Tax-Number919863.zip
- SHA256 e329a261e98d890fb4184ac6ccbaf4a2b39335f87d20e1f383cfa89394bc32d2
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
Tax-Number919863.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tax-Number919863.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
jli.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
jli.dll
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Tax-Number919863.zip
- Size 1.4MB
- Sample260619-pfty7sg19v
- SHA256 e329a261e98d890fb4184ac6ccbaf4a2b39335f87d20e1f383cfa89394bc32d2
- MD5 a3aa10fcf7348b67511ca5c942078525
- SHA1 d8e1f5b8a073609d5a8b10e9da8ce45b1887eb20
- SHA512 570af7dcd2f9e1539d553a12853698e446ba212cf1ec511681feb47f9bf601022c6430c5a946f5d9b7c9999219c16dec9f24a80abde2ca08f030041dfb9407ad
- SSDEEP 24576:keLTrbTPRe0ImpxnZ8+etdOpig3cX0ABw3KH18ic6:kSemvZ8+Tsf29/6
- TLSH T1F765D03AFB343191F95C6EB0BF04599857EEAED6969CCF1072407F194CF66A08389836
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack002/jli.dll - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack002/jli.dll
File Explorer
-
Tax-Number919863.zip.zip 1.4MB
-
Tax-Number919863.img.iso 363.4MB
-
Tax-Number919863.exe.exe 24KB
-
jli.dll.dll 362.9MB
Tax-Number919863.img
- SHA256 03a0ca970508e5ee765d3c7d465d6ec922abde4e95e18248b1192df0646c2b89
- MD5 da9a44e1590af9e57f71a6ab3017d0c3
- SHA1 a416923796b542809af88d3450a7c7f7ffb12fc7
- SHA512 8aabb95bfd415ae0f6e2c1e3ae9c61af11f2fac9ddb65ed9e6d36139989e15cce14670b12fe1dc2de7537bd77736c883d45ed77510a465c73c38e551beb005bf
- SSDEEP 49152:9miwfzLdmqZCLzseyb2jEem/M0ALeE4n/pB5dXkzzsp:efzF7Yhm/M0ALeE4n/pB5dXkzzsp
- TLSH T1EE098D07B3B01AA8F51EC5348767963ED172F86347658D8BAA95E7093E33B804B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
Tax-Number919863.exe
- IMPHASH 1b382c703e8dad00285539abb287642a
- SHA256 233086e7d57e16523ac3463df306cfc497a9ba3c3e8268f62c8625ef56b2380e
- MD5 3c305f878c678e9017e3e53fb6020283
- SHA1 b8f157d19017065ccad21e5ceae21184d0fc3e5d
- SHA512 7783d325bf738dbbc2a35545e2aa31d672dbab7e255720d83a9da66ce885eb0a60853211e95748f8bd3bcd3c470f2a9e8d10bb767b02f8a14511cec6e748e7ec
- SSDEEP 384:8qRg0yFtNq5Awt9F7heZBLy8RbmL4nNyGu0:eFnq5xtgBL5AL10
- TLSH T1B8B27C67CE500CCBFE1A8AB0A0E59227FC32B6999ED1D3C35378C1550F513817A9A2E9
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
a1:9e:e8:73:71:7c:cb:a9:ba:c7:09:bb:8a:19:2d:0e:d3:09:b2:a4:72:6e:20:05:92:6d:ff:4a:22:61:1c:9a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a
Chains
Mar 2, 2026
SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a
CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a
CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US
Serial Number
07:60:2c:bf:6e:75:79:40:03:82:56:f0:ad:87:5e:d6
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 14, 2023 - Feb 13, 2033
Subject
SERIALNUMBER=26502275,CN=JetBrains s.r.o.,O=JetBrains s.r.o.,L=Prague,C=CZ,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302435a
Serial Number
08:3e:a1:38:84:bd:ff:ce:8e:5d:9d:5c:ad:2e:fb:de
Issuer
CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Aug 26, 2025 - Aug 25, 2028
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
5320
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
rmiregistry.exe.pdb
jli
JLI_Launch
JLI_MemAlloc
JLI_CmdToArgs
JLI_GetStdArgc
JLI_GetStdArgs
JLI_MemFree
JLI_InitArgProcessing
kernel32
GetCurrentProcessId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
GetModuleHandleW
GetCommandLineW
WideCharToMultiByte
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
vcruntime140
__current_exception
__current_exception_context
memset
memcpy
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__p__commode
api-ms-win-crt-runtime-l1-1-0
perror
_register_onexit_function
exit
__p___argc
__p___argv
_seh_filter_exe
terminate
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_initialize_onexit_table
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_crt_atexit
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
main
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
368B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
324B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=35207,
count=2, id=257, version=27412,
count=2, id=259, version=35207,
count=9, id=260, version=35207,
count=18, id=261, version=35207,
count=3, id=257, version=35223,
count=59, id=1, productName=Unmarked objects,
count=1, id=260, version=35223,
count=1, id=256, version=35223,
count=1, id=255, version=35223,
count=1, id=258, version=35223,
jli.dll
- IMPHASH 197633b68e25508567a9e32764dba1bc
- SHA256 2a0b3f4f734fa6dd6e1fb8b8cb667b67fde0811c1b826db4b7a967a2fd7489a9
- MD5 54ebfd863c43fa81739905481aeaf2b5
- SHA1 5456ce649df3b6fc270b95ecdd3622a28a0dc1ce
- SHA512 eaf8c822f28defea1ad95f51a58305e9dfd469a363a26e0be53f3ac4e6456c11417c3400ed0ef765513e747c3d319805bca6b51112fc7129ad7ffcfbb5082d13
- SSDEEP 49152:5miwfzLdmqZCLzseyb2jEem/M0ALeE4n/pB5dXkzzspv:SfzF7Yhm/M0ALeE4n/pB5dXkzzspv
- TLSH T168098D07B3B01AA8F51EC5348767963ED172F86347658D8BAA95E7093E33B804B3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
787844
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
RegisterEventSourceW
ReportEventW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
bcrypt
BCryptGenRandom
kernel32
InitializeCriticalSectionEx
EncodePointer
CloseHandle
CreateEventExW
DuplicateHandle
FormatMessageW
FreeConsole
FreeLibrary
GetCPInfo
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentProcessorNumberEx
GetCurrentThread
GetEnvironmentVariableW
GetLastError
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
GetStdHandle
GetThreadPriority
GetTickCount64
LoadLibraryExW
LoadLibraryW
LocalAlloc
LocalFree
MultiByteToWideChar
OpenProcess
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseFailFastException
ReadProcessMemory
SetEvent
SetLastError
SetThreadErrorMode
Sleep
VirtualAlloc
VirtualFree
VirtualProtectEx
WaitForMultipleObjectsEx
WideCharToMultiByte
WriteFile
WriteProcessMemory
RaiseException
AddVectoredExceptionHandler
RtlVirtualUnwind
RtlCaptureContext
RtlRestoreContext
VerSetConditionMask
FlsAlloc
FlsGetValue
FlsSetValue
ResetEvent
WaitForSingleObjectEx
CreateEventW
SwitchToThread
CreateThread
GetCurrentThreadId
SetThreadPriority
SuspendThread
ResumeThread
FlushProcessWriteBuffers
GetThreadContext
SetThreadContext
GetSystemTimeAsFileTime
CreateMemoryResourceNotification
QueryInformationJobObject
GetModuleHandleExW
GetProcessAffinityMask
VerifyVersionInfoW
InitializeContext
GetEnabledXStateFeatures
LocateXStateFeature
SetXStateFeaturesMask
VirtualQuery
DebugBreak
WaitForSingleObject
SleepEx
GlobalMemoryStatusEx
GetSystemInfo
GetLogicalProcessorInformation
GetLogicalProcessorInformationEx
GetLargePageMinimum
VirtualUnlock
VirtualAllocExNuma
IsProcessInJob
GetNumaHighestNodeNumber
GetProcessGroupAffinity
K32GetProcessMemoryInfo
IsDebuggerPresent
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
FlsFree
RtlPcToFileHeader
InterlockedFlushSList
RtlUnwindEx
InitializeSListHead
ole32
CoWaitForMultipleHandles
CoGetApartmentType
CoUninitialize
CoInitializeEx
CoCreateGuid
api-ms-win-crt-math-l1-1-0
log
ceil
api-ms-win-crt-heap-l1-1-0
free
malloc
calloc
_callnewh
api-ms-win-crt-string-l1-1-0
_stricmp
strlen
strcmp
strcpy_s
strcpy
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsnprintf_s
api-ms-win-crt-runtime-l1-1-0
terminate
_cexit
abort
_seh_filter_dll
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_initterm_e
_initterm
1LHPgMQJwl1bCFwHbW7h3fJxyDl0sYsc
2AcP2ybWdnYdXIdLK6WzxEdr0rUu
6gXAEpWlAqe9k
8UyE3yjbnfOh6WKxEX0LN
8V8524C361KlFCbMrgLW
8l8jOlzkoJvGAzOzQSUecPAV1A9Di
9PRlpVanzotq
AiyJEENQVk9sA2AoqoQ3fzMwfjVVgtvK
BCDQ8Mufj9DVW3FzRwILTicDgIzN
BMVYqaswrwwyGYHybQR5VC
EIryLV1EK4t
H0S0zxNHqtnxB8DGpxTDdADgF2M
IUYWP08joh2qQ0
JLI_AddArgsFromEnvVar
JLI_CmdToArgs
JLI_GetAppArgIndex
JLI_GetStdArgc
JLI_GetStdArgs
JLI_InitArgProcessing
JLI_Launch
JLI_List_add
JLI_List_new
JLI_ManifestIterate
JLI_MemAlloc
JLI_MemFree
JLI_PreprocessArg
JLI_ReportErrorMessage
JLI_ReportExceptionDescription
JLI_ReportMessage
JLI_SetTraceLauncher
JLI_StringDup
JpxOvgpAWKZI
LYEwBr7v
MiPghMJyE
Mx9toS4ZB8vEkeuPiqYOCLlrkotwqit
O2Sr8WEIEfURET1jVCqIVu3R
PZeCT63n
PxuIwaEHld
QtfpTiJncI36
T7cVz20JKWtORacV4wdtSu8mjurWU
Tbhh77fBgcemvOOwycEHmiOhWdVgwrC
VEk3StU654gcKV
VbuyGv9RKfNC
VuwM8rYAjbxBGVgJllHZf
X80DdiMzCa9YuO
aKcnOfbiZrWIgvs0hprwbxbYEaOyseeQ
d44JmFCNftyjpXIBob4p
gVxP6X3IlO8PCDgO38ShqQVeyNm
hyo4pzTaBLQM4jMWx
iVybirUf6XqXqggmzwMUEeZ
jnike5f1PjOkNKtONwt6
k9wMjaRJFV8gFYfcry3A64e
n8MzVZHzbQ0D8gqacp4udoGcd23EzpA
nM3qkVw8QzFLZQwAHG1tpIVpGU2MyMJ
okjg3bhpmKJ
pID8WUEOwJsFg3T
paZwRAp53e8cOne0edbh
qLMxegrpJTLcv5xDr9vnjB9
rKQZuUpMDkIh7MrL
s1qqLulqWa8yTlKg256me9kENDGQ
tXPCMbWVW4QbwQql5Xo
u6TwJGCvQahPgrWrK18O32Jnhu69Rq
vv6pPywLUMDx7PV1o4
wOycPiI1
xG03ogsmXHGAb9APdcaKM
xbyDOY6qfynVaRcH
y8cNTN1jzEiw4VDpzNZYVpeld
yeZu4eLHf3bQ52xR4QCi
zojnT7AU3IV8rKkWW8Jbs4F
zvXFToIN849nv
Name
.text
Size
786KB
Virtual Size
786KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
372KB
Virtual Size
371KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
74KB
Virtual Size
119KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
48KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
630KB
Virtual Size
630KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ