( 00570c961 )
SymantecMobileInsight	AppRisk:Generisk
Symantec	Trojan.Gen.NPE
ESET-NOD32	a variant of Android/Agent.CBG
Kaspersky	HEUR:Trojan.AndroidOS.Jocker.fb
Tencent	Dos.Trojan.Jocker.Ajlm
DrWeb	Android.Joker.207.origin
McAfee-GW-Edition	Artemis!Trojan
Jiangmin	Trojan.AndroidOS.iooo
Avira	ANDROID/Joker.IBEX.Gen
Microsoft	Program:Win32/Uwamson.A!ml
Cynet	Malicious (score: 99)
Ikarus	Trojan-Spy.AndroidOS.Joker
MaxSecure	Trojan.SMS.AndroidOS.Agent.a3
Fortinet	Android/Agent.CBG!tr

adal.jar

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All