SUSPICIOUS — 9af4e08d55020b4182a411f547214d2092887a727f7ec5ae2ead8045bdccd579.jar

SUSPICIOUS — 9af4e08d55020b4182a411f547214d2092887a727f7ec5ae2ead8045bdccd579.jar is a jar sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (35/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 9af4e08d55020b4182a411f547214d2092887a727f7ec5ae2ead8045bdccd579
• SHA-1: cf126a7264bdf97bd03e0439a4d73623c2dc18b7
• MD5: 1e198b6cb97fd1662c6fd6d0cab8ea1c
• ssdeep: 393216:wW8aUyfqgNv9i4/NmvymepNbDzpL4/pKpSpNbaASo3a5vcwm8WHr47:drrv9R1ybScw+uASWtu7
• TLSH: T1317323ECE3156A31D3CE8F33418A785C415D8021F87066DD52222BDCA97837B725EE6A
• Submitted as: 9af4e08d55020b4182a411f547214d2092887a727f7ec5ae2ead8045bdccd579.jar
• File type: jar · Size: 22878176 bytes
• Verdict: suspicious (35/100)

Detections (2 of 53 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-blob
• YARA: MalwareAnalyser community pack: TL_UPX_Packed

Why this verdict

The suspicious score of 35/100 is the fusion of 2 weighted signals:

• YARA: MalwareAnalyser community pack flagged TL_UPX_Packed (rule TL_UPX_Packed) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-blob - static signal, weight 0.25, confidence 0.55

Archive contents (15 executables)

This jar carries 15 extracted members, each analyzed as its own sample (listing truncated):

• libjnidispatch.jnilib - 22139ef060538cccc0e654639ef36d53a96b4f5d8f0b5027116e430fed5e75df
• libjnidispatch.jnilib - 12d88138ce3c0a20d4bb3cfbd091b7ccb1f6365a79ab07b2d786a52d104d418e
• libjnidispatch.so - c1d200c601baf9f26db1b0ba0d152fb517dd929f01cbbe1ac3320bbe40adb827
• libjnidispatch.so - 13281e25bf8614ab1aeb5f93d32ce4af02d986b0ca49f7692d08fce981eb1d5e
• libjnidispatch.so - 5c894177c2c4a1a422047886f5f526959e4f1a8c1561bb3cb2277fe0da85b744
• libjnidispatch.so - 00a35890dde5b4174d6646d1ebdc553bac3b7d99c1a793899eddaa002b5a16a2
• libjnidispatch.so - 257d627bce7ddccf539f8a32dd293e4d0ed8ba64070dab07d5ae40d4932d60a6
• libjnidispatch.so - 2e91afb910bf56ca578786861fb87845f7bae1dc91b3ec6374540f3a946f170a
• libjnidispatch.so - 5e7a37f9cc6c0dc7cfa2b6d0944788c448ff2e87d4aab894a241269a8b6335ed
• libjnidispatch.so - c974c4ec9701655a30d7601389c3b3246447fdbc90240e809b37cb283224a2ff
• libjnidispatch.so - bb026410e75b3e928cb3ccddc0f9418e3fb40aad1f6c80cf046b72d62e5eb062
• libjnidispatch.so - 938f42166508c30d5b5ed3eb094219f9b2df736b1ea38ed7586c0ce79c12ee97
• libjnidispatch.so - 3f33fab801dc3a43a5d269fa0e8f43e54b0f7e29f02c4821901c62aafb3aee6c
• libjnidispatch.so - caf3d95b12a6f907fa0b647e1d785c6505415fc266e11733b24eec22da6ae3d9
• libjnidispatch.so - c0ff03e4593fedd2fa96bd76a66ee9dab7a057df8739a7a38133cb5f21d12552

Dynamic analysis (linux)

893 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• 250.255.255.239.in-addr.arpa
• desktop-hsgcbep
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• ntp.ubuntu.com
• ff02::1:3
• 224.0.0.252
• 135.232.92.137 US · Boydton · AS8075 Microsoft Limited
• ff02::fb
• 224.0.0.251
• 169.254.255.255
• 10.240.0.1
• 239.255.255.250
• ff02::16
• 10.240.0.255
• ff02::2
• ff02::1
• ff02::1:ff12:3456

Embedded domains

• g.io
• 0.pw
• 3.au
• jj.ua
• e.mx
• ko.it
• k.uk
• g.tw
• t.us

Embedded IP addresses

• 135.232.92.137
• 20.184.175.6

File paths

• e:\u2
• M:\3}n
• n:\![
• x:\H#
• d:\}}
• D:\A

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report