Favorites
Tools
Dr.Zero Chatbot
Notifications
Guide 2020-06-10
Version history 2020-06-10

Summary | ZeroBOX

10.11.2023_SIPARIS_LISTESI.PDF.jar

ZIP Format

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Nov. 11, 2023, 4:13 p.m.	Nov. 11, 2023, 4:18 p.m.

Size	227.0KB
Type	Java archive data (JAR)
MD5	`36e1f972423dcb93ee5308ae5f956612`
SHA256	`9d8de44cbfe1a44c0541eaf04efb9a81368f629daf558874d78d4a82ce2b0e1a`
CRC32	`C02976E3`
ssdeep	`6144:BH3EYQ6EK7YBjAJhZ3JfMEg5F7uEJekvres27HLV2t0CkQ:1Q6E6qjsPpgKE7vrexHQZb`
Yara	zip_file_format - ZIP file format

java.exe "C:\Program Files\Java\jre7\bin\java.exe" -jar C:\Users\test22\AppData\Local\Temp\10.11.2023_SIPARIS_LISTESI.PDF.jar
2640

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Nov. 11, 2023, 4:06 p.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Nov. 11, 2023, 4:06 p.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 2555904 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002530000 process_handle: 0xffffffffffffffff	1	0	0

A potential heapspray has been detected. 726 megabytes was sprayed onto the heap of the java.exe process (1 event)

count

2907

name

heapspray

process

java.exe

total_mb

726

length

262144

protection

PAGE_READWRITE