Create Interactive TourWindows Analysis Report jxplorer-3.3.1.2-windows-installer.exe
Overview
General Information
| Sample Name: | jxplorer-3.3.1.2-windows-installer.exe |
| Analysis ID: | 512641 |
| MD5: | c23a27b06281cfa93641fdbb611c33ff |
| SHA1: | cac02ab7f94320ff7168ac30ca4da44df649dfa9 |
| SHA256: | c1fe14a60bc6aa909ea8c1d5f09eb7426722bdd90634b451c12d1a32d10ff67b |
| Infos: | |
Most interesting Screenshot:  | |
Detection
| Score: | 9 |
| Range: | 0 - 100 |
| Whitelisted: | false |
| Confidence: | 60% |
Signatures
Uses 32bit PE files
Queries information about the installed CPU (vendor, model number etc)
Queries the volume information (name, serial number etc) of a device
Antivirus or Machine Learning detection for unpacked file
Sample file is different than original file name gathered from version info
PE file contains strange resources
Drops PE files
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
PE file contains sections with non-standard names
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Queries time zone information
Contains functionality to call native functions
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Found dropped PE file which has not been started or loaded
Creates a process in suspended mode (likely to inject code)
Contains functionality for read data from the clipboard
Classification
Analysis Advice |
|---|
| Sample drops PE files which have not been started, submit dropped PE samples for a secondary analysis to Joe Sandbox |
| Sample may offer command line options, please run it with the 'Execute binary with arguments' cookbook (it's possible that the command line switches require additional characters like: "-", "/", "--") |
|
Malware Configuration |
|---|
| No configs have been found |
|---|
Yara Overview |
|---|
| No yara matches |
|---|
Sigma Overview |
|---|
| No Sigma rule has matched |
|---|
Jbx Signature Overview |
|---|
- • AV Detection
- • Compliance
- • Networking
- • Key, Mouse, Clipboard, Microphone and Screen Capturing
- • System Summary
- • Data Obfuscation
- • Persistence and Installation Behavior
- • Hooking and other Techniques for Hiding and Protection
- • Malware Analysis System Evasion
- • Anti Debugging
- • HIPS / PFW / Operating System Protection Evasion
- • Language, Device and Operating System Detection
Click to jump to signature section
Show All Signature Results
There are no malicious signatures, click here to show all signatures.
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Avira: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Code function: | 0_2_004351EC | |
| Source: | Static PE information: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_004700F4 | |
| Source: | Code function: | 0_2_0041832C | |
| Source: | Static PE information: | ||
| Source: | File read: | Jump to behavior | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | |||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Joe Sandbox Cloud Basic: | Perma Link | ||
| Source: | Mutant created: | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Section loaded: | Jump to behavior | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | String found in binary or memory: | ||
| Source: | Classification label: | ||
| Source: | Key opened: | Jump to behavior | ||
| Source: | Window detected: | ||
| Source: | Static file information: | ||
| Source: | File opened: | Jump to behavior | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Binary string: | ||
| Source: | Code function: | 0_3_028CB635 | |
| Source: | Code function: | 0_2_004FD28E | |
| Source: | Code function: | 0_2_004FD29B | |
| Source: | Code function: | 2_2_0300BB4D | |
| Source: | Code function: | 2_2_0300B39D | |
| Source: | Code function: | 2_2_0300B92D | |
| Source: | Code function: | 2_2_0300A1DA | |
| Source: | Code function: | 2_2_0300A1E5 | |
| Source: | Code function: | 2_2_03012D45 | |
| Source: | Code function: | 2_2_0300C45D | |
| Source: | Code function: | 6_2_023FBB4D | |
| Source: | Code function: | 6_2_023FB39D | |
| Source: | Code function: | 6_2_023FB92D | |
| Source: | Code function: | 6_2_023FA1E5 | |
| Source: | Code function: | 6_2_023FA1DA | |
| Source: | Code function: | 6_2_023FC45D | |
| Source: | Code function: | 6_2_02402D45 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | Code function: | 0_2_00418B54 | |
| Source: | Static PE information: | ||
| Source: | Static PE information: | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to dropped file | ||
| Source: | File created: | Jump to behavior | ||
| Source: | Process created: | ||
| Source: | Code function: | 0_2_00417DBC | |
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Dropped PE file which has not been started: | Jump to dropped file | ||
| Source: | Code function: | 0_2_004FD418 | |
| Source: | API call chain: | graph_0-8423 | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Code function: | 0_2_00418B54 | |
| Source: | Code function: | 0_2_00401020 | |
| Source: | Memory protected: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Process created: | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Registry key value queried: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Queries volume information: | Jump to behavior | ||
| Source: | Code function: | 2_2_03000380 | |
| Source: | Key value queried: | Jump to behavior | ||
| Source: | Code function: | 0_2_004FD418 | |
Mitre Att&ck Matrix |
|---|
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Credential Access | Discovery | Lateral Movement | Collection | Exfiltration | Command and Control | Network Effects | Remote Service Effects | Impact |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Valid Accounts | Command and Scripting Interpreter2 | Services File Permissions Weakness1 | Process Injection12 | Disable or Modify Tools1 | OS Credential Dumping | System Time Discovery1 | Remote Services | Archive Collected Data1 | Exfiltration Over Other Network Medium | Encrypted Channel1 | Eavesdrop on Insecure Network Communication | Remotely Track Device Without Authorization | Modify System Partition |
| Default Accounts | Native API1 | Boot or Logon Initialization Scripts | Services File Permissions Weakness1 | Process Injection12 | LSASS Memory | Security Software Discovery1 | Remote Desktop Protocol | Clipboard Data1 | Exfiltration Over Bluetooth | Junk Data | Exploit SS7 to Redirect Phone Calls/SMS | Remotely Wipe Data Without Authorization | Device Lockout |
| Domain Accounts | At (Linux) | Logon Script (Windows) | Logon Script (Windows) | Obfuscated Files or Information11 | Security Account Manager | Process Discovery1 | SMB/Windows Admin Shares | Data from Network Shared Drive | Automated Exfiltration | Steganography | Exploit SS7 to Track Device Location | Obtain Device Cloud Backups | Delete Device Data |
| Local Accounts | At (Windows) | Logon Script (Mac) | Logon Script (Mac) | Services File Permissions Weakness1 | NTDS | Application Window Discovery1 | Distributed Component Object Model | Input Capture | Scheduled Transfer | Protocol Impersonation | SIM Card Swap | Carrier Billing Fraud | |
| Cloud Accounts | Cron | Network Logon Script | Network Logon Script | Software Packing21 | LSA Secrets | System Information Discovery34 | SSH | Keylogging | Data Transfer Size Limits | Fallback Channels | Manipulate Device Communication | Manipulate App Store Rankings or Ratings |
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
InternetThumbnails
This section contains all screenshots as thumbnails, including those not shown in the slideshow.
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 1% | Virustotal | Browse | ||
| 5% | Metadefender | Browse | ||
| 2% | ReversingLabs |
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Metadefender | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Metadefender | Browse | ||
| 0% | ReversingLabs | |||
| 0% | Metadefender | Browse | ||
| 0% | ReversingLabs |
| Source | Detection | Scanner | Label | Link | Download |
|---|---|---|---|---|---|
| 100% | Avira | TR/Patched.Ren.Gen | Download File | ||
| 100% | Avira | TR/Crypt.XPACK.Gen | Download File | ||
| 100% | Avira | TR/Crypt.XPACK.Gen | Download File | ||
| 100% | Avira | TR/Crypt.XPACK.Gen2 | Download File | ||
| 100% | Avira | TR/Patched.Ren.Gen | Download File |
| No Antivirus matches |
|---|
| Source | Detection | Scanner | Label | Link |
|---|---|---|---|---|
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | URL Reputation | safe | ||
| 0% | Virustotal | Browse | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe | ||
| 0% | Avira URL Cloud | safe |
| No contacted domains info |
|---|
| Name | Source | Malicious | Antivirus Detection | Reputation |
|---|---|---|---|---|
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false |
| unknown | ||
| false | high | |||
| false | high | |||
| false | high | |||
| false | high | |||
| false |
| unknown | ||
| false |
| unknown | ||
| false |
| unknown |
| No contacted IP infos |
|---|
General Information |
|---|
| Joe Sandbox Version: | 34.0.0 Boulder Opal |
| Analysis ID: | 512641 |
| Start date: | 01.11.2021 |
| Start time: | 09:34:42 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 8m 30s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Sample file name: | jxplorer-3.3.1.2-windows-installer.exe |
| Cookbook file name: | default.jbs |
| Analysis system description: | Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211 |
| Number of analysed new started processes analysed: | 22 |
| Number of new started drivers analysed: | 0 |
| Number of existing processes analysed: | 0 |
| Number of existing drivers analysed: | 0 |
| Number of injected processes analysed: | 0 |
| Technologies: |
|
| Analysis Mode: | default |
| Analysis stop reason: | Timeout |
| Detection: | CLEAN |
| Classification: | clean9.winEXE@12/18@0/0 |
| EGA Information: |
|
| HDC Information: | Failed |
| HCA Information: | Failed |
| Cookbook Comments: |
|
| Warnings: | Show All
|
| No simulations |
|---|
| No context |
|---|
| No context |
|---|
| No context |
|---|
| No context |
|---|
| Match | Associated Sample Name / URL | SHA 256 | Detection | Link | Context |
|---|---|---|---|---|---|
| C:\Users\user\AppData\Local\Temp\BR2C62.tmp | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| C:\Users\user\AppData\Local\Temp\BR2A3D.tmp | Get hash | malicious | Browse | ||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse | |||
| Get hash | malicious | Browse |
| Process: | C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 57 |
| Entropy (8bit): | 4.841147470077358 |
| Encrypted: | false |
| SSDEEP: | 3:oFj4I5vpN6yUaHTQBlv:oJ5X6yVQBlv |
| MD5: | 491BFC1D50E8452C2A6DF24E4D76EB5A |
| SHA1: | 4070BDE3F5F41C1DC56C277F469DE6213CD3F16F |
| SHA-256: | 3C1896F2B4E72601C78D11CE91D4AEDDF8A4E6288F9FBC4B6AFFEBB754F5CBF5 |
| SHA-512: | 71DE50A17FC4C0B09CDA6A378E090D3C9DD4192D295FD6CA7D1247858F12D127534830853444394473CA59D1E3A65B14949CBFF9BBF5726D3D4C2E2671531290 |
| Malicious: | false |
| Reputation: | low |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 42370 |
| Entropy (8bit): | 5.0466136277802285 |
| Encrypted: | false |
| SSDEEP: | 768:bYhR8FateHZi03f9DsC429HqL9kChZYWz2CsPkr1wVXggpBOxSe2zt:bYice5iOf9DsC4WHqKRkr1wppBMSe0t |
| MD5: | 98E531FFD84600DD27E8BC4A83DCDD5E |
| SHA1: | 6B7403D6E903CFBD0B5F2C1BDAE16DE1EAB638C7 |
| SHA-256: | 09DD23B63F9FE79D039E43F274B5AEB9DF01A816DEFC8C503531E1B3643921A3 |
| SHA-512: | E8523077549E79045C02882307654D21CADF334098B878C976C960BA86E323CFFDD678713E3084CCB31AC21158CF542187733767F28CC130665962AFD13D4A7A |
| Malicious: | false |
| Antivirus: |
|
| Reputation: | low |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 36633 |
| Entropy (8bit): | 5.172153856265245 |
| Encrypted: | false |
| SSDEEP: | 384:i760QouLg/TgeoyZQ82FXRivC4yPTyNeOnEOqjLtKjIUZuVnrufvS0QOwOP2H:pxR1u9CpKVZuFBNOeH |
| MD5: | 08AD4CD2A940379F1DCDBDB9884A1375 |
| SHA1: | C302B7589BA4F05C6429E7F89AD0CB84DD9DFBAC |
| SHA-256: | 78827E2B1EF0AAD4F8B1B42D0964064819AA22BFCD537EBAACB30D817EDC06D8 |
| SHA-512: | F37BD071994C31B361090A149999E8B2D4A7839F19EA63E1D4563AADA1371BE37F2BFCC474E24DE95FF77CA4124A39580C9F711E2FBE54265713AB76F631835A |
| Malicious: | false |
| Antivirus: |
|
| Joe Sandbox View: |
|
| Reputation: | moderate, very likely benign file |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 112558 |
| Entropy (8bit): | 5.941177762717291 |
| Encrypted: | false |
| SSDEEP: | 1536:vbn96+fgEQxtYuuDFYe4gg2ReJAkz2omuU4LCPkYLsdFEclGqKONtlD+:D9NgEQnYuscgjeJAkBCvLsEQ/HlD+ |
| MD5: | D33EE6D856350F321189138134745388 |
| SHA1: | E20A69863AE3A63A5C812D80BC7766C54CBB0689 |
| SHA-256: | 9EB5405449BE0D43FEE145B5B6D5FE01799C6F635389A44F58A0AF2793A1B737 |
| SHA-512: | 133A382CE27408CB993E8DCDCBD65737C99C093DD632580B47CA08A3C0198699FA27BBD0A20CFBA572B1B2F8FA3840F1309DC6B8CEBE0B1A15885E0030201FEF |
| Malicious: | false |
| Antivirus: |
|
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 409600 |
| Entropy (8bit): | 6.4807474467356245 |
| Encrypted: | false |
| SSDEEP: | 6144:qZW3ZkG4zErXGmWkaHf77ym+fs7EWdRx35FFFyFFFFFFc7N+8:qCZFmESn/v9dz35FFFyFFFFFFc48 |
| MD5: | 027491B39A7B16B116E780F55ABC288E |
| SHA1: | 62C0AB7C3E374D5FC9920983EE62BAA4421076B4 |
| SHA-256: | EEF69D005BF1C0B715C8D6205400D4755C261DD38DDFBBFE918E6EE91F21F1F0 |
| SHA-512: | FE0BA835D9AF2A2C297A545BB7E30D315B580273BB1F558F16D9CBA59755200A4735F75B1672E5E5FBED449EB7A5ABB6D905696674C181B742BF637028953194 |
| Malicious: | false |
| Joe Sandbox View: |
|
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 51712 |
| Entropy (8bit): | 6.11232673678852 |
| Encrypted: | false |
| SSDEEP: | 768:KUqfg94qXKdv7VzR5CnsW9+oR5gKkizhr2ORzQeOD:PqCev7ZCZ7htRzt |
| MD5: | 72FAB2C90296330ECA3787DC4093E208 |
| SHA1: | 6091F6637EF24E2C4F5AEA348CD9DAE2607B17E8 |
| SHA-256: | 6251F51D616CDCB4256D73A67819A3419E5B59158BE358CF387B90E39C05C260 |
| SHA-512: | 347A54C6D0F4FEFC966B3EE3BCD4387FAA54D4C9D7FB050AC33E26514848CD4F4F5465D5A27F76B14F05F1D8380DA88B798B1EDE2EAB6722972EEF37118EAC0D |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 31232 |
| Entropy (8bit): | 5.970542297862573 |
| Encrypted: | false |
| SSDEEP: | 384:828IV0h6y6b65DRS/47tAF61letKEnQ7UcTNuZLngGDUVizkcZFNZNgB/p9DCn:8txi624hS61EtMUcnCUVoFN/AB |
| MD5: | B226B75915B944BF20F96ADDFD6E4F87 |
| SHA1: | D1E745996FFD68C6AE91C2AC2C65B2D77BFD0EAB |
| SHA-256: | 91910BF7A630D272D5389AA6DAFC4E71F32298731B4F44D39B6A0B0D34BD1A3B |
| SHA-512: | 4913D11666057269249880668C92EC7D28788E3041BC18B6A9F72F94E2CA375464ADA6242DE694159E4EA99CCE934B01A981F60171E7A739607BB9DF6D07421B |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 61685 |
| Entropy (8bit): | 5.767404399067206 |
| Encrypted: | false |
| SSDEEP: | 768:3wsnWORQW1x0waiE/h3QBG14+raAQD2ZW1YRC9gfMFfdKnoOWO:37DRrxcF2S4+WH1WhMFfgoK |
| MD5: | FA89B48BF972FEF2F26C24A5C1BD1689 |
| SHA1: | 2777FB16B37609C6EFC27ACCD1DD855A11FF4F5E |
| SHA-256: | 6E5348CBCE980777D8E9827B57A90BE829F94884C9F96395807BABDB9B445756 |
| SHA-512: | 1C88F8F0EC311756C1AC3A6F72725F656A74630C97AE6A2DB02728B236EC0E8A8A3E524BF76E99E6F15AD52855C05CE0F238DE0C4350DA0F5EF00FA561A2D6C0 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 24576 |
| Entropy (8bit): | 2.1110182606763486 |
| Encrypted: | false |
| SSDEEP: | 96:3OeQrkZUMQl0sLw1pljKegUlelUEYP2OaSOdOfDUj5y2RUI32IyyymvNTB:bQAlQl/UzjBPleOE5VoUjVRUKJyo |
| MD5: | 4CF27E0747E5719A5478AA2624F6B996 |
| SHA1: | 13DF901E34F77E5EA11F36C0AFEDDA7F86A2C003 |
| SHA-256: | E69A9D06F2C17CC021EBF9B62CA110548FACDC147B67DEA4846E09865043D2D9 |
| SHA-512: | 4B0DDCBD7321128F977E1DBBE18CC76C7E489D4EE84B7775989E99778B5A60DAA683C6063C5B700794B7F2070AE381FEF20B19B3CB35C1BABEF9BE79FF264941 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 24576 |
| Entropy (8bit): | 2.233559660511395 |
| Encrypted: | false |
| SSDEEP: | 192:w6Aw4G01nltNu1qqSyjjc1Pcrhve+fAzsI:w6Awe1ltUv3c1AveKAzs |
| MD5: | 124E89D0FCC409EDE3595A253B788708 |
| SHA1: | BC88E037C3EDEA02DD20AEFF10818105BE9F4033 |
| SHA-256: | 27EA1B57A3024AEC4A03188E80FDB2AA301FA5179C19BE9C8B0DFC2AAC73A114 |
| SHA-512: | 7CD0CA268A5DBD2AA22DBCE1F253A2D067CA30C5195E059C3F431D546A20D1811592F8BD8FE88B6AD9CB5C6FDD6A4666FF451B84A5E790A9D5058865D48790B1 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 102400 |
| Entropy (8bit): | 6.032443659163402 |
| Encrypted: | false |
| SSDEEP: | 1536:RgeYsGOAkT1xZXRyrjGA9KOsZDmwd1/MAjVkZJEJ6PZ2:WBVw1xHef9amwDMAjUJ0 |
| MD5: | 606F13D4D580B1F322B3F3D3DF423BBA |
| SHA1: | 02CB375E13B415EDC8B5360DFFDBA531E47827ED |
| SHA-256: | C71A16B1056E522CD0365449448116D06F37A3273D77694D170340064511DD25 |
| SHA-512: | 867A45DC15E99148F24FC528FBC9255582E5534BB4696700292B70163FDDB15F35DDF2ACD0536A9CD78B4D8F9D827BF7530D2303BFD7E428F11573B381A0986C |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 57344 |
| Entropy (8bit): | 4.947032837109441 |
| Encrypted: | false |
| SSDEEP: | 384:AfMFAoyIdlBM2y3yKy8i0s7xxgx9lRD4Pich2vzLfp6kVtWVG80TTqV5axSwHAuz:Af7KBM2vcLlRDYncLfp43HTaxOPxP0 |
| MD5: | 145D5C49FE34A44662BEAFFE641D58C7 |
| SHA1: | 95D5E92523990B614125D66FA3FA395170A73BFE |
| SHA-256: | 59182F092B59A3005ADA6B2F2855C7E860E53E8ADF6E41CD8CD515578AE7815A |
| SHA-512: | 48CB0048F4FCF460E791A5B0BECA40DBF2399B70F1784236B6D1F17835201D70DFA64C498814B872F57E527793C58A5959230FE40DDF5EBDCB0B1DE57E9C53EF |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 95 |
| Entropy (8bit): | 4.413288531422079 |
| Encrypted: | false |
| SSDEEP: | 3:SXKPFaT5WRiGgBWKFiFCnRVLvDAEMVLU//Vy:SuFmWRiGghYFCnHEEMVQVy |
| MD5: | EF54325FD6089991019D42D4D2584AB8 |
| SHA1: | 8FAE15DB21C5C2C06E87EE9CF9EA18C6964D3D24 |
| SHA-256: | 3058165ABF1FF11090812BE06B155DE1CA8BFF3F077F246F18B6D0ECB6FA7905 |
| SHA-512: | D5A257DC2DFED0E434EB2F3581E2AA03CF62736FB5E4EB4EE0E56C2C7EF1B25A1680A3709E051FBE74A2012E1C72663E73F7E5A99B114B0967F5542D95DA2E09 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 149 |
| Entropy (8bit): | 5.0506245895145785 |
| Encrypted: | false |
| SSDEEP: | 3:CEuXWN0Ld4muEHNekOCe3Z8465TEFHgtzasVUaIfKnQvn:CEuX8J/IcCQ16tt+sVfIfKn6n |
| MD5: | 22CA8A72C29F11FF5158A385957E54D2 |
| SHA1: | 3CAA40588EE350F2C8CF89E4B474BAA29A97FAAE |
| SHA-256: | 8E66EAFE2D5A1FFCB41C18C8AAC8DFAFD2DCA5C3349C6E35A6F0D7D0AB411D73 |
| SHA-512: | FE2C6863929762AA77E5F8F13258BDE0038894947E6BB70B6E42E8B7D75850C1F00732D9DF7DB77835BC4563EB03C3ACAC903EEA7071D70130E2D94DFFDBF3EF |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 95 |
| Entropy (8bit): | 4.413288531422079 |
| Encrypted: | false |
| SSDEEP: | 3:SXKPFaT5WRiGgBWKFiFCnRVLvDAEMVLU//Vy:SuFmWRiGghYFCnHEEMVQVy |
| MD5: | EF54325FD6089991019D42D4D2584AB8 |
| SHA1: | 8FAE15DB21C5C2C06E87EE9CF9EA18C6964D3D24 |
| SHA-256: | 3058165ABF1FF11090812BE06B155DE1CA8BFF3F077F246F18B6D0ECB6FA7905 |
| SHA-512: | D5A257DC2DFED0E434EB2F3581E2AA03CF62736FB5E4EB4EE0E56C2C7EF1B25A1680A3709E051FBE74A2012E1C72663E73F7E5A99B114B0967F5542D95DA2E09 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 413276 |
| Entropy (8bit): | 6.543624302377151 |
| Encrypted: | false |
| SSDEEP: | 6144:qy3L0mgDcJ78LbJkOyVWWRT4KyQN5earARhMwZ1iooZfDZJHR9PWll7bt4:zg1BOI6uQNtqioo9D3TKft4 |
| MD5: | A210F1AC135E5331C314CE5F394FB5A5 |
| SHA1: | 355AFC1C61E1F65834472B16A4CA718E61537DC2 |
| SHA-256: | 65B32EA2982078FB9A18E88FEEC238CB76ED2AE6C2BB4DDB0F6A9C4F57B1D62B |
| SHA-512: | E4E70EF75E2F7897837F6772B9A0DCAAF4515D8BE4210B28509F12CDDE9D85BD7BED604AD5A9EE587356971F75E6F79874DBDB974CEC4996262295E255501CF4 |
| Malicious: | false |
| Preview: |
|
| Process: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| File Type: | |
| Category: | dropped |
| Size (bytes): | 150 |
| Entropy (8bit): | 4.625871843481267 |
| Encrypted: | false |
| SSDEEP: | 3:tBkuxX9UuF6U2XJKRLOLJxZGKs1VOXFMOa1yox/0sQGGAK82sBov:42JSJKRLmLGK4VOXFboRTGAK8xov |
| MD5: | D6DCC8B52D774A93E7CDD4B675522704 |
| SHA1: | 0F3D6292875FED6CE2A56E29EB73F430C26F6F84 |
| SHA-256: | 0840BCF92F33446B7E6D2E1FF1C8FF10E740B530E30E9007A9ADC8379C097373 |
| SHA-512: | B99EA924EDFFDCDF73C68356FA82DD9A9B69921834E87C667549C7110F1708D0122238CE6D5C3D30D27120BFFA080852683FE6C3CD87C434DCD5FEF546FDB81D |
| Malicious: | false |
| Preview: |
|
Static File Info |
|---|
General | |
|---|---|
| File type: | |
| Entropy (8bit): | 7.9936248674269565 |
| TrID: |
|
| File name: | jxplorer-3.3.1.2-windows-installer.exe |
| File size: | 7501332 |
| MD5: | c23a27b06281cfa93641fdbb611c33ff |
| SHA1: | cac02ab7f94320ff7168ac30ca4da44df649dfa9 |
| SHA256: | c1fe14a60bc6aa909ea8c1d5f09eb7426722bdd90634b451c12d1a32d10ff67b |
| SHA512: | f7902af4909083ce11ad7f0135a89f60096a4b44079326ec14458f90f8de908e18615e8686c526bbb04be4fdcc70b92e79ac27ba657741f2eeaee3ddffb3b437 |
| SSDEEP: | 196608:p5DOE1MFFH51Cetx3WxgzPp52ce3pYt3XqZ9sYg:p5v1MFFH51CWx3WOzPp5n1Xc4 |
| File Content Preview: | MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....IP..'..............0...0...@..Pq(..P....(...@...........................)............... .....................p.).p.. |
File Icon |
|---|
 | |
| Icon Hash: | f6d3d2f1d7c878b0 |
General | |
|---|---|
| Entrypoint: | 0x687150 |
| Entrypoint Section: | UPX1 |
| Digitally signed: | false |
| Imagebase: | 0x400000 |
| Subsystem: | windows gui |
| Image File Characteristics: | LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, DEBUG_STRIPPED, LINE_NUMS_STRIPPED |
| DLL Characteristics: | |
| Time Stamp: | 0x5049C0C3 [Fri Sep 7 09:39:15 2012 UTC] |
| TLS Callbacks: | 0x687d56 |
| CLR (.Net) Version: | |
| OS Version Major: | 4 |
| OS Version Minor: | 0 |
| File Version Major: | 4 |
| File Version Minor: | 0 |
| Subsystem Version Major: | 4 |
| Subsystem Version Minor: | 0 |
| Import Hash: | f703294ca5098ae27457e58f179b2127 |
| Instruction |
|---|
| pushad |
| mov esi, 005B5015h |
| lea edi, dword ptr [esi-001B4015h] |
| mov dword ptr [edi+0023F4A0h], E8E07FC9h |
| push edi |
| mov ebp, esp |
| lea ebx, dword ptr [esp-00030E80h] |
| xor eax, eax |
| push eax |
| cmp esp, ebx |
| jne 00007FB4ECAB5DCDh |
| inc esi |
| inc esi |
| push ebx |
| push 002856EFh |
| push edi |
| add ebx, 04h |
| push ebx |
| push 000D2139h |
| push esi |
| add ebx, 04h |
| push ebx |
| push eax |
| mov dword ptr [ebx], 00040007h |
| nop |
| nop |
| nop |
| push ebp |
| push edi |
| push esi |
| push ebx |
| sub esp, 7Ch |
| mov edx, dword ptr [esp+00000090h] |
| mov dword ptr [esp+74h], 00000000h |
| mov byte ptr [esp+73h], 00000000h |
| mov ebp, dword ptr [esp+0000009Ch] |
| lea eax, dword ptr [edx+04h] |
| mov dword ptr [esp+78h], eax |
| mov eax, 00000001h |
| movzx ecx, byte ptr [edx+02h] |
| mov ebx, eax |
| shl ebx, cl |
| mov ecx, ebx |
| dec ecx |
| mov dword ptr [esp+6Ch], ecx |
| movzx ecx, byte ptr [edx+01h] |
| shl eax, cl |
| dec eax |
| mov dword ptr [esp+68h], eax |
| mov eax, dword ptr [esp+000000A8h] |
| movzx esi, byte ptr [edx] |
| mov dword ptr [ebp+00h], 00000000h |
| mov dword ptr [esp+60h], 00000000h |
| mov dword ptr [eax], 00000000h |
| mov eax, 00000300h |
| mov dword ptr [esp+64h], esi |
| mov dword ptr [esp+5Ch], 00000001h |
| mov dword ptr [esp+58h], 00000001h |
| Name | Virtual Address | Virtual Size | Is in Section |
|---|---|---|---|
| IMAGE_DIRECTORY_ENTRY_EXPORT | 0x29a770 | 0x70 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_IMPORT | 0x29a488 | 0x2e8 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_RESOURCE | 0x288000 | 0x12488 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_EXCEPTION | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_SECURITY | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BASERELOC | 0x29a7e0 | 0x18 | .rsrc |
| IMAGE_DIRECTORY_ENTRY_DEBUG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COPYRIGHT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_GLOBALPTR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_TLS | 0x287d78 | 0x18 | UPX1 |
| IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_IAT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR | 0x0 | 0x0 | |
| IMAGE_DIRECTORY_ENTRY_RESERVED | 0x0 | 0x0 |
| Name | Virtual Address | Virtual Size | Raw Size | Xored PE | ZLIB Complexity | File Type | Entropy | Characteristics |
|---|---|---|---|---|---|---|---|---|
| UPX0 | 0x1000 | 0x1b4000 | 0x0 | False | 0 | empty | 0.0 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ |
| UPX1 | 0x1b5000 | 0xd3000 | 0xd2e00 | False | 0.998996230365 | data | 7.99969875033 | IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| .rsrc | 0x288000 | 0x13000 | 0x12800 | False | 0.330355257601 | data | 4.1613860609 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ |
| Name | RVA | Size | Type | Language | Country |
|---|---|---|---|---|---|
| RT_CURSOR | 0x28a604 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28a73c | 0x134 | AmigaOS bitmap font | English | United States |
| RT_CURSOR | 0x28a874 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28a9ac | 0x134 | data | English | United States |
| RT_CURSOR | 0x28aae4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28ac1c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28ad54 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28ae8c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28afc4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28b0fc | 0x134 | data | English | United States |
| RT_CURSOR | 0x28b234 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28b36c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28b4a4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28b5dc | 0x134 | data | English | United States |
| RT_CURSOR | 0x28b714 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28b84c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28b984 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28babc | 0x134 | data | English | United States |
| RT_CURSOR | 0x28bbf4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28bd2c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28be64 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28bf9c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28c0d4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28c20c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28c344 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28c47c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28c5b4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28c6ec | 0x134 | data | English | United States |
| RT_CURSOR | 0x28c824 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28c95c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28ca94 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28cbcc | 0x134 | data | English | United States |
| RT_CURSOR | 0x28cd04 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28ce3c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28cf74 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28d0ac | 0x134 | data | English | United States |
| RT_CURSOR | 0x28d1e4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28d31c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28d454 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28d58c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28d6c4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28d7fc | 0x134 | data | English | United States |
| RT_CURSOR | 0x28d934 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28da6c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28dba4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28dcdc | 0x134 | data | English | United States |
| RT_CURSOR | 0x28de14 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28df4c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28e084 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28e1bc | 0x134 | data | English | United States |
| RT_CURSOR | 0x28e2f4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28e42c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28e564 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28e69c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28e7d4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28e90c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28ea44 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28eb7c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28ecb4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28edec | 0x134 | data | English | United States |
| RT_CURSOR | 0x28ef24 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28f05c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28f194 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28f2cc | 0x134 | data | English | United States |
| RT_CURSOR | 0x28f404 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28f53c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28f674 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28f7ac | 0x134 | data | English | United States |
| RT_CURSOR | 0x28f8e4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28fa1c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28fb54 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28fc8c | 0x134 | data | English | United States |
| RT_CURSOR | 0x28fdc4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x28fefc | 0x134 | data | English | United States |
| RT_CURSOR | 0x290034 | 0x134 | data | English | United States |
| RT_CURSOR | 0x29016c | 0x134 | data | English | United States |
| RT_CURSOR | 0x2902a4 | 0x134 | data | English | United States |
| RT_CURSOR | 0x2903dc | 0x134 | data | English | United States |
| RT_BITMAP | 0x290514 | 0x340 | data | English | United States |
| RT_ICON | 0x290858 | 0x568 | GLS_BINARY_LSB_FIRST | English | United States |
| RT_ICON | 0x290dc4 | 0x4228 | dBase III DBT, version number 0, next free block index 40 | English | United States |
| RT_ICON | 0x294ff0 | 0x25a8 | dBase III DBT, version number 0, next free block index 40 | English | United States |
| RT_ICON | 0x29759c | 0x10a8 | data | English | United States |
| RT_ICON | 0x298648 | 0x988 | dBase III DBT, version number 0, next free block index 40 | English | United States |
| RT_DIALOG | 0x298fd4 | 0x23a | data | English | United States |
| RT_GROUP_CURSOR | 0x299214 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29922c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299244 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29925c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299274 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29928c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2992a4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2992bc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2992d4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2992ec | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299304 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29931c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299334 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29934c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299364 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29937c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299394 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2993ac | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2993c4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2993dc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2993f4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29940c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299424 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29943c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299454 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29946c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299484 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29949c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2994b4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2994cc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2994e4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2994fc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299514 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29952c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299544 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29955c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299574 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29958c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2995a4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2995bc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2995d4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2995ec | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299604 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29961c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299634 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29964c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299664 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29967c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299694 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2996ac | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2996c4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2996dc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2996f4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29970c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299724 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29973c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299754 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29976c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299784 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29979c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2997b4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2997cc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2997e4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2997fc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299814 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29982c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299844 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29985c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299874 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29988c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2998a4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2998bc | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2998d4 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x2998ec | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299904 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29991c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x299934 | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_CURSOR | 0x29994c | 0x14 | Lotus unknown worksheet or configuration, revision 0x1 | English | United States |
| RT_GROUP_ICON | 0x299964 | 0x4c | data | English | United States |
| RT_VERSION | 0x2999b4 | 0x51c | data | English | United States |
| RT_MANIFEST | 0x299ed4 | 0x5b1 | XML 1.0 document, ASCII text | English | United States |
| DLL | Import |
|---|---|
| KERNEL32.DLL | LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess |
| ADVAPI32.DLL | RegCloseKey |
| COMCTL32.DLL | InitCommonControlsEx |
| COMDLG32.DLL | ChooseColorA |
| GDI32.dll | Arc |
| IMM32.DLL | ImmGetContext |
| msvcrt.dll | cos |
| OLE32.dll | CreateBindCtx |
| OLEAUT32.DLL | VariantInit |
| SHELL32.DLL | SHGetMalloc |
| USER32.dll | GetDC |
| WS2_32.DLL | bind |
| Name | Ordinal | Address |
|---|---|---|
| TclKit_AppInit | 1 | 0x402344 |
| TclKit_SetKitPath | 2 | 0x402720 |
| Description | Data |
|---|---|
| LegalCopyright | Copyright JXplorer Open Source Project |
| InternalName | |
| FileVersion | 1.0.0.0 |
| CompanyName | JXplorer Open Source Project |
| LegalTrademarks | |
| Comments | |
| ProductName | JXplorer |
| ProductVersion | 3.3.1.2 |
| FileDescription | |
| OriginalFilename | setup.exe |
| Translation | 0x0409 0x04b0 |
| Language of compilation system | Country where language is spoken | Map |
|---|---|---|
| English | United States |  |
Key Decision
Richest Path
Thread / callback creation
Lower opacity -> Library NodeNetwork Behavior |
|---|
| No network behavior found |
|---|
Code Manipulations |
|---|
Statistics |
|---|
CPU Usage |
|---|
Click to jump to process
Memory Usage |
|---|
Click to jump to process
High Level Behavior Distribution |
|---|
back
Click to dive into process behavior distribution
Behavior |
|---|
Click to jump to process
System Behavior |
|---|
| Start time: | 09:35:39 |
| Start date: | 01/11/2021 |
| Path: | C:\Users\user\Desktop\jxplorer-3.3.1.2-windows-installer.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x400000 |
| File size: | 7501332 bytes |
| MD5 hash: | C23A27B06281CFA93641FDBB611C33FF |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | low |
File Activities
Section Activities
Registry Activities
Mutex Activities
Process Activities
Thread Activities
Memory Activities
System Activities
Timing Activities
Windows UI Activities
LPC Port Activities
| Start time: | 09:35:47 |
| Start date: | 01/11/2021 |
| Path: | C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1160000 |
| File size: | 192376 bytes |
| MD5 hash: | 28733BA8C383E865338638DF5196E6FE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | Java |
| Reputation: | high |
File Activities
Section Activities
Registry Activities
Mutex Activities
Process Activities
Thread Activities
Memory Activities
System Activities
LPC Port Activities
| Start time: | 09:35:48 |
| Start date: | 01/11/2021 |
| Path: | C:\Windows\SysWOW64\icacls.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x11a0000 |
| File size: | 29696 bytes |
| MD5 hash: | FF0D1D4317A44C951240FAE75075D501 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
File Activities
Section Activities
Registry Activities
Process Activities
Thread Activities
Memory Activities
System Activities
Object Security Activities
| Start time: | 09:35:48 |
| Start date: | 01/11/2021 |
| Path: | C:\Windows\System32\conhost.exe |
| Wow64 process (32bit): | false |
| Commandline: | |
| Imagebase: | 0x7ff7f20f0000 |
| File size: | 625664 bytes |
| MD5 hash: | EA777DEEA782E8B4D7C7C33BBF8A4496 |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
File Activities
Section Activities
Registry Activities
Mutex Activities
Process Activities
Thread Activities
System Activities
LPC Port Activities
| Start time: | 09:35:49 |
| Start date: | 01/11/2021 |
| Path: | C:\Program Files (x86)\Java\jre1.8.0_211\bin\java.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0x1160000 |
| File size: | 192376 bytes |
| MD5 hash: | 28733BA8C383E865338638DF5196E6FE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
File Activities
Section Activities
Registry Activities
Mutex Activities
Process Activities
Thread Activities
Memory Activities
System Activities
LPC Port Activities
| Start time: | 09:35:50 |
| Start date: | 01/11/2021 |
| Path: | C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xaa0000 |
| File size: | 192376 bytes |
| MD5 hash: | 28733BA8C383E865338638DF5196E6FE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
File Activities
Section Activities
Registry Activities
Mutex Activities
Process Activities
Thread Activities
Memory Activities
System Activities
Object Security Activities
LPC Port Activities
| Start time: | 09:35:52 |
| Start date: | 01/11/2021 |
| Path: | C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_885250\java.exe |
| Wow64 process (32bit): | true |
| Commandline: | |
| Imagebase: | 0xaa0000 |
| File size: | 192376 bytes |
| MD5 hash: | 28733BA8C383E865338638DF5196E6FE |
| Has elevated privileges: | true |
| Has administrator privileges: | true |
| Programmed in: | C, C++ or other language |
| Reputation: | high |
File Activities
Section Activities
Registry Activities
Mutex Activities
Process Activities
Thread Activities
Memory Activities
System Activities
LPC Port Activities
Disassembly |
|---|
Code Analysis |
|---|
Execution Graph |
|---|
Execution Coverage
Dynamic/Packed Code Coverage
Signature Coverage
| Execution Coverage: | 10.9% |
| Dynamic/Decrypted Code Coverage: | 0% |
| Signature Coverage: | 15% |
| Total number of Nodes: | 608 |
| Total number of Limit Nodes: | 41 |
Graph
Executed Functions |
|---|
Download Yara Rule
Control-flow Graph |
|---|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph |
|---|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph |
|---|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
Control-flow Graph |
|---|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph |
|---|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph |
|---|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
Control-flow Graph |
|---|
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
Control-flow Graph |
|---|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
Control-flow Graph |
|---|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph |
|---|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
Control-flow Graph |
|---|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
Control-flow Graph |
|---|
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph |
|---|
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph |
|---|
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Control-flow Graph |
|---|
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Non-executed Functions |
|---|
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
|
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
|
| Strings |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| APIs |
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
| Strings |
|
| Memory Dump Source |
|
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Executed Functions |
|---|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Non-executed Functions |
|---|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Executed Functions |
|---|
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Download Yara Rule
| Memory Dump Source |
|
| Joe Sandbox IDA Plugin |
|
| Similarity |
|
| Uniqueness |
Uniqueness Score: -1.00% |
Non-executed Functions |
|---|
