CLEAN — 023127e61ea84b5a133a0a640628c3cf883a4eae722f5618a37380db500d284d.jar
CLEAN — 023127e61ea84b5a133a0a640628c3cf883a4eae722f5618a37380db500d284d.jar is a jar sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (14/100). 3 of 53 detection engines flagged it.
Identification
- SHA-256:
023127e61ea84b5a133a0a640628c3cf883a4eae722f5618a37380db500d284d - SHA-1:
670c16c89825baf0ba8bdd0b6f02c61b81ba439c - MD5:
507381ab117759fd05a7b3fb4356e8e3 - ssdeep:
393216:AfrLO07GzZd/Tw8Ao6BBYrPK2ia5X9HrN7p+ohObX82cBLt2Q8f7Mkfjpt060uKv:Af/OQ6sZBWi2xNHrN7PhO7scFfw6jb5I - TLSH:
T18372333DBA12B56FCA1CEC29D40C7B7C970C208167A3C6846DD58AE797F614122EA137 - Submitted as: 023127e61ea84b5a133a0a640628c3cf883a4eae722f5618a37380db500d284d.jar
- File type: jar · Size: 21181459 bytes
- Verdict: clean (14/100)
Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified
Detections (3 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
- Microsoft Defender: flagged
- Kaspersky (KVRT): Trojan.Java.Agent.vw
Why this verdict
The clean score of 14/100 is the fusion of 1 weighted signal:
- Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55
Archive contents (15 executables)
This jar carries 15 extracted members, each analyzed as its own sample (listing truncated):
- Detached.class -
488e5247ee15cd54ff8a3b02496170b5af80fc6ecde2b7fa690560fad7f6587e - LangProvider.class -
b7bd5d3b359dc52f97c5707c4e23efe6be19e43796f6e00d075ea25d463f3792 - Libmod.class -
59cae621d70f739ee18b4e392e1b87d9ed8fb752206fadebfe5bb089f1a8b3b9 - Main.class -
613561c27a02301f86f290f697c8cd442f05531319c783efc9e2310755f8cfeb - RpcHelper.class -
3ca7b6101bb66bb798f7bb5a2a3774bcb56f77afccb252de0ac801c8e278b8c4 - AN.class -
4795bbd66d8a3f55b5292cd12aee51d3af6ebb3933429b00f57285ec4228fbd2 - tizwA.class -
46e98c097475bed48a9045ebd325d482f7a8474c03f54b5f3cf877bd2388ae6f - iweepkikjyqovrst.class -
4e6df06a7e254c9d3307b75093f307fd46d623d039fee5b5d701085b36b6c308 - I1I0.class -
73fe4c758653a16a4ab78f45a5b263a6df01a17c3a23dc6409a15bfd573b74cd - Il.class -
a2d54199d1fc8a07f57ad2dae57c295ade7122d6ff71dd643335c2648b4c017a - IlolI.class -
008debc898accc0750493f6bc1dce42df2bfe20b09070ef887cfb141018f0eaa - Ol1loI1.class -
eb259008bfce121bba787ae823c6ebcbe5c805807b359530208beffd8919afed - l0II0l.class -
26a9f66d8cdef874e2b7c926458553d1ebc1d53d70f42e962a55b05770fa81c3 - l1Ql0o.class -
7e5354ec68aab13003ad5f3a0f96b4f2ed20f8cb5fa1e8c7ef910d62327ab964 - lI.class -
e7fdb427cf5da31719e37f8b3289f029d2581e67c11ea4b2cf7e9563a8e67dbf
Dynamic analysis
This jar is a container, so it was not detonated itself. Its extracted members were re-submitted and analyzed as their own samples, and the runtime behaviour lives on those reports.
Embedded domains
- ece.in
- e.ai
- 8.br
- v.us
- 1.gq
File paths
- g:\#a
- c:\&q
- T:\}
- G:\W:.
- T:\O
- h:\53
- l:\y{
- l:\N
- T:\qU
- P:\)3
- u:\Kq
- Q:\y^
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report