file_1783322653575.zip
- SHA256 bde4ae209ffa8b197d032c9752fa706f5268520cbdfac80338f24def99e4e31e
Static task
static1
2 signatures
General
- Target file_1783322653575.zip
- Size 40KB
- Sample260707-kbtqesdx6v
- SHA256 bde4ae209ffa8b197d032c9752fa706f5268520cbdfac80338f24def99e4e31e
- MD5 fa6d637e2d0c40911b8a3639ed7ec932
- SHA1 f58ce2fa6dfaaa9d50cf6cf1be1bdf467c8a68e6
- SHA512 494386f3cc59ce3ef452356e72f162ddb35f0ade4013b8fff6c569ee9978daa4e11d72b30ba62f4097c161ffe2694832dcaf78dd6c9bca24086f1154e7b2e431
- SSDEEP 768:xfthBaoigsbRHweNtvQ/da4UpWGceLgGgi9gQeRUzXlzjbK6LEzlqzN7xyEbsVGa:x8oi/bRH/OSp5ceXgi9cRiCw2lqzN7x6
- TLSH T18213F26DDE2DA4415C8F6DAB0582E57F88749291214F902EF070F55F67C4273A1B2BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- DLL Hijacking vulnerability 1 IoCs
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
resource unpack001/jli.dll - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/jli.dll
File Explorer
-
file_1783322653575.zip.zip 40KB
-
Open to View.exe.exe 48KB
-
jli.dll.dll 49KB
Open to View.exe
- IMPHASH b9867ad0234ff4fca6856a830af71438
- SHA256 7c9f3fa98d0678d1fe429825625bd06306d47a4b2a7d4c710c1f4d02165c39e4
- MD5 37d3b9ff8f3153ddffce7f8250a97ed3
- SHA1 f6e90157ff693499ce30ced12237a6df30f7c84f
- SHA512 975fef2e113a7b20d59e41b8d6783b71eeddcd6eaddc682f4dcef2b504460a3281ec10099c037a65bf4817240032c689e77a8b700b8270b16415365ccbe28337
- SSDEEP 768:oPh129M5R2TyJ5R3s8D/bkt5Ruz3Vb3935mYi1x5AL2DAbV:ahEM5RdJ5R3sozkt5RA3935m71jC
- TLSH T14F235C87AA182C81F02F84F094A7792655B47D032BD172FB7DCAB21E4D71391A8276DF
- MD5 SHA1 SHA512 SSDEEP TLSH
Digest
de:36:51:99:65:8f:96:d3:34:95:e0:f3:9f:bc:eb:a1:f4:d3:a0:8b:27:f3:c9:a3:00:d2:98:d7:40:28:f7:1a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Azul Systems\, Inc.,O=Azul Systems\, Inc.,L=Sunnyvale,ST=California,C=US
Chains
Oct 14, 2025
CN=Azul Systems\, Inc.,O=Azul Systems\, Inc.,L=Sunnyvale,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=Azul Systems\, Inc.,O=Azul Systems\, Inc.,L=Sunnyvale,ST=California,C=US
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=Azul Systems\, Inc.,O=Azul Systems\, Inc.,L=Sunnyvale,ST=California,C=US
Serial Number
03:72:bc:44:f5:59:f6:94:64:40:b5:8d:0a:19:21:a0
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jun 27, 2023 - Jun 26, 2026
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US
Serial Number
0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Jun 4, 2025 - Sep 3, 2036
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
5336
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
javaw.exe.pdb
jli
JLI_Launch
JLI_MemAlloc
JLI_CmdToArgs
JLI_GetStdArgc
JLI_GetStdArgs
JLI_MemFree
JLI_InitArgProcessing
kernel32
GetCurrentProcessId
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
GetModuleHandleW
GetCommandLineW
WideCharToMultiByte
QueryPerformanceCounter
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
vcruntime140
__current_exception
__current_exception_context
memset
memcpy
__C_specific_handler
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__p__commode
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
exit
__p___argc
__p___argv
terminate
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_initialize_onexit_table
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
perror
_crt_atexit
api-ms-win-crt-environment-l1-1-0
__p__environ
getenv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
224B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
336B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
56B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=2, id=257, version=28900,
count=18, id=261, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=9, id=260, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=2, id=259, productName=VS2022 v17.1.0 pre 1.0 build 30818, version=30818,
count=3, id=257, version=31106,
count=60, id=1, productName=Unmarked objects,
count=1, id=260, version=31106,
count=1, id=255, version=31106,
count=1, id=258, version=31106,
jli.dll
- IMPHASH 72bbdcf33c31dc8c9b3e28607bffa356
- SHA256 9dc507245633fa00bc36bc3ab46e8982528041f8d9c797e61755541eba3697ff
- MD5 2954c08192b68150b7f5a985ea85a1c1
- SHA1 56faf79d17411aa37fa3c41bb0da06285fff7ce9
- SHA512 adda39e4f473ef3ab19b0e93f56f46b6b30e95ad54a1552cc56a07a99a44e234b5b3bd2c64d5f40c7877ce2871bae0256e3a381c32c92227b1bba506dda4ef16
- SSDEEP 384:vss3vFQwyToBqxTTxJmE1gq6ULFZxxVRHliodajK3VLCZRi3n97HoO/pXufyy4TW:T3NQwgYiHZ1LFQGjKO/64TXfg9QEPwS
- TLSH T14233933ABD216661C040923AC0ABAE355D61BF254523BE99E0E28511FD42273FFDF78D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
72:c1:62:a5:f9:f5:f8:16:e2:01:0b:6a:46:77:28:6a:14:89:8b:dc
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=BEIJING XINDA HUANYU NETWORK SECURITY TECHNOLOGY CO.\,LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BEIJING XINDA HUANYU NETWORK SECURITY TECHNOLOGY CO.\,LTD,L=\ Beijing,ST=Beijing,C=CN
Chains
Jul 6, 2026
CN=BEIJING XINDA HUANYU NETWORK SECURITY TECHNOLOGY CO.\,LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BEIJING XINDA HUANYU NETWORK SECURITY TECHNOLOGY CO.\,LTD,L=\ Beijing,ST=Beijing,C=CN
Subject
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Serial Number
1b:09:3b:78:60:96:da:37:bb:a4:51:94:46:c8:96:78
Issuer
OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Timespan
Nov 8, 2006 - Nov 7, 2021
Subject
CN=BEIJING XINDA HUANYU NETWORK SECURITY TECHNOLOGY CO.\,LTD,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=BEIJING XINDA HUANYU NETWORK SECURITY TECHNOLOGY CO.\,LTD,L=\ Beijing,ST=Beijing,C=CN
Serial Number
23:b3:32:0a:66:ea:5e:be:1b:cc:6b:5a:d5:0f:5d:f3
Issuer
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Jul 17, 2012 - Jul 17, 2013
Subject
CN=VeriSign Class 3 Code Signing 2010 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)10,O=VeriSign\, Inc.,C=US
Serial Number
52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7
Issuer
CN=VeriSign Class 3 Public Primary Certification Authority - G5,OU=VeriSign Trust Network+OU=(c) 2006 VeriSign\, Inc. - For authorized use only,O=VeriSign\, Inc.,C=US
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Feb 8, 2010 - Feb 7, 2020
Minor OS version
0
Major OS version
4
Entry point
%!f(<nil>)
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
advapi32
GetUserNameA
OpenProcessToken
RegCloseKey
RegOpenKeyExA
gdi32
CreateCompatibleDC
DeleteObject
GetDeviceCaps
iphlpapi
GetAdaptersAddresses
kernel32
AddVectoredExceptionHandler
CloseHandle
CreateFileA
CreateThread
FlushInstructionCache
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetDiskFreeSpaceExA
GetFileAttributesA
GetFileSize
GetModuleHandleA
GetProcAddress
GetProcessHeap
GetSystemDirectoryA
GetSystemTime
GetTickCount
GetVersion
HeapAlloc
HeapFree
LoadLibraryA
OutputDebugStringA
Sleep
VirtualProtect
lstrcatA
lstrlenA
msvcrt
_time64
memset
srand
shell32
SHGetFolderPathA
user32
ClipCursor
EnumWindows
GetDoubleClickTime
GetForegroundWindow
GetKeyboardLayout
GetSystemMetrics
GetWindowThreadProcessId
IsWindowVisible
wsprintfA
ws2_32
WSACleanup
WSAStartup
gethostname
JLI_AddArgsFromEnvVar
JLI_CmdToArgs
JLI_GetAppArgIndex
JLI_GetStdArgc
JLI_GetStdArgs
JLI_InitArgProcessing
JLI_Launch
JLI_List_add
JLI_List_new
JLI_ManifestIterate
JLI_MemAlloc
JLI_MemFree
JLI_PreprocessArg
JLI_ReportErrorMessage
JLI_ReportExceptionDescription
JLI_ReportMessage
JLI_SetTraceLauncher
JLI_StringDup
sub_bqgl_10
sub_cg5e_13
sub_coo6_4
sub_cycq_12
sub_e9cg_26
sub_ea7i_0
sub_efbx_11
sub_ehw1_27
sub_fefx_3
sub_fitc_8
sub_fkb8_15
sub_fl1f_7
sub_flgr_1
sub_h6hl_28
sub_h97j_21
sub_hg5q_29
sub_hu1x_6
sub_id9p_18
sub_ip6k_5
sub_j3np_22
sub_jhjg_17
sub_krvx_16
sub_ls9x_19
sub_qbq4_9
sub_r3n1_2
sub_rfiq_23
sub_rp9g_20
sub_uymu_24
sub_xyk9_25
sub_yelz_14
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
64B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
27KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
976B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ