Report - InvoiceP038455.jar

ScreenShot
Created 2021.07.02 18:13 Machine s1_win7_x6402
Filename InvoiceP038455.jar
Type Zip archive data, at least v2.0 to extract
AI Score Not founds Behavior Score
2.2
ZERO API file : clean
VT API (file)
md5 3b9807d9332a324f920ca95e2282c082
sha256 5536d8f5600ef53726c59c1027a620fce65ca6176179694bbddba2f52cb09c09
ssdeep 3072:21JQihTDw+IAH+0cyBPO5auK32iCXvev38caxy9jwwyO/NPeEoNx37Ly3TEt:YJQkkXAH+qBPO5auKm3ENkOVPnwvy3T4
imphash
impfuzzy
  Network IP location

Signature (4cnts)

Level Description
danger A potential heapspray has been detected. 878 megabytes was sprayed onto the heap of the java.exe process
watch Communicates with host for which no DNS query was performed
notice Allocates read-write-execute memory (usually to unpack itself)
info Checks amount of memory in system

Rules (0cnts)

Level Name Description Collection

Network (10cnts) ?

Request CC ASN Co IP4 Rule ? ZERO ?
aus.thunderbird.net Unknown 54.230.62.19 clean
aus5.mozilla.org US GOOGLE 35.244.181.201 clean
d2js2viceajwla.cloudfront.net Unknown 54.230.62.19 clean
prod.balrog.prod.cloudops.mozgcp.net US GOOGLE 35.244.181.201 clean
99.86.144.61 US AMAZON-02 99.86.144.61 clean
99.86.202.125 US AMAZON-02 99.86.202.125 clean
99.86.144.100 US AMAZON-02 99.86.144.100 clean
35.244.181.201 US GOOGLE 35.244.181.201 clean
99.86.144.82 US AMAZON-02 99.86.144.82 clean
99.86.144.46 US AMAZON-02 99.86.144.46 clean

Suricata ids



Similarity measure (PE file only) - Checking for service failure