Windows Analysis Report
Apache ActiveMQ.exe

Overview

General Information

Sample name: Apache ActiveMQ.exe
Analysis ID: 1448271
MD5: b8932033b53ca08967100c58e12126be
SHA1: 6f30131181d81129c2f59d050214f47a6eedabbe
SHA256: 07fe71b256c1c913b0f3e3fa67e53d21a3d1f499beb4e550597f5743797a77c4
Tags: exe
Infos:

Detection

Score: 68
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Machine Learning detection for sample
Detected potential crypto function
PE file contains sections with non-standard names

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: Apache ActiveMQ.exe Avira: detected
Multi AV Scanner detection for domain / URL
Source: mvs05.zyns.com Virustotal: Detection: 5% Perma Link
Multi AV Scanner detection for submitted file
Source: Apache ActiveMQ.exe ReversingLabs: Detection: 47%
Source: Apache ActiveMQ.exe Virustotal: Detection: 53% Perma Link
Machine Learning detection for sample
Source: Apache ActiveMQ.exe Joe Sandbox ML: detected
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: mvs05.zyns.com
Detected potential crypto function
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Code function: 0_2_00401000 0_2_00401000
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Code function: 0_2_00402D30 0_2_00402D30
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Code function: 0_2_00402EB0 0_2_00402EB0
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Code function: 0_2_00402560 0_2_00402560
Source: classification engine Classification label: mal68.winEXE@1/0@1/0
Source: Apache ActiveMQ.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_ALIGN_1BYTES, IMAGE_SCN_ALIGN_4BYTES, IMAGE_SCN_ALIGN_8BYTES, IMAGE_SCN_ALIGN_16BYTES, IMAGE_SCN_ALIGN_32BYTES, IMAGE_SCN_ALIGN_64BYTES, IMAGE_SCN_ALIGN_256BYTES, IMAGE_SCN_ALIGN_1024BYTES, IMAGE_SCN_ALIGN_2048BYTES, IMAGE_SCN_ALIGN_4096BYTES, IMAGE_SCN_ALIGN_8192BYTES, IMAGE_SCN_ALIGN_MASK, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: Apache ActiveMQ.exe ReversingLabs: Detection: 47%
Source: Apache ActiveMQ.exe Virustotal: Detection: 53%
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: napinsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: pnrpnsp.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: wshbth.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: nlaapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: winrnr.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe Section loaded: rasadhlp.dll Jump to behavior
PE file contains sections with non-standard names
Source: Apache ActiveMQ.exe Static PE information: section name: .xdata
Source: Apache ActiveMQ.exe, 00000000.00000002.1339157211.0000000000813000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\Apache ActiveMQ.exe API call chain: ExitProcess graph end node
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1448271 Sample: Apache ActiveMQ.exe Startdate: 28/05/2024 Architecture: WINDOWS Score: 68 8 mvs05.zyns.com 2->8 10 Multi AV Scanner detection for domain / URL 2->10 12 Antivirus / Scanner detection for submitted sample 2->12 14 Multi AV Scanner detection for submitted file 2->14 16 Machine Learning detection for sample 2->16 6 Apache ActiveMQ.exe 2->6         started        signatures3 process4
⊘No contacted IP infos

Contacted Domains

Name IP Active
mvs05.zyns.com 81.19.82.2 true