jli[.]dll | Triage™

Resubmissions

30/07/2026, 23:35

260730-3ldq3ahc9910

30/07/2026, 13:21

260730-qlpr4sar2110

Sharing

Copy URL Twitter E-mail

General

Target
jli.dll
Size 177.5MB
Sample260730-qlpr4sar21
SHA256 7c0242f8adad73fbe444ef189528566dc0b342a0b4f1af41662855cb0f88b2a3
MD5 756f552f0f081f3aabb154c249ddec31
SHA1 a2a81d98e6f7a22e0001cdb9ce3273975cf23507
SHA512 39ea123203d1651fa932daae7e1279f5f867db1a8bb1d99b8eff659c53a211457bf78e262074b558c6e120a677780ed1c43685fcc57cdaad2a4d07b059202329
SSDEEP 196608:qsv/lgvCwdgi/eglUVmBlCwMpS3jhVIZs:7v/lMdgClUVIjhVIZs
TLSH
T11798331EACF9F082C22A00B17AD469FDF431F670B66A48FE6ED94755482349BB3235D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jli.dll

File Explorer

jli.dll

.dll 177.5MB

jli.dll

IMPHASH f19f888c5c0d6f50f7a879abb65862d0
SHA256 7c0242f8adad73fbe444ef189528566dc0b342a0b4f1af41662855cb0f88b2a3
MD5 756f552f0f081f3aabb154c249ddec31
SHA1 a2a81d98e6f7a22e0001cdb9ce3273975cf23507
SHA512 39ea123203d1651fa932daae7e1279f5f867db1a8bb1d99b8eff659c53a211457bf78e262074b558c6e120a677780ed1c43685fcc57cdaad2a4d07b059202329
SSDEEP 196608:qsv/lgvCwdgi/eglUVmBlCwMpS3jhVIZs:7v/lMdgClUVIjhVIZs
TLSH
T11798331EACF9F082C22A00B17AD469FDF431F670B66A48FE6ED94755482349BB3235D1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

641264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

DeregisterEventSource RegCloseKey RegCreateKeyExW RegSetValueExW RegisterEventSourceW ReportEventW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

InitializeCriticalSectionEx EncodePointer CloseHandle CreateDirectoryW CreateEventExW CreateFileW CreateThread DuplicateHandle FindClose FindFirstFileW FindNextFileW FormatMessageW FreeConsole GetCPInfo GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetStdHandle GetThreadPriority LoadLibraryA LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime QueueUserAPC RaiseFailFastException ReadFile ResumeThread SetEvent SetLastError SetThreadPriority Sleep SleepEx VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile RaiseException AddVectoredExceptionHandler GetModuleHandleW RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue ResetEvent CreateEventW GetCurrentProcessId SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW LoadLibraryExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery DebugBreak GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo IsDebuggerPresent GetSystemTimeAsFileTime FlushProcessWriteBuffers InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FlsFree RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx InitializeSListHead

ole32

CoInitializeEx CoGetApartmentType CoUninitialize CoWaitForMultipleHandles

api-ms-win-crt-math-l1-1-0

log

api-ms-win-crt-string-l1-1-0

strcmp strcpy_s strlen strcpy _stricmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnprintf_s

vcruntime140

memmove __C_specific_handler _purecall memcpy memset

api-ms-win-crt-runtime-l1-1-0

abort terminate _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _initterm _initterm_e _seh_filter_dll _configure_narrow_argv

api-ms-win-crt-heap-l1-1-0

calloc free _callnewh malloc

Name

.text

Size

639KB

Virtual Size

639KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.5MB

Virtual Size

3.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

89KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.relov

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

jli.dll

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic