General

Malware Config

Signatures

Files

• clrjit_dump.dll

  .dll windows x86

  5a4d65d818316d86367f2b5dd55f8fb2

  
  

  Code Sign

  33:00:00:01:3c:ed:d3:5c:e9:30:dd:53:d0:00:00:00:00:01:3c

  Certificate

  Issuer

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  23-10-2019 23:17

  Not After

  21-01-2021 23:17

  Subject

  CN=Microsoft Time-Stamp Service,OU=Microsoft Ireland Operations Limited+OU=Thales TSS ESN:86DF-4BBC-9335,O=Microsoft Corporation,L=Redmond,ST=WA,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:37

  Not After

  02-05-2020 21:37

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:16:68:34:00:00:00:00:00:1c

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority,0.9.2342.19200300.100.1.25=#13096d6963726f736f6674,0.9.2342.19200300.100.1.25=#1303636f6d

  Not Before

  03-04-2007 12:53

  Not After

  03-04-2021 13:03

  Subject

  CN=Microsoft Time-Stamp PCA,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  33:00:00:01:52:9b:40:9f:50:56:99:75:88:00:00:00:00:01:52

  Certificate

  Issuer

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  02-05-2019 21:37

  Not After

  02-05-2020 21:37

  Subject

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  61:0e:90:d2:00:00:00:00:00:03

  Certificate

  Issuer

  CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Not Before

  08-07-2011 20:59

  Not After

  08-07-2026 21:09

  Subject

  CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  52:ea:ed:59:b4:59:45:12:8c:fe:c4:d7:6a:02:e9:df:97:f5:d8:3b:f3:fd:63:a9:ad:fa:ef:7a:b3:4f:9a:f1

  Signer

  Actual PE Digest

  52:ea:ed:59:b4:59:45:12:8c:fe:c4:d7:6a:02:e9:df:97:f5:d8:3b:f3:fd:63:a9:ad:fa:ef:7a:b3:4f:9a:f1

  Digest Algorithm

  sha256

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  20-01-2023 16:00

  Valid: false

  ee:02:c2:cb:70:ac:4b:1b:f3:28:58:34:08:ae:1e:b2:26:e3:73:d0

  Signer

  Actual PE Digest

  ee:02:c2:cb:70:ac:4b:1b:f3:28:58:34:08:ae:1e:b2:26:e3:73:d0

  Digest Algorithm

  sha1

  PE Digest Matches

  false

  Signature Validations

  Trusted

  false

  Verification

  Signing Certificate

  CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

  26-03-2020 22:59

  Valid: false

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  Imports

  kernel32

  IsDebuggerPresent

  GetSystemTimeAsFileTime

  GetCurrentThreadId

  LocalFree

  FormatMessageW

  GetACP

  GetCPInfo

  GetCurrentProcessId

  TerminateProcess

  SetLastError

  QueryPerformanceCounter

  QueryPerformanceFrequency

  QueryThreadCycleTime

  LoadLibraryExW

  FreeLibrary

  UnhandledExceptionFilter

  SetUnhandledExceptionFilter

  IsProcessorFeaturePresent

  InitializeSListHead

  OutputDebugStringA

  RaiseException

  DisableThreadLibraryCalls

  GetCurrentProcess

  GetModuleFileNameW

  GetEnvironmentVariableW

  MultiByteToWideChar

  GetLastError

  GetCurrentThread

  vcruntime140_clr0400

  memset

  memcmp

  _CxxThrowException

  memcpy

  _purecall

  __CxxFrameHandler3

  memmove

  _except_handler4_common

  __std_type_info_destroy_list

  ucrtbase_clr0400

  strcpy_s

  __stdio_common_vsnwprintf_s

  __stdio_common_vsnprintf_s

  wcsncpy_s

  _errno

  wcscat_s

  wcscpy_s

  _fpclass

  _isnan

  __stdio_common_vfprintf

  qsort

  fclose

  _wfopen

  _finite

  _initterm

  _initterm_e

  _seh_filter_dll

  _configure_narrow_argv

  _initialize_narrow_environment

  _initialize_onexit_table

  _execute_onexit_table

  _cexit

  advapi32

  EventWrite

  RegOpenKeyExW

  RegCloseKey

  RegQueryValueExW

  user32

  LoadStringW

  oleaut32

  SetErrorInfo

  Exports

  Exports

  getJit

  sxsJitStartup

  Sections

  .text

  Size: 484KB - Virtual size: 484KB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 33KB - Virtual size: 36KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .data

  Size: 2KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 1KB - Virtual size: 4KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 10KB - Virtual size: 12KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ