clrjit[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

clrjit.dll
Size

1.2MB
MD5

df347932e64192708ffa010982afc50b
SHA1

3c71715e36b83da6f81104b5616e946acecd4073
SHA256

d5a7a4e3151b1b6ccad38e2545b3c422223de64c9d91dfa812160030f2481b48
SHA512

b6a5d565a6a9d9263cacc0578a81a7205c634b1dbe95a13eef122b80686cc1168a88e2ce3c3f977dcb2b20fd067496c3b5ae539a880a79fc1270c91657921405
SSDEEP

24576:mk6qx5aELhzJNzGaR3wQNAj3FSlf8QCDIuyLeyvXJunOJRYj/T:yeaENzJ5GKpiDFCCDIZLeyvXJuOJ2rT

Score

1^/10

Malware Config

Signatures

Files

clrjit.dll
.dll windows:6 windows x64

c8945dc64b6927bd17dfe30702cccb25

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

Issuer

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16-03-2023 18:43

Not After

14-03-2024 18:43

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:0e:90:d2:00:00:00:00:00:03
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

08-07-2011 20:59

Not After

08-07-2026 21:09

Subject

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

98:9b:f6:bd:01:93:26:19:15:f6:83:ca:1b:b3:1f:46:da:cb:ba:dc:89:32:65:fc:d7:39:22:15:1d:ce:8c:d6
Signer

Actual PE Digest

98:9b:f6:bd:01:93:26:19:15:f6:83:ca:1b:b3:1f:46:da:cb:ba:dc:89:32:65:fc:d7:39:22:15:1d:ce:8c:d6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

advapi32

EventUnregister
EventRegister
EventWriteTransfer

kernel32

DecodePointer
EncodePointer
IsDebuggerPresent
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetCurrentThread
QueryThreadCycleTime
DisableThreadLibraryCalls
RaiseException
DebugBreak
OutputDebugStringA
GetModuleHandleExW
GetProcAddress
FreeLibrary
WideCharToMultiByte
QueryPerformanceCounter
QueryPerformanceFrequency
IsProcessorFeaturePresent

msvcr120_clr0400

fprintf
_wfopen
fclose
_wtoi
qsort
fseek
ftell
strcpy_s
sqrt
sqrtf
strcat_s
?_type_info_dtor_internal_method@type_info@@QEAAXXZ
?terminate@@YAXXZ
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
__crtCapturePreviousContext
__crtCaptureCurrentContext
__crtTerminateProcess
__crtUnhandledException
__crt_debugger_hook
__C_specific_handler
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
__CppXcptFilter
wcsncmp
_isnanf
_copysignf
_copysign
_isnan
_finite
memmove_s
memcpy_s
memmove
setvbuf
_fdopen
_setmode
_dup
_errno
__iob_func
_fileno
_purecall
sinf
sin
memset
memcpy
memcmp
fmodf
fmod
floorf
_CxxThrowException
__CxxFrameHandler3
ceil
ceilf
cos
cosf
floor
strcmp

Exports

Exports

getJit
jitStartup
sxsJitStartup

Sections

.text
Size: 957KB - Virtual size: 957KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 17B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c8945dc64b6927bd17dfe30702cccb25

Code Sign

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4dCertificate

Extended Key Usages

61:0e:90:d2:00:00:00:00:00:03Certificate

Key Usages

98:9b:f6:bd:01:93:26:19:15:f6:83:ca:1b:b3:1f:46:da:cb:ba:dc:89:32:65:fc:d7:39:22:15:1d:ce:8c:d6Signer

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

kernel32

msvcr120_clr0400

Exports

Exports

Sections

.text Size: 957KB - Virtual size: 957KB

.rdata Size: 101KB - Virtual size: 100KB

.data Size: 6KB - Virtual size: 7KB

.pdata Size: 107KB - Virtual size: 107KB

.tls Size: 512B - Virtual size: 17B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

33:00:00:03:4d:4e:91:a6:1a:28:b0:78:8f:00:00:00:00:03:4d
Certificate

61:0e:90:d2:00:00:00:00:00:03
Certificate

98:9b:f6:bd:01:93:26:19:15:f6:83:ca:1b:b3:1f:46:da:cb:ba:dc:89:32:65:fc:d7:39:22:15:1d:ce:8c:d6
Signer

.text
Size: 957KB - Virtual size: 957KB

.rdata
Size: 101KB - Virtual size: 100KB

.data
Size: 6KB - Virtual size: 7KB

.pdata
Size: 107KB - Virtual size: 107KB

.tls
Size: 512B - Virtual size: 17B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB