Summary

File jre-8u461-windows-x64.exe

Summary

Download Resubmit sample

Size	38.5MB
Type	PE32+ executable (GUI) x86-64, for MS Windows
MD5	e62d0a758048f9c54292d95ecf45a4b1
SHA1	ac29ac7f299062714304c92822ec202f5816cc6d
SHA256	2fa1d7cab90121a59c777258497f9bc5fdc02f23b36af92ea9f515a0c50a7e7a
SHA512	Show SHA512 a0562357802a367136153b76e2f94fa1376a1d6c6376085856371c568e32a17f9c6d42ec64c208b150df1748bccf4b5f7a4ffac922a20e88c11fc99e49e0ed38
CRC32	733D5484
ssdeep	None
Yara	JavaDropper - (no description) anti_dbg - Checks if being debugged disable_antivirus - Disable AntiVirus network_http - Communications over HTTP network_dga - Communication using dga screenshot - Take screenshot win_mutex - Create or check mutex win_registry - Affect system registries win_token - Affect system token win_files_operation - Affect private profile

Score

Please notice: The scoring system is currently still in development and should be considered an alpha feature.

---

Autosubmit

6736541

Feedback

Expecting different results? Send us this analysis and we will inspect it. Click here

Information on Execution

Signatures

Yara rules detected for file (10 events)

description	(no description)				rule	JavaDropper
description	Checks if being debugged				rule	anti_dbg
description	Disable AntiVirus				rule	disable_antivirus
description	Communications over HTTP				rule	network_http
description	Communication using dga				rule	network_dga
description	Take screenshot				rule	screenshot
description	Create or check mutex				rule	win_mutex
description	Affect system registries				rule	win_registry
description	Affect system token				rule	win_token
description	Affect private profile				rule	win_files_operation

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 16, 2025, 6:52 p.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

Creates executable files on the filesystem (1 event)

file	C:\Users\Administrator\AppData\LocalLow\Oracle\Java\jre1.8.0_461_x64\jre1.8.0_46164.msi

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW July 16, 2025, 6:52 p.m.	thread_identifier: 1800 thread_handle: 0x00000000000000a8 process_identifier: 2928 current_directory: C:\Users\ADMINI~1\AppData\Local\Temp\jds14769265.tmp filepath: C:\Users\Administrator\AppData\Local\Temp\jds14769265.tmp\jre-8u461-windows-x64.exe track: 1 command_line: "C:\Users\ADMINI~1\AppData\Local\Temp\jds14769265.tmp\jre-8u461-windows-x64.exe" filepath_r: C:\Users\ADMINI~1\AppData\Local\Temp\jds14769265.tmp\jre-8u461-windows-x64.exe stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 0 process_handle: 0x00000000000000ac	1	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x02619000', u'virtual_address': u'0x00064000', u'entropy': 7.951511681712129, u'name': u'.rsrc', u'virtual_size': u'0x02618fb8'}				entropy	7.95151168171				description	A section with a high entropy has been found
entropy	0.990466518566				description	Overall entropy of this PE file is high

Screenshots