jli[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
jli.dll
Size 87KB
Sample260821-cmd54shb57
SHA256 8a838a176148e7651aa041c1f1f704176030de3f7dfd3cfbcc8fe0e6f148ce4c
MD5 5f753fc3e370c34212acd71a2ff5ace6
SHA1 bc3ca599d250fb0d5c672818b4d8553e9bbe9787
SHA512 0cde2b802d1491380f7734eb231d5c471d9b0c9687d8c86020d3fc6be202e5b73cd02fc5c22f34af689c3c51ae47ea5f8f7cfd9061212344f6057cc74964165a
SSDEEP 1536:jCV/KaLiixnqtkDwf9WKyc3m+zBIOkygcJtG2P7VIv:2VHiixrcfRyammkyggg2P+v
TLSH
T146938D5A53E011A1DEB7C1B8D9B05A0FD3F1F0562761838F136885AA0FA36623F1DBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

jli.dll

.dll 87KB

jli.dll

IMPHASH 2097d33aaab6d2d4ab091b0008ce291d
SHA256 8a838a176148e7651aa041c1f1f704176030de3f7dfd3cfbcc8fe0e6f148ce4c
MD5 5f753fc3e370c34212acd71a2ff5ace6
SHA1 bc3ca599d250fb0d5c672818b4d8553e9bbe9787
SHA512 0cde2b802d1491380f7734eb231d5c471d9b0c9687d8c86020d3fc6be202e5b73cd02fc5c22f34af689c3c51ae47ea5f8f7cfd9061212344f6057cc74964165a
SSDEEP 1536:jCV/KaLiixnqtkDwf9WKyc3m+zBIOkygcJtG2P7VIv:2VHiixrcfRyammkyggg2P+v
TLSH
T146938D5A53E011A1DEB7C1B8D9B05A0FD3F1F0562761838F136885AA0FA36623F1DBD9
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

d5:47:56:a4:0f:3b:85:34:9f:dd:36:f0:60:0e:39:54:34:96:8b:cd:89:2c:8a:2c:7a:92:f0:67:52:ed:65:b1

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Eclipse.org Foundation\, Inc.,O=Eclipse.org Foundation\, Inc.,L=Ottawa,ST=Ontario,C=CA

Chains

Apr 25, 2026

CN=Eclipse.org Foundation\, Inc.,O=Eclipse.org Foundation\, Inc.,L=Ottawa,ST=Ontario,C=CA

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=Eclipse.org Foundation\, Inc.,O=Eclipse.org Foundation\, Inc.,L=Ottawa,ST=Ontario,C=CA

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=Eclipse.org Foundation\, Inc.,O=Eclipse.org Foundation\, Inc.,L=Ottawa,ST=Ontario,C=CA

Serial Number

09:da:3a:d5:a3:21:ea:b5:d7:d1:43:53:39:c7:0c:69

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jul 17, 2025 - Jul 16, 2026

Minor OS version

Major OS version

Entry point

46528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

jli.pdb

comctl32

InitCommonControlsEx

user32

CharNextExA MessageBoxA

kernel32

IsDebuggerPresent CloseHandle GetLastError QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject GetExitCodeThread GetModuleFileNameA GetModuleHandleA GetModuleHandleExA GetProcAddress LoadLibraryA LocalFree FormatMessageA MultiByteToWideChar FindClose FindFirstFileA FindNextFileA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead

vcruntime140

memcpy strchr memset strrchr memcmp memmove __C_specific_handler __std_type_info_destroy_list

api-ms-win-crt-runtime-l1-1-0

_beginthreadex _initialize_onexit_table _initialize_narrow_environment exit _configure_narrow_argv _seh_filter_dll _initterm_e _initterm _errno perror strerror _cexit _execute_onexit_table

api-ms-win-crt-environment-l1-1-0

getenv _putenv

api-ms-win-crt-stdio-l1-1-0

_wopen _fileno fflush _close fopen ferror feof fread _lseeki64 __acrt_iob_func _read _open fclose __stdio_common_vsscanf __stdio_common_vsprintf __stdio_common_vfprintf fgets

api-ms-win-crt-filesystem-l1-1-0

_access _fstat64i32 _stat64i32

api-ms-win-crt-string-l1-1-0

strcmp strlen strncmp wcsncpy _stricmp _strdup wcslen strspn strcspn strcpy isspace strcat strpbrk

api-ms-win-crt-heap-l1-1-0

realloc calloc malloc free

Sharing

General

Malware Config

Signatures

File Explorer

jli.dll

comctl32

user32

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic