Edit tour

Windows Analysis Report
niga.jar

Overview

General Information

Sample name:	niga.jar
Analysis ID:	1632113
MD5:	c2eaf7f27279e855ce4fb6e28b1a9257
SHA1:	da9d48af66f70393b0967886fa098e3a97f0d3fe
SHA256:	7854f78de36e7ba1280434f6a6fc48015d2d7d89dc6bd665a717951ece83bb60
Tags:	jaruser-aachum
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

Exploit detected, runtime environment starts unknown processes

Java source code contains very large array initializations

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

7za.exe (PID: 7900 cmdline: 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\niga.jar" MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 7876 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

java.exe (PID: 1680 cmdline: java.exe -jar "C:\Users\user\Desktop\niga.jar" com.example.Main MD5: 9DAA53BAB2ECB33DC0D9CA51552701FA)

conhost.exe (PID: 6772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

icacls.exe (PID: 6848 cmdline: C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M MD5: 2E49585E4E08565F52090B144062F97E)

conhost.exe (PID: 6856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Configuration

⊘No configs have been found

Yara Signatures

⊘No yara matches

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: C:\Windows\System32\7za.exe

File created: C:\jar\META-INF\LICENSE.txt

Jump to behavior

Software Vulnerabilities

Exploit detected, runtime environment starts unknown processes

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\System32\conhost.exe

Source: global traffic

TCP traffic: 192.168.2.5:49695 -> 2.59.41.142:9090

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: public-suffix-list.txt.3.dr

String found in binary or memory: // www.yahoo.com.by, for example), so we list it here for safety's sake. equals www.yahoo.com (Yahoo)

Source: global traffic

DNS traffic detected: DNS query: gogo.fechrise.fun

Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://about.museum/naming/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://alboto.ca
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://alces-software.com
Source: java.exe, 00000005.00000002.2654612355.000000000A45A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://cenpac.net.nr/dns/index.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://cnnic.cn/html/Dir/2005/10/11/3218.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://co.bn/faq.html
Source: pom.xml.3.dr	String found in binary or memory: http://commons.apache.org/proper/commons-codec/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://dns.js.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://dns.marnet.net.mk/postapka.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://domain.nida.or.kr/eng/registration.jsp
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://domains.fj/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://domains.in.net
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://domains.qa/en/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://domreg.merit.edu
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://drs.ua/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://dy.fi/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://encounter.eus/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://enonic.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://gadao.gov.gu/register.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://getchannels.com
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: http://gsj.bz
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: http://hakaran.cz
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://hoster.by/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://icmregistry.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://index.museum/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://info.cx
Source: pom.xml.3.dr	String found in binary or memory: http://issues.apache.org/jira/browse/CODEC
Source: java.exe, 00000005.00000002.2654612355.000000000A499000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://java.oracle.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://jprs.co.jp/en/jpdomain.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://jprs.jp/doc/rule/saisoku-1.html
Source: pom.xml.3.dr	String found in binary or memory: http://juliusdavies.ca/
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, pom.xml0.3.dr	String found in binary or memory: http://maven.apache.org
Source: pom.xml.3.dr, pom.xml1.3.dr, pom.xml0.3.dr, pom.xml3.3.dr, pom.xml2.3.dr	String found in binary or memory: http://maven.apache.org/POM/4.0.0
Source: pom.xml.3.dr	String found in binary or memory: http://maven.apache.org/maven-v4_0_0.xsd
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, pom.xml0.3.dr	String found in binary or memory: http://maven.apache.org/xsd/maven-4.0.0.xsd
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://minion.systems
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://nic.ae/english/arabicdomain/rules.jsp
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://nic.ba/users_data/files/pravilnik_o_registraciji.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://nic.com.ai/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://nic.gl
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://nic.krd/data/krd/Registration%20Policy.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://nic.mg/nicmg/?page_id=39
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://nic.tn
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://online.dns.pt/dns/start_dns
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://opencraft.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://peplink.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://pk5.pknic.net.pk/pk5/msgNamepk.PK
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://protonet.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://psg.com/dns/gn/gn.txt
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://psg.com/dns/lr/lr.txt
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://qutheory.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://registro.br/dominio/categoria.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://registry.co.ca/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://registry.gc.ca/en/SubdomainFAQ
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://registry.gy/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://registry.pro/get-pro
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://sae.sina.com.cn/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://samoanic.ws/index.dhtml
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://sonic.so/policies/
Source: pom.xml.3.dr	String found in binary or memory: http://svn.apache.org/repos/asf/commons/proper/codec/trunk
Source: pom.xml.3.dr	String found in binary or memory: http://svn.apache.org/viewvc/commons/proper/codec/trunk
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://tld.by/rules_2006_en.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://us.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://whois.ati.tn/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://whois.nic.bi/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.aeda.ae/eng/aepolicy.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.afnic.fr/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.afnic.fr/medias/documents/AFNIC-naming-policy2012.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.afnic.re/obtenir/chartes/nommage-re/annexe-descriptifs
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.anrt.ma/fr/admin/download/upload/file_fr782.pdf
Source: version.properties.3.dr	String found in binary or memory: http://www.apache.org/
Source: NOTICE.3.dr, NOTICE.txt.3.dr	String found in binary or memory: http://www.apache.org/).
Source: LICENSE.txt.3.dr, LICENSE.3.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: sep_exact_italian.txt.3.dr, ash_approx_hebrew.txt.3.dr, gen_exact_any.txt.3.dr, ash_exact_spanish.txt.3.dr, ash_approx_french.txt.3.dr, gen_approx_russian.txt.3.dr, ash_exact_hebrew.txt.3.dr, ash_exact_cyrillic.txt.3.dr, ash_languages.txt.3.dr, ash_exact_approx_common.txt.3.dr, gen_rules_czech.txt.3.dr, dmrules.txt.3.dr, ash_rules_polish.txt.3.dr, ash_rules_russian.txt.3.dr, gen_approx_polish.txt.3.dr, gen_hebrew_common.txt.3.dr, ash_rules_hebrew.txt.3.dr, gen_approx_italian.txt.3.dr, gen_rules_english.txt.3.dr, gen_rules_portuguese.txt.3.dr, sep_exact_hebrew.txt.3.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.asustor.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.auda.org.au/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.belizenic.bz/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.bermudanic.bm/dnr-text.txt
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.binarylane.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.bnnic.bn/faqs
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.c.la/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.cctld.nc/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.cdn77.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.centralnic.com/names/domains
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.cgdn.org.au/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.channelisles.net/register-domains/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.clearvox.nl/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.cloudns.net
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.cmc.iq/english/iq/iqregister1.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.co.pl/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.com.jm/register.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.cosimo.de
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.craynic.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dansk.net/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.definima.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dns.ao/REGISTR.DOC
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dns.hr/documents/pdf/HRTLD-regulations.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dns.jo/Registration_policy.aspx
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dns.lu/en/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dns.pl/english/index.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dns.pl/english/index.html)
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.domain.gr.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.domain.hu/domain/English/sld.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.domain.kg/dmn_n.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.domaine.km/documents/charte.doc
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.domains.ph/FAQ2.asp
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dot.kn/domainRules.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dot.mp/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dotmasr.eg/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dreamhost.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.drobo.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.duckdns.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.dyndns.com/services/dns/dyndns/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.eenet.ee/EENet/dom_reeglid.html#lisa_B
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.ert.gov.al/ert_alb/faq_det.html?Id=31
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.evennode.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.fastly.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.freebox.fr
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: http://www.futureweb.at
Source: pom.xml.3.dr	String found in binary or memory: http://www.garygregory.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.gobin.info/domainname/bw.doc
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.gobin.info/domainname/formulaire-pf.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.gobin.info/domainname/ml-template.doc
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.gobin.info/domainname/sy.doc
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: http://www.goip.de
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.gov.lt/index_en.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.government.pn/PnRegistry/policies.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.gt/politicas_de_registro.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.i-registry.cz/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.icilalune.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.ict.gov.qa/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.icta.ky/da_ky_reg_dom.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.info.at/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.info.na/domain/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.information.nyc.mn
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.interlegis.leg.br
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.iodata.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.isnic.is/domain/rules.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.isoc.org.il/domains/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.isoc.sd/sudanic.isoc.sd/billing_pricing.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.kaashosting.nl/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.kcce.kp/en_index.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.kenic.or.ke/index.php/en/ke-domains/ke-domains
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.ki/dns/index.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.knightpoint.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.liquidnetlimited.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.monic.net.mo/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.mos.com.np/register.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.mptc.gov.kh/dns_registration.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.mynic.net.my/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.na-nic.com.na/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.af/help.jsp
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ag/prices.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.bs/rules.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ci/index.php?page=charte
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.cr/niccr_publico/showRegistroDominiosScreen.do
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.cy/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.dz/images/pdf_nic/charte.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ec/reg/paso1.asp
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.gh/reg_now.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.gi/rules.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.gm/htmlpages%5Cgm-policy.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.gp/index.php?lang=en
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.hn/politicas/ps02
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ht/info/charte.cfm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.io/rules.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ir/Internationalized_Domain_Names
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ir/Terms_and_Conditions_ir
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.kz/rules/index.jsp
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.lc/rules.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ls/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.lv/DNS/En/generic.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ly/regulations.php
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.mc/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ms/pdf/MS_Domain_Name_Rules.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.mx/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.net.ge/policy_en.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.net.sa/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.net.sg/page/registration-policies-procedures-and-guidelines
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ni/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.org.uy/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.pa/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.pr/index.asp?f=1
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.priv.at/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.ps/registration/policy.html#reg
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.py/pautas.html#seccion_9
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.sc/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.sh/registrar.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.sl
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.st/html/policyrules/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.tg/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.tj/policy.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.tm/local.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.tt/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.vi/Domain_Rules/body_domain_rules.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nic.vi/newdomainform.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.nira.org.ng/index.php/join-us/register-ng-domain/189-nira-slds
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.onefoldmedia.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.ownprovider.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.ox.rs
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.pnina.ps
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.reg.uz/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.registrar.mw/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.revitalised.co.uk
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.rit.edu/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.rotld.ro/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.sbnic.net.sb/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.scrysec.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.shopblocks.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.sispa.org.sz/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.skyhat.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.snt.utwente.nl/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.sub6.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.svnet.org.sv/niveldos.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.telnic.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.thnic.co.th
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.twnic.net/english/dn/dn_07a.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.tznic.or.tz/index.php/domains
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.uem.mz/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.una.cw/cw_registry/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.vunic.vu/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: http://www.y.net.ye/services/domain_name.htm
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://611project.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://Lifetime.Hosting/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://advisorwebsites.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://all-inkl.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://amune.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://apigee.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://app.lmpm.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://avm.de
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://aws.amazon.com/cloudfront/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://aws.amazon.com/ec2/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://aws.amazon.com/elasticbeanstalk/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://aws.amazon.com/elasticloadbalancing/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://aws.amazon.com/s3/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://bip.sh
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://boomla.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://boxfuse.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://brsmedia.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://carrd.co
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://cctld.ru/en/domains/domens_ru/reserved/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://cctld.ru/files/pdf/docs/en/rules_ru-rf.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://certmgr.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://citrix.com
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://cityhost.ua
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://clic2000.fr
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://cloud.oracle.com/home
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://cloudeity.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://clovyr.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://cnpy.gdn
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://co-co.nl/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://cryptonomic.net/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://cupcake.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://curv-labs.de/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://dangerscience.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://daplie.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://dappnode.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://dapps.earth/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://darklang.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://desec.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://dev.viberplay.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://developer.swisscom.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://dns.business
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://dnstrace.pro/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://domena.pl
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://dyn.com/dns/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://dynv6.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://e4you.cz/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://ecgrobotics.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://en-root.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://eu.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://eurid.eu
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://faitid.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://fastvps.ru/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://fearworksmedia.co.uk
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://featherhead.xyz/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://fedoraproject.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://fermax.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://fly.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://flynn.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://frederik-braun.com
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://gitplac.si
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://glitch.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://grweb.ics.forth.gr/english/1617-B-2005.html
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://handshake.org
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://hashbang.sh
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://hasura.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://hb.cldmail.ru
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://hosting.url.com.tw/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://hostmaster.ua/2ld/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://hostmaster.ua/policy/?ua
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://impertrixcdn.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://iserv.eu
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://jelastic.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://joinforte.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://king.host
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://kuroku.ltd/
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://lab.aaronleem.co.za
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://lelux.fi/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://linki.tools
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://linode.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://lubman.pl/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://lug.org.uk
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://lukanet.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://mayfirst.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://mchost.ru
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://mcpe.me
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://mozilla.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://mozilla.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://mozilla.org/MPL/2.0/.
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://names.of.london/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nctu.me/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://netangels.ru/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://ngrok.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nic.ar/nic-argentina/normativa-vigente
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nic.bo/delegacion2015.php#h-1.10
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nic.lk
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nic.tr/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nic.tr/forms/eng/policies.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nic.tr/index.php?USRACTN=PRICELST
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nodeart.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nodum.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://noip.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://now-dns.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nucleos.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://nymnom.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://observablehq.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://omg.lol
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://omniwe.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://openshift.redhat.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://pagefog.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://pagexl.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://pandi.id/en/domain/registration-requirements/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://pantheon.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://pcarrier.ca/
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://pepabo.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://perspecta.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://pixolino.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://platform.sh
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://platter.dev
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://port53.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://potager.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://ppcom.fr
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://prgmr.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://protocol.ai/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://publicsuffix.org/list/.
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://publicsuffix.org/list/public_suffix_list.dat
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://qualifio.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://quip.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://rancher.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://registro.nic.ve/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://registry.africa.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://registry.co.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://registry.in/Policies
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://registry.nic.ss/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://render.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://repl.it
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://resin.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://roar.basketball/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://sandcats.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://schokokeks.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://shiftedit.net/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://shopware.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://sie.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://skygear.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://small-tech.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://static.land
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://stdlib.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://storj.io/
Source: pom.xml.3.dr	String found in binary or memory: https://svn.apache.org/repos/asf/commons/proper/codec/trunk
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://symfony.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://tools.ietf.org/html/rfc7686
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://ulterius.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://whats-th.is/
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://wpengine.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.1gb.ua/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.NearlyFreeSpeech.NET/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.afnic.fr/en/products-and-services/the-fr-tld/sector-based-fr-domains-4.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.afnic.fr/medias/documents/Cadre_legal/Afnic_Naming_Policy_12122016_VEN.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.altervista.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.alwaysdata.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.amnic.net/policy/en/Policy_EN.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.amsterdamwireless.nl/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.aptible.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.aseinet.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.b-data.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.backplane.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.balena.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.blackbaud.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.bplaced.net/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.bytemark.co.uk
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.callidomus.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.clerk.dev
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.clever-cloud.com/
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.cloud.service.gov.uk/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.cloud66.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.cloudaccess.net/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.cloudcontrol.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.cloudera.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.cloudflare.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.combell.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.cyon.ch/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.danieldent.com/)
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.datawire.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.datto.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.ddnss.de/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.debian.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.discourse.org/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.dnshome.de/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.dot.vn/vnnic/vnnic/domainregistration.jsp
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.dotarai.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.draytek.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.drud.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.dynu.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.enalean.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.fabrica.dev/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.filegear.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.flexireg.net/stat_info
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.freedesktop.org
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.funkfeuer.at
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.gehirn.co.jp/
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.gentlent.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.getopensocial.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.globehosting.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.gov.scot
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.gov.uk/government/organisations/home-office
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.gov.uk/service-manual/operations/operating-servicegovuk-subdomains
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.group53.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.hepforge.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.heroku.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.hkirc.hk
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.hkirc.hk/content.jsp?id=30#
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.hostbip.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.icann.org/resources/registries/gtlds/v2/gtlds.json
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.in-berlin.de/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.information.aero/index.php?id=66
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.ipifony.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.jino.ru
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.joyent.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.keyweb.de
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.lcube-webhosting.de
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.leadpages.net
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.linkyard.ch/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.loginline.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.memset.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.metacentrum.cz/en/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.meteor.com/hosting
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.msk-ix.ru/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.mythic-beasts.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nabucasa.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.netlify.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.cd/domain/insertDomain_2.jsp?act=1
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.cl
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.es/site_ingles/ingles/dominios/index.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.im/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.it/sites/default/files/archivio/docs/Regulation_assignation_v7.1.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.kw/policies/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.lk/index.php/domain-registration/lk-domain-naming-structure
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.org.mt/go/policy
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nic.pe/InformeFinalComision.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nimbushosting.co.uk/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.norid.no/en/om-domenenavn/regelverk-for-no/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-b/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-c/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.norid.no/en/om-domenenavn/regelverk-for-no/vedlegg-d/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.nsupdate.info/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.omnibond.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.pagefronthq.com/
Source: 7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	String found in binary or memory: https://www.payments.service.gov.uk/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.planet-work.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.plesk.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.potraz.gov.zw/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.privacytools.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.pubtls.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.qnap.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.quickbackend.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.rackmaze.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.readthedocs.org
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.redstarconsultants.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.register.bg/user/static/rules/en/index.html
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.registry.co.ug/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.rethinkdb.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.ricta.org.rw/sites/default/files/resources/registry_registrar_contract_0.pdf
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.rnids.rs/en/domains/national-domains
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.sbe.de/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.securepoint.de
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.seidat.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.senseering.de
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.shopitcommerce.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.sidn.nl/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.siteleaf.com/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.sourcelair.com
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.spacekit.io/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.speedpartner.de/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.srcf.net/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.stackhero.io
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.uog.edu
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://www.zadna.org.za/content/page/domain-information/
Source: public-suffix-list.txt.3.dr	String found in binary or memory: https://zicta.zm/

System Summary

Java source code contains very large array initializations

Source: niga.jar, org/apache/commons/codec/digest/PureJavaCrc32C.java	Large array initialization: update: array initializer size 2048
Source: niga.jar, org/apache/commons/codec/digest/PureJavaCrc32.java	Large array initialization: update: array initializer size 2048

Source: classification engine

Classification label: mal48.expl.winJAR@7/998@1/1

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7876:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6772:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6856:120:WilError_03

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

File created: C:\Users\user\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Source: C:\Windows\System32\7za.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Windows\System32\7za.exe 7za.exe x -y -oC:\jar "C:\Users\user\Desktop\niga.jar"
Source: C:\Windows\System32\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe java.exe -jar "C:\Users\user\Desktop\niga.jar" com.example.Main
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
Source: C:\Windows\SysWOW64\icacls.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M	Jump to behavior

Source: C:\Windows\System32\7za.exe	Section loaded: 7z.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\icacls.exe	Section loaded: ntmarta.dll	Jump to behavior

Source: niga.jar

Static file information: File size 1479698 > 1048576

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02D0FE7B push cs; retf	5_2_02D0FEF1
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02D05FA4 push eax; ret	5_2_02D06031
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02D0A83B push es; retn 0001h	5_2_02D0A93F
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02D0FDD8 push ebx; retf	5_2_02D0FE7A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02D0FDDD push ebx; retf	5_2_02D0FE7A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02C6A20A push ecx; ret	5_2_02C6A21A
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02C6A21B push ecx; ret	5_2_02C6A225
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02C6B3B7 push 00000000h; mov dword ptr [esp], esp	5_2_02C6B3DD
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02C6BB67 push 00000000h; mov dword ptr [esp], esp	5_2_02C6BB8D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02C6B947 push 00000000h; mov dword ptr [esp], esp	5_2_02C6B96D
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Code function: 5_2_02C6C477 push 00000000h; mov dword ptr [esp], esp	5_2_02C6C49D

Source: C:\Windows\System32\7za.exe

File created: C:\jar\META-INF\LICENSE.txt

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: java.exe, 00000005.00000003.1398935409.0000000015263000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: LogFactory.class.3.dr	Binary or memory string: java/lang/VirtualMachineError
Source: java.exe, 00000005.00000003.1398935409.0000000015263000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: &com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe, 00000005.00000002.2646251407.000000000120B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [Ljava/lang/VirtualMachineError;
Source: java.exe, 00000005.00000003.1398935409.0000000015263000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK
Source: java.exe, 00000005.00000002.2646251407.000000000120B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: cjava/lang/VirtualMachineError
Source: java.exe, 00000005.00000003.1398935409.0000000015263000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe, 00000005.00000002.2646251407.000000000120B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Memory protected: page read and write | page guard

Jump to behavior

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe

Process created: C:\Windows\SysWOW64\icacls.exe C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M

Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\bin\client\jvm.dll VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\hsperfdata_user\1680 VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\resources.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\rt.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\jce.jar VolumeInformation	Jump to behavior
Source: C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe	Queries volume information: C:\Program Files (x86)\Java\jre-1.8\lib\meta-index VolumeInformation	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Exploitation for Client Execution	1 Services File Permissions Weakness	1 Services File Permissions Weakness	1 Services File Permissions Weakness	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	11 Process Injection	1 Disable or Modify Tools	LSASS Memory	21 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	11 Process Injection	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 DLL Side-Loading	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Obfuscated Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Source	Detection	Scanner	Label
https://zicta.zm/	0%	Avira URL Cloud	safe
http://www.co.pl/	0%	Avira URL Cloud	safe
https://www.getopensocial.com/	0%	Avira URL Cloud	safe
https://www.funkfeuer.at	0%	Avira URL Cloud	safe
https://www.drud.com/	0%	Avira URL Cloud	safe
http://www.domains.ph/FAQ2.asp	0%	Avira URL Cloud	safe
https://potager.org/	0%	Avira URL Cloud	safe
http://www.nic.tg/	0%	Avira URL Cloud	safe
https://www.dynu.com/	0%	Avira URL Cloud	safe
https://ulterius.io/	0%	Avira URL Cloud	safe
https://jelastic.com/	0%	Avira URL Cloud	safe
https://www.msk-ix.ru/	0%	Avira URL Cloud	safe
https://www.cloud66.com/	0%	Avira URL Cloud	safe
https://www.nic.cd/domain/insertDomain_2.jsp?act=1	0%	Avira URL Cloud	safe
http://www.evennode.com/	0%	Avira URL Cloud	safe
http://www.cosimo.de	0%	Avira URL Cloud	safe
https://king.host	0%	Avira URL Cloud	safe
https://openshift.redhat.com/	0%	Avira URL Cloud	safe
https://cupcake.io/	0%	Avira URL Cloud	safe
https://www.srcf.net/	0%	Avira URL Cloud	safe
https://www.seidat.com	0%	Avira URL Cloud	safe
https://www.loginline.com/	0%	Avira URL Cloud	safe
http://gsj.bz	0%	Avira URL Cloud	safe
http://www.dot.kn/domainRules.html	0%	Avira URL Cloud	safe
https://pcarrier.ca/	0%	Avira URL Cloud	safe
https://mayfirst.org/	0%	Avira URL Cloud	safe
http://tld.by/rules_2006_en.html	0%	Avira URL Cloud	safe
http://www.gobin.info/domainname/ml-template.doc	0%	Avira URL Cloud	safe
http://www.cgdn.org.au/	0%	Avira URL Cloud	safe
http://www.nic.ps/registration/policy.html#reg	0%	Avira URL Cloud	safe
http://www.nic.sl	0%	Avira URL Cloud	safe
http://www.skyhat.io	0%	Avira URL Cloud	safe
https://sandcats.io/	0%	Avira URL Cloud	safe
https://www.altervista.org	0%	Avira URL Cloud	safe
http://www.gobin.info/domainname/bw.doc	0%	Avira URL Cloud	safe
http://whois.ati.tn/	0%	Avira URL Cloud	safe
http://bugreport.sun.com/bugreport/	0%	Avira URL Cloud	safe
https://small-tech.org	0%	Avira URL Cloud	safe
https://lukanet.com	0%	Avira URL Cloud	safe
http://www.nic.pa/	0%	Avira URL Cloud	safe
https://www.group53.com	0%	Avira URL Cloud	safe
http://www.cctld.nc/	0%	Avira URL Cloud	safe
http://nic.gl	0%	Avira URL Cloud	safe
https://www.planet-work.com/	0%	Avira URL Cloud	safe
http://www.nic.hn/politicas/ps02	0%	Avira URL Cloud	safe
https://www.discourse.org/	0%	Avira URL Cloud	safe
https://whats-th.is/	0%	Avira URL Cloud	safe
https://www.afnic.fr/en/products-and-services/the-fr-tld/sector-based-fr-domains-4.html	0%	Avira URL Cloud	safe
http://www.binarylane.com	0%	Avira URL Cloud	safe
https://grweb.ics.forth.gr/english/1617-B-2005.html	0%	Avira URL Cloud	safe
https://cctld.ru/files/pdf/docs/en/rules_ru-rf.pdf	0%	Avira URL Cloud	safe
https://www.metacentrum.cz/en/	0%	Avira URL Cloud	safe
https://registry.co.com	0%	Avira URL Cloud	safe
http://www.ict.gov.qa/	0%	Avira URL Cloud	safe
http://www.centralnic.com/names/domains	0%	Avira URL Cloud	safe
https://www.sidn.nl/	0%	Avira URL Cloud	safe
http://www.sub6.com	0%	Avira URL Cloud	safe
http://www.nic.dz/images/pdf_nic/charte.pdf	0%	Avira URL Cloud	safe
https://lug.org.uk	0%	Avira URL Cloud	safe
https://cityhost.ua	0%	Avira URL Cloud	safe
http://www.craynic.com/	0%	Avira URL Cloud	safe
https://linki.tools	0%	Avira URL Cloud	safe
http://www.isoc.sd/sudanic.isoc.sd/billing_pricing.htm	0%	Avira URL Cloud	safe
https://static.land	0%	Avira URL Cloud	safe
http://www.nic.gp/index.php?lang=en	0%	Avira URL Cloud	safe
https://www.siteleaf.com/	0%	Avira URL Cloud	safe
http://nic.ae/english/arabicdomain/rules.jsp	0%	Avira URL Cloud	safe
http://www.sbnic.net.sb/	0%	Avira URL Cloud	safe
https://www.keyweb.de	0%	Avira URL Cloud	safe
https://www.nic.it/sites/default/files/archivio/docs/Regulation_assignation_v7.1.pdf	0%	Avira URL Cloud	safe
https://eu.org/	0%	Avira URL Cloud	safe
https://e4you.cz/	0%	Avira URL Cloud	safe
http://www.isnic.is/domain/rules.php	0%	Avira URL Cloud	safe
http://www.nic.priv.at/	0%	Avira URL Cloud	safe
http://www.kaashosting.nl/	0%	Avira URL Cloud	safe
https://domena.pl	0%	Avira URL Cloud	safe
http://nic.krd/data/krd/Registration%20Policy.pdf	0%	Avira URL Cloud	safe
https://bip.sh	0%	Avira URL Cloud	safe
http://www.iodata.com/	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.co.pl/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.domains.ph/FAQ2.asp	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://zicta.zm/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://maven.apache.org/POM/4.0.0	pom.xml.3.dr, pom.xml1.3.dr, pom.xml0.3.dr, pom.xml3.3.dr, pom.xml2.3.dr	false		high
https://iserv.eu	public-suffix-list.txt.3.dr	false		high
https://linode.com	public-suffix-list.txt.3.dr	false		high
https://potager.org/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://fedoraproject.org/	public-suffix-list.txt.3.dr	false		high
http://registro.br/dominio/categoria.html	public-suffix-list.txt.3.dr	false		high
https://www.funkfeuer.at	7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.getopensocial.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.nic.tg/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.drud.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.dynu.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://ulterius.io/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://jelastic.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.msk-ix.ru/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.cloud66.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.evennode.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://svn.apache.org/viewvc/commons/proper/codec/trunk	pom.xml.3.dr	false		high
http://www.cosimo.de	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.nic.cd/domain/insertDomain_2.jsp?act=1	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://king.host	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://openshift.redhat.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.plesk.com/	public-suffix-list.txt.3.dr	false		high
https://cupcake.io/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.seidat.com	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.srcf.net/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.loginline.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://pcarrier.ca/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://gsj.bz	7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.cgdn.org.au/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.dot.kn/domainRules.html	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://mayfirst.org/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://nic.ar/nic-argentina/normativa-vigente	public-suffix-list.txt.3.dr	false		high
http://tld.by/rules_2006_en.html	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.gobin.info/domainname/ml-template.doc	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.nic.ps/registration/policy.html#reg	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://sandcats.io/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://pandi.id/en/domain/registration-requirements/	public-suffix-list.txt.3.dr	false		high
http://psg.com/dns/lr/lr.txt	public-suffix-list.txt.3.dr	false		high
http://www.nic.sl	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.skyhat.io	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.altervista.org	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://bugreport.sun.com/bugreport/	java.exe, 00000005.00000002.2654612355.000000000A45A000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://whois.ati.tn/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.gobin.info/domainname/bw.doc	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://small-tech.org	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://java.oracle.com/	java.exe, 00000005.00000002.2654612355.000000000A499000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lukanet.com	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.nic.pa/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.group53.com	7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://nic.gl	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://maven.apache.org/xsd/maven-4.0.0.xsd	7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, pom.xml0.3.dr	false		high
https://render.com	public-suffix-list.txt.3.dr	false		high
https://www.discourse.org/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.cctld.nc/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://repl.it	public-suffix-list.txt.3.dr	false		high
http://www.nic.hn/politicas/ps02	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.planet-work.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://whats-th.is/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.afnic.fr/en/products-and-services/the-fr-tld/sector-based-fr-domains-4.html	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://grweb.ics.forth.gr/english/1617-B-2005.html	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.binarylane.com	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://cctld.ru/files/pdf/docs/en/rules_ru-rf.pdf	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.metacentrum.cz/en/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.sidn.nl/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://registry.co.com	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.ict.gov.qa/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.centralnic.com/names/domains	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.sub6.com	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://lug.org.uk	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.nic.dz/images/pdf_nic/charte.pdf	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://cityhost.ua	7za.exe, 00000003.00000003.1394738991.0000000001100000.00000004.00000800.00020000.00000000.sdmp, public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.craynic.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://linki.tools	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.isoc.sd/sudanic.isoc.sd/billing_pricing.htm	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://static.land	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.siteleaf.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.nic.gp/index.php?lang=en	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.sbnic.net.sb/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://nic.ae/english/arabicdomain/rules.jsp	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://www.keyweb.de	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://eu.org/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://sae.sina.com.cn/	public-suffix-list.txt.3.dr	false		high
http://www.apache.org/).	NOTICE.3.dr, NOTICE.txt.3.dr	false		high
https://aws.amazon.com/elasticloadbalancing/	public-suffix-list.txt.3.dr	false		high
https://www.nic.it/sites/default/files/archivio/docs/Regulation_assignation_v7.1.pdf	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://e4you.cz/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://rancher.com	public-suffix-list.txt.3.dr	false		high
https://www.qnap.com	public-suffix-list.txt.3.dr	false		high
http://www.isnic.is/domain/rules.php	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.nic.priv.at/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://getchannels.com	public-suffix-list.txt.3.dr	false		high
http://www.kaashosting.nl/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://www.iodata.com/	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://domena.pl	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
http://hoster.by/	public-suffix-list.txt.3.dr	false		high
http://nic.krd/data/krd/Registration%20Policy.pdf	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown
https://bip.sh	public-suffix-list.txt.3.dr	false	Avira URL Cloud: safe	unknown

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1632113
Start date and time:	2025-03-07 19:51:55 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsfilecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Tracing
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	niga.jar
Detection:	MAL
Classification:	mal48.expl.winJAR@7/998@1/1
EGA Information:	Failed
HCA Information:	Successful, ratio: 70% Number of executed functions: 9 Number of non-executed functions: 1
Cookbook Comments:	Found application associated with file extension: .jar

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
2.59.41.142	GjThRAJ.exe	Get hash	malicious	Unknown	Browse
2.59.41.142	SecuriteInfo.com.Win64.Evo-gen.28617.20135.exe	Get hash	malicious	Unknown	Browse

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
gogo.fechrise.fun	SecuriteInfo.com.Win64.Evo-gen.28617.20135.exe	Get hash	malicious	Unknown	Browse	2.59.41.142
	SecuriteInfo.com.Win64.DropperX-gen.20149.32584.exe	Get hash	malicious	Unknown	Browse	95.216.227.249
	SecuriteInfo.com.Win64.DropperX-gen.20149.32584.exe	Get hash	malicious	Unknown	Browse	95.216.227.249

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TIMEWEB-ASRU	GjThRAJ.exe	Get hash	malicious	Unknown	Browse	2.59.41.142
	splx86.elf	Get hash	malicious	Unknown	Browse	92.53.113.157
	i686.elf	Get hash	malicious	Mirai	Browse	188.225.75.215
	https://33kuritsi.ru/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://gamma.app/docs/PDF-Scanned-Document-wldbj3tbiz3h3zk?mode=present#card-bc666izqridnjbr	Get hash	malicious	HTMLPhisher	Browse	5.23.50.101
	https://33kuritsi.ru/bitrix/redirect.php?event1=click_to_call&event2=&event3=&goto=https://gamma.app/docs/PDF-Scanned-Document-wldbj3tbiz3h3zk?mode=present#card-bc666izqridnjbr	Get hash	malicious	Unknown	Browse	5.23.50.101
	XkggQZnZYs.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	92.53.120.241
	SecuriteInfo.com.Win32.DropperX-gen.14963.7308.exe	Get hash	malicious	Unknown	Browse	5.23.51.54
	SecuriteInfo.com.Win32.DropperX-gen.14963.7308.exe	Get hash	malicious	Unknown	Browse	5.23.51.54
	RFQ R2100131125.pdf.scr.exe	Get hash	malicious	MSIL Logger, MassLogger RAT	Browse	5.23.51.54
	Deactivation notice for your workspace account (1).pdf	Get hash	malicious	Unknown	Browse	92.53.96.119

Process:	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_749031\java.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.810734669939355
Encrypted:	false
SSDEEP:	3:oFj4I5vpm4USFKLvn:oJ5bFKbn
MD5:	7FB2318FBF5ACF70355413CA81F75956
SHA1:	17ED69ECFAD12ADF802BEB559782987E5F30796F
SHA-256:	0CFA7C4A167888980127269487D40A679AD0B66CEA35C8754546EB0A3517A7C5
SHA-512:	7961BA51B4D7FA99CF7E743EEEC762966E5EFA140BBDD9DB57C49C84953E0C062D38B47D58849406A28E777CC72BAC5D45BAC9476B208F1C0C02503D0A494915
Malicious:	false
Reputation:	low
Preview:	C:\Program Files (x86)\Java\jre-1.8..1741373576741..

Process:	C:\Windows\System32\7za.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.747677659181117
Encrypted:	false
SSDEEP:	24:RsPd94GhZBkMHEX69EePl93V1Ghx8S3d+1b:RsIVbX69xl9F103d+1b
MD5:	FE4BE91F409551A7F7C039C12D96FCFE
SHA1:	B246DEB0FC8434C01DD7324262E606A85C01803B
SHA-256:	E4A19F1FF15E66449985F84ABE0593CF237108DC94B3E51BAA81632F82D9F3C5
SHA-512:	C7DA883D7C12CFB1A4552C27EC3CBF51F34E7C26B9AA5876FD8B83D90C555EC66AA63A4CF70F9984193EC73D8DF44260551FCA50E46D968E5D678E0EDF95AD4A
Malicious:	false
Reputation:	low
Preview:	// ------------------------------------------------------------------.// Transitive dependencies of this project determined from the.// maven pom organized by organization..// ------------------------------------------------------------------..Apache HttpClient...From: 'The Apache Software Foundation' (http://www.apache.org/). - Apache Commons Logging (http://commons.apache.org/proper/commons-logging/) commons-logging:commons-logging:jar:1.2. License: The Apache Software License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt). - Apache HttpCore (http://hc.apache.org/httpcomponents-core-ga) org.apache.httpcomponents:httpcore:jar:4.4.13. License: Apache License, Version 2.0 (http://www.apache.org/licenses/LICENSE-2.0.txt)..From: 'The Apache Software Foundation' (https://www.apache.org/). - Apache Commons Codec (http://commons.apache.org/proper/commons-codec/) commons-codec:commons-codec:jar:1.11. License: Apache License, Version 2.0 (https://www.apache.org/li

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report niga.jar

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Oracle\Java\.oracle_jre_usage\b5820291038aa69c.timestamp

C:\Users\user\AppData\Local\Temp\hsperfdata_user\1680

C:\jar\META-INF\DEPENDENCIES

C:\jar\META-INF\LICENSE

C:\jar\META-INF\LICENSE.txt

C:\jar\META-INF\MANIFEST.MF

C:\jar\META-INF\NOTICE

C:\jar\META-INF\NOTICE.txt

C:\jar\META-INF\maven\com.example\MyJavaApp\pom.properties

C:\jar\META-INF\maven\com.example\MyJavaApp\pom.xml

C:\jar\META-INF\maven\commons-codec\commons-codec\pom.properties

C:\jar\META-INF\maven\commons-codec\commons-codec\pom.xml

C:\jar\META-INF\maven\commons-logging\commons-logging\pom.properties

C:\jar\META-INF\maven\commons-logging\commons-logging\pom.xml

C:\jar\META-INF\maven\org.apache.httpcomponents\httpclient\pom.properties

C:\jar\META-INF\maven\org.apache.httpcomponents\httpclient\pom.xml

C:\jar\META-INF\maven\org.apache.httpcomponents\httpcore\pom.properties

C:\jar\META-INF\maven\org.apache.httpcomponents\httpcore\pom.xml

C:\jar\com\example\Main$A.class

C:\jar\com\example\Main.class

C:\jar\mozilla\public-suffix-list.txt

C:\jar\org\apache\commons\codec\BinaryDecoder.class

C:\jar\org\apache\commons\codec\BinaryEncoder.class

C:\jar\org\apache\commons\codec\CharEncoding.class

Windows Analysis Report
niga.jar