- First seen
- Last seen
THREAT SIGNALMedium-low
Read alongside the verdict
Indicator overview
INDICATOR PROFILEThe VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
- SHA256
0f3e20de6bcb508d19f87dad0602ec750069bf0ccda3254cf0fa09a8daaf16c1- SHA1
b73ec983d95bf34f227ec35697d769737a71f422- MD5
6203aabb84942788dbd323018bae12bd- Filename
- Unconfirmed 941337.crdownload
- File type
- jar
- MIME
- application/java-archive
- File size
- 20899251
- Filename variants
- 2 reported
- TLSH
T1CD27330256ED627DC82B6772C02185A76D3420CD9A0BA44BFE78078F4EE5E571B9D3EC- SSDEEP
393216:9B6zJYjAOBBwk0hVnvQODC4CTYVJnLsYv+JtKONddUODvK2INJ:ezJYjAOJ2VvpD7lODpNHtUNJ
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (9%).
Confidence signal
VirusSign confidence is elevated at 68%. Use it as supporting evidence together with detections, family and relationship context.
Analysis signals
OBSERVEDEngine detections9%
VirusSign confidence68%
Relationship context5 visible
Threat classificationjava
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
0%
2209592 bytes
contains
Filename
cj.anc
MIME
application/octet-stream
Size
2209592
SHA1
171c91254d6c0f2466e85444e739f11fa18d089f
First seen
2026-10-13T03:30:00Z
0%
elf
6582304 bytes
contains
Filename
libimgui-java64.so
File type
elf
MIME
application/x-elf
Size
6582304
SHA1
769f408d81e68a2ae6b2e72cfc9d50a370f41475
0%
ttf
127872 bytes
contains
Filename
src_assets_fonts_geistsemibold.ttf
File type
ttf
MIME
font/ttf
Size
127872
SHA1
33f41ec5829fb071a0b1ed5ab0e2f5e3ac0388f1
0%
ttf
127660 bytes
contains
Filename
fild9lw7soSvIhJGNt3p_1ss5CUyPQ
File type
ttf
MIME
font/ttf
Size
127660
SHA1
ee332d9aa34699a998a46f4115dbaaf8f3d0221b
0%
jar
31654 bytes
contains
Filename
fabric-rendering-fluids-v1-3.1.4+4ebb5c083e-46d4faacdb1822a1.jar
File type
jar
MIME
application/java-archive
Size
31654
SHA1
23e391b0b031fcac2788ffbf637bb6fcc712d917
Analysis details
Severity: hightrojandebug-checkjarenv-checkprocess-renameobfuscated
Freshness: Recent · Last seen 27 days ago.
- Detection rate
- 9%
- Threat type
- trojan
- Family
- java
- Confidence
- 68%
- detection
- 9 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
0f3e20de6bcb508d19f87dad0602ec750069bf0ccda3254cf0fa09a8daaf16c1- SHA1
b73ec983d95bf34f227ec35697d769737a71f422- MD5
6203aabb84942788dbd323018bae12bd- Filename
- Unconfirmed 941337.crdownload
- File type
- jar
- MIME
- application/java-archive
- File size
- 20899251
- TLSH
T1CD27330256ED627DC82B6772C02185A76D3420CD9A0BA44BFE78078F4EE5E571B9D3EC- SSDEEP
393216:9B6zJYjAOBBwk0hVnvQODC4CTYVJnLsYv+JtKONddUODvK2INJ:ezJYjAOJ2VvpD7lODpNHtUNJ- First seen
- 2026-10-13T19:59:37Z
- Last seen
- 2026-10-14T17:47:28Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Review the detections and related infrastructure.
Detection signal
Suspicious. A limited set of engine detections is present (9%).
Confidence signal
VirusSign confidence is elevated at 68%. Use it as supporting evidence together with detections, family and relationship context.
Threat context
Classification includes type trojan and family java.
Relationship context
5 related indicators are shown across 1 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
6 timestamped observations are arranged from 2025-10-14 to 2026-10-13. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.
Reported engine detection rate. A low rate alone does not establish that the indicator is benign.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
1 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family java.
Last seen 27 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- Unconfirmed 941337.crdownload
- File type
- jar
- MIME
- application/java-archive
- Size
- 20899251
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- A DLL was loaded from a suspicious directory
- A process created a hidden window
- Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
- Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
- Attempted to spawn a new child process from dynamically allocated (unbacked) memory
5 shown
View MITRE ATT&CK details · 5 shown
- T1574 — A DLL was loaded from a suspicious directoryTactics: TA0002 · TA0005
- T1564.003 — A process created a hidden windowTactics: TA0005
- T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven executionTactics: TA0004 · TA0005
- T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patchingTactics: TA0004 · TA0005
- T1055 · T1106 — Attempted to spawn a new child process from dynamically allocated (unbacked) memoryTactics: TA0002 · TA0004 · TA0005
5 shown
View MBC details · 5 shown
- CommunicationObjectives: OC0006
- E1480.001 — E1480.001
- ExecutionObjectives: OB0009
- C0002 — HTTP CommunicationObjectives: OC0006
- E1564 — Hide ArtifactsObjectives: OB0006 · OB0012
5 shown