448524fd62dec1151c75b55b86587784
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2009-Sep-14 15:28:07 |
| Detected languages |
English - United States
Russian - Russia |
| CompanyName | Microsoft Corporation |
| FileDescription | Java Virtual Mashine |
| FileVersion | 5.00.3805.0000 |
| InternalName | MSJAVAVM |
| LegalCopyright | Copyright (C) Microsoft Corp. 1997-2000. |
| OriginalFilename | MsJavaVM.dll |
| ProductName | Microsoft(R) Windows (R) Operating System |
| ProductVersion | 5.00.3805.0000 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 DLL (Debug)
Microsoft Visual C++ 6.0 - 8.0 Microsoft Visual C++ Microsoft Visual C++ v6.0 |
| Suspicious | PEiD Signature: | HQR data file |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
May have dropper capabilities:
|
| Suspicious | The PE contains functions most legitimate programs don't use. |
[!] The program may be hiding some of its imports:
|
| Malicious | VirusTotal score: 52/67 (Scanned on 2021-11-08 09:23:45) |
Elastic:
malicious (high confidence)
DrWeb: Win32.HLLW.Autoruner.35241 MicroWorld-eScan: Gen:Variant.Doina.8448 FireEye: Generic.mg.448524fd62dec115 ALYac: Backdoor.Turla.A Cylance: Unsafe Zillya: Worm.AutoRun.Win32.6053 Sangfor: Worm.Win32.Autorun.giqh K7AntiVirus: P2PWorm ( 004ca5911 ) Alibaba: Worm:Win32/Autorun.dfa423b6 K7GW: P2PWorm ( 004ca5911 ) CrowdStrike: win/malicious_confidence_90% (W) BitDefenderTheta: Gen:NN.ZedlaF.34266.lu8@aSFuPYoc Cyren: W32/AutoRun.M.gen!Eldorado ESET-NOD32: Win32/AutoRun.ADR APEX: Malicious Paloalto: generic.ml ClamAV: Win.Worm.Autorun-376 Kaspersky: HEUR:Trojan.Win32.Generic BitDefender: Gen:Variant.Doina.8448 NANO-Antivirus: Trojan.Win32.AutoRun.crptlv Avast: Win32:Turla-F [Trj] Tencent: Win32.Worm.Autorun.Pciv Ad-Aware: Gen:Variant.Doina.8448 Sophos: W32/Autorun-ZB Comodo: Worm.Win32.Autorun.DAA@4l3wiy VIPRE: Worm.Win32.AutoRun TrendMicro: WORM_OTORUN.SML McAfee-GW-Edition: W32/Autorun.worm.mq Emsisoft: Gen:Variant.Doina.8448 (B) GData: Win32.Rootkit.Uroburos.C Jiangmin: Worm/AutoRun.mit Webroot: Trojan:Win32/Remdruk.A Avira: WORM/Autorun.giqh MAX: malware (ai score=100) Antiy-AVL: Trojan/Generic.ASMalwS.896B49 Kingsoft: Win32.Troj.Undef.(kcloud) ViRobot: Worm.Win32.Autorun.185344.E Microsoft: Worm:Win32/Autorun.JE Cynet: Malicious (score: 99) AhnLab-V3: Worm/Win32.AutoRun.R1836 McAfee: W32/Autorun.worm.mq TACHYON: Worm/W32.AutoRun.185344 VBA32: BScope.Trojan-Dropper.Injector Malwarebytes: Malware.AI.909372737 TrendMicro-HouseCall: WORM_OTORUN.SML Rising: Backdoor.[Turla]ComRAT!1.C333 (CLASSIC) Yandex: Worm.Autorun.Gen.24 Ikarus: Worm.Win32.AutoRun eGambit: Unsafe.AI_Score_99% Fortinet: W32/AutoRun.BDJ!tr AVG: Win32:Turla-F [Trj] |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0xf8 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 5 |
| TimeDateStamp | 2009-Sep-14 15:28:07 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 6.0 |
| SizeOfCode | 0x23600 |
| SizeOfInitializedData | 0xc600 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0001B41A (Section: .text) |
| BaseOfCode | 0x1000 |
| BaseOfData | 0x25000 |
| ImageBase | 0x10000000 |
| SectionAlignment | 0x1000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 4.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x33000 |
| SizeOfHeaders | 0x400 |
| Checksum | 0 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rdata
.data
.rsrc
.reloc
Imports
| KERNEL32.dll |
FindNextFileA
DeleteFileA FindFirstFileA GetTempFileNameA GetTempPathA FreeLibrary GetProcAddress LoadLibraryA UnmapViewOfFile GetLastError MapViewOfFile CreateFileMappingA GetFileSize lstrcmpA SetLastError SetFileAttributesA OpenEventA WriteFile CopyFileA Sleep GetVolumeInformationA GetDriveTypeA ExitProcess SetFilePointer ReadFile GetModuleHandleA GetModuleFileNameA CreateProcessA GetSystemTime GetSystemDirectoryA SetFileTime lstrcatA GetLocalTime GetPrivateProfileStringA GetTempPathW FindClose GetEnvironmentVariableW GetComputerNameW GetTimeZoneInformation MultiByteToWideChar lstrcatW lstrlenW GetVersionExA GetComputerNameA lstrcpyA GetTickCount FileTimeToSystemTime GetWindowsDirectoryA GetEnvironmentVariableA TerminateProcess WaitForSingleObject CreateDirectoryA CreateMutexA ReleaseMutex OutputDebugStringA GetFileTime GetDiskFreeSpaceExA GetDiskFreeSpaceA SetEnvironmentVariableA CompareStringW CompareStringA GetStringTypeW GetStringTypeA CreateFileA lstrlenA GetFileInformationByHandle CloseHandle FileTimeToLocalFileTime FileTimeToDosDateTime GetFileAttributesA GetWindowsDirectoryW IsBadCodePtr IsBadReadPtr GetOEMCP GetACP GetCPInfo GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA HeapAlloc HeapFree GetFileType EnterCriticalSection LeaveCriticalSection RaiseException RtlUnwind ResumeThread CreateThread TlsSetValue TlsGetValue ExitThread InterlockedDecrement InterlockedIncrement GetCommandLineA GetVersion GetCurrentProcess HeapReAlloc HeapSize HeapDestroy HeapCreate VirtualFree VirtualAlloc IsBadWritePtr InitializeCriticalSection DeleteCriticalSection GetCurrentThreadId TlsAlloc TlsFree SetStdHandle SetEndOfFile SetHandleCount GetStdHandle GetStartupInfoA FlushFileBuffers SetUnhandledExceptionFilter UnhandledExceptionFilter WideCharToMultiByte LCMapStringA LCMapStringW |
|---|---|
| USER32.dll |
DefWindowProcA
wsprintfA RegisterClassExA CreateWindowExA SendMessageA CharLowerBuffA wsprintfW GetMessageA TranslateMessage DispatchMessageA |
| ADVAPI32.dll |
RegEnumValueA
RegDeleteValueA RegCreateKeyA RegQueryValueExA RegSetValueExA RegCreateKeyExA RegCloseKey |
| RPCRT4.dll |
UuidToStringA
UuidCreate RpcStringFreeA |
| WS2_32.dll |
inet_ntoa
gethostbyname WSAStartup WSACleanup |
Delayed Imports
Entry
| Ordinal | 1 |
|---|---|
| Address | 0x4010 |
AddAtomT
| Ordinal | 2 |
|---|---|
| Address | 0x4070 |
AddAtomS
| Ordinal | 3 |
|---|---|
| Address | 0x4340 |
102
1
2
103
104
1 (#2)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 5.0.3805.0 |
| ProductVersion | 1.0.0.1 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT
VOS_NT_WINDOWS32
VOS_WINCE
VOS__WINDOWS32
|
| FileType |
VFT_DLL
|
| Language | English - United States |
| CompanyName | Microsoft Corporation |
| FileDescription | Java Virtual Mashine |
| FileVersion (#2) | 5.00.3805.0000 |
| InternalName | MSJAVAVM |
| LegalCopyright | Copyright (C) Microsoft Corp. 1997-2000. |
| OriginalFilename | MsJavaVM.dll |
| ProductName | Microsoft(R) Windows (R) Operating System |
| ProductVersion (#2) | 5.00.3805.0000 |
| Resource LangID | Russian - Russia |
|---|
TLS Callbacks
Load Configuration
RICH Header
| XOR Key | 0x92def87d |
|---|---|
| Unmarked objects | 0 |
| C++ objects (8047) | 1 |
| 12 (7291) | 3 |
| C objects (VS98 SP6 build 8804) | 122 |
| 14 (7299) | 24 |
| Imports (2179) | 11 |
| Total imports | 153 |
| C++ objects (VS98 SP6 build 8804) | 21 |
| Resource objects (VS98 SP6 cvtres build 1736) | 1 |
| Linker (VC++ 6.0 SP5 imp/exp build 8447) | 1 |