JRTools[.]dll | Triage

Sharing

Copy URL Twitter E-mail

General

Target

JRTools.dll
Size

4.8MB
MD5

7e1c13f01c8993c2a98189b5c5450bdd
SHA1

93d8667c2925e9d6fcd4be29fe80f5f73298ee49
SHA256

8643ae236a3b3b4ce9fdab9c067c2d145538cca8f95a93eadcfe40aca750f72a
SHA512

90cc49fad8dbdcacc3d5374bc1857150968d21ad0be042be45249db1182589d3838d0c3d0fe5e3a296f28e2383b7cdee49ac33d7e8f8cdb851817263e696053b
SSDEEP

98304:B5Biz008csZ6aZ93/LCp5KCjq7XyK+mkul1tTaBEeiofV:nBiz0TcQDDCGC27Emt1tTW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JRTools.dll

Files

JRTools.dll
.dll windows:6 windows x64 arch:x64

45dc0ba57f23ea8c40fe91ab111fef52

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleFileNameW
RtlUnwind
OutputDebugStringW
MoveFileW
GetCurrentProcess
CloseHandle
WaitForSingleObject
CreateMutexW
SetProcessWorkingSetSize
TryEnterCriticalSection
GetFileAttributesW
GetTimeZoneInformation
GetDateFormatW
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
FindClose
FindFirstFileW
SetFileTime
LocalFileTimeToFileTime
DosDateTimeToFileTime
GetFileTime
CopyFileW
SetEvent
CreateEventW
Sleep
ReleaseMutex
GetSystemDefaultLocaleName
GetUserDefaultLocaleName
SetThreadExecutionState
SetWaitableTimer
CreateWaitableTimerW
GetUserDefaultLCID
CompareStringW
CreateFileW
lstrlenW
DeviceIoControl
GetLastError
HeapSize
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
CreateFileA
GetFileAttributesA
GetFileInformationByHandle
GetFileType
GetFullPathNameW
ReadFile
WriteFile
PeekNamedPipe
GetExitCodeProcess
MultiByteToWideChar
WideCharToMultiByte
IsValidCodePage
GetACP
GetOEMCP
HeapAlloc
HeapFree
GetProcessHeap
GetStdHandle
SearchPathA
DuplicateHandle
SetHandleInformation
CreatePipe
CreateProcessA
OpenProcess
GetProcAddress
LoadLibraryA
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
LoadLibraryExA
GetDriveTypeW
GetLongPathNameW
GlobalAlloc
GlobalLock
GlobalFree
GlobalUnlock
GetLocalTime
GetTimeFormatW
TerminateThread
GetThreadPriority
ResetEvent
WaitForMultipleObjects
SetThreadPriority
ResumeThread
GetSystemDirectoryW
GetDiskFreeSpaceExW
GetLogicalDrives
RemoveDirectoryW
GetComputerNameW
SetFileAttributesW
DeleteFileW
GetCurrentProcessId
TerminateProcess
GetCurrentThreadId
LoadLibraryExW
LocalFree
CreateToolhelp32Snapshot
Process32First
Process32Next
SetFilePointer
SetEndOfFile
GetFileSize
FlushFileBuffers
GlobalSize
FindNextFileW
GetVersionExW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetComputerNameA
GetSystemDirectoryA
GetCommandLineW
MulDiv
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
LoadLibraryW
lstrcmpW
QueryPerformanceCounter
QueryPerformanceFrequency
GetStringTypeW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
CompareStringEx
GetCPInfo
LCMapStringEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
InterlockedFlushSList
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
SetStdHandle
ExitProcess
SetFilePointerEx
SetEnvironmentVariableW
GetCurrentDirectoryW
CreateDirectoryW
GetConsoleMode
ReadConsoleW
GetConsoleOutputCP
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
LCMapStringW
GetLocaleInfoW
IsValidLocale
EnumSystemLocalesW
HeapReAlloc
GetFileSizeEx
FindFirstFileExW
GetCommandLineA
IsDebuggerPresent
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress

user32

GetClassNameW
GetClassInfoW
GetDoubleClickTime
BeginPaint
EndPaint
MessageBeep
PeekMessageW
FlashWindowEx
ValidateRect
GetGUIThreadInfo
IsZoomed
IsIconic
EnableWindow
IsWindowEnabled
ShowWindow
SetWindowPos
GetWindowLongW
SetWindowLongW
GetClientRect
ClientToScreen
RedrawWindow
InvalidateRect
UpdateWindow
SetWindowRgn
SetParent
GetLastActivePopup
GetCapture
SetCapture
ReleaseCapture
LockSetForegroundWindow
GetForegroundWindow
AttachThreadInput
SetForegroundWindow
DestroyIcon
SetClipboardViewer
ChangeClipboardChain
LoadImageW
DrawIconEx
CopyIcon
FindWindowW
EnumWindows
WaitMessage
FindWindowExW
WindowFromPoint
GetWindowTextLengthW
GetScrollPos
ScreenToClient
GetCursorPos
SystemParametersInfoW
MapVirtualKeyW
GetKeyState
SendInput
GetKeyboardLayout
MapVirtualKeyExW
SetTimer
SetClipboardData
EmptyClipboard
EnumDisplayMonitors
MonitorFromRect
GetSystemMetrics
GetMonitorInfoW
GetWindowPlacement
SetWindowPlacement
SetWindowsHookExW
UnhookWindowsHookEx
CallNextHookEx
GetMessagePos
DestroyCursor
DrawIcon
CreateIconFromResource
CreateCursor
GetTopWindow
DrawStateW
GetIconInfo
CallWindowProcW
PtInRect
DrawTextW
GetWindowDC
IsRectEmpty
GetUpdateRect
GetSystemMenu
GetMenuDefaultItem
SetMenuDefaultItem
TrackPopupMenu
GetClassLongPtrW
GetScrollInfo
ShowScrollBar
LoadCursorW
GetDesktopWindow
GetWindowRect
GetWindow
GetWindowThreadProcessId
GetFocus
SetFocus
PostMessageW
UnregisterClassW
KillTimer
DestroyWindow
CreateWindowExW
RegisterClassW
MessageBoxW
MsgWaitForMultipleObjects
SendMessageW
GetSysColor
EnumChildWindows
SetWindowTextW
GetWindowTextW
GetDC
ReleaseDC
IsWindow
DefWindowProcW
SetWindowLongPtrW
GetWindowLongPtrW
DispatchMessageW
TranslateMessage
GetParent
GetMessageW
CloseClipboard
GetClipboardData
IsClipboardFormatAvailable
OpenClipboard
OffsetRect
SetCursor
RegisterClipboardFormatW

gdi32

CreateRectRgn
GetTextExtentPoint32W
SaveDC
RestoreDC
SelectObject
SelectClipRgn
RectVisible
CreateEllipticRgn
CreateSolidBrush
Ellipse
CombineRgn
GetDeviceCaps
ExtTextOutW
SetBkColor
DeleteDC
OffsetRgn
DeleteObject
GetObjectW
GetStockObject
AddFontResourceW
BitBlt
SetBkMode
GetTextExtentPointW
SetTextColor
OffsetWindowOrgEx

advapi32

RegRestoreKeyW
RegSaveKeyW
RegEnumValueW
RegEnumKeyW
RegSetValueExW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteValueW
RegDeleteKeyW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegDeleteValueA
RegOpenKeyExA
RegSetValueExA
RegCreateKeyExA
RegQueryValueExA

ole32

CoCreateInstance
CoFreeUnusedLibraries
CoTaskMemFree
CoInitialize
OleUninitialize
CoUninitialize

oleaut32

SysFreeString
SysAllocString

imm32

ImmGetContext
ImmGetCompositionStringW
ImmReleaseContext

wintrust

WinVerifyTrust

bcrypt

BCryptCreateHash
BCryptDeriveKeyPBKDF2
BCryptDestroyKey
BCryptEncrypt
BCryptHashData
BCryptSetProperty
BCryptGetProperty
BCryptFinishHash
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider
BCryptGenerateSymmetricKey

Exports

Exports

GetJRToolsDLL
JRLogExternal

Sections

.text
Size: - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 893KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 170KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.W%k
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.$'~
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.mQ{
Size: 4.8MB - Virtual size: 4.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 200B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

45dc0ba57f23ea8c40fe91ab111fef52

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

ole32

oleaut32

imm32

wintrust

bcrypt

Exports

Exports

Sections

.text Size: - Virtual size: 3.0MB

.rdata Size: - Virtual size: 893KB

.data Size: - Virtual size: 170KB

.pdata Size: - Virtual size: 111KB

.W%k Size: - Virtual size: 1.3MB

.$'~ Size: 4KB - Virtual size: 3KB

.mQ{ Size: 4.8MB - Virtual size: 4.8MB

.reloc Size: 512B - Virtual size: 200B

.rsrc Size: 1024B - Virtual size: 1KB

.text
Size: - Virtual size: 3.0MB

.rdata
Size: - Virtual size: 893KB

.data
Size: - Virtual size: 170KB

.pdata
Size: - Virtual size: 111KB

.W%k
Size: - Virtual size: 1.3MB

.$'~
Size: 4KB - Virtual size: 3KB

.mQ{
Size: 4.8MB - Virtual size: 4.8MB

.reloc
Size: 512B - Virtual size: 200B

.rsrc
Size: 1024B - Virtual size: 1KB