jli[.]dll[.]exe | Triage™

General

Target
jli.dll.exe
Size 688KB
Sample261027-2ebgpag17m
SHA256 63bfe87318bc8f9826f819d0233359e0c5c1843cad41d216c19dddf67ae6a032
MD5 4b0195823130b6e9e19aa454d47887f8
SHA1 33f61a45849150fbd1d0b5b9117ac94b23f401fe
SHA512 587919f2c761d3e3e9b815b9128ea06c59512f9cfcd61718866dc2953558805b49c228bdadd192c3a501dce155ba39f4856d712978c0296f2c905aab93df167e
SSDEEP 12288:iEfHLFxnf9SAz6ExVglO/AYcjXxE/Gh4JARzQ3C69QwEsFEjJhIyCD5tip/7m3Ji:iEfHLTHKO9cjGC4qRzUC693ejJqyCDWj
TLSH
T1B5E41211F2E681E9D529C13486138906A9B5BC118B50AAFF93D8E73E0F777E4833EB51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jli.dll.exe

File Explorer

jli.dll.exe

.dll 688KB

jli.dll.exe

IMPHASH 7d3bb06a79688514926fc09a23a49e9c
SHA256 63bfe87318bc8f9826f819d0233359e0c5c1843cad41d216c19dddf67ae6a032
MD5 4b0195823130b6e9e19aa454d47887f8
SHA1 33f61a45849150fbd1d0b5b9117ac94b23f401fe
SHA512 587919f2c761d3e3e9b815b9128ea06c59512f9cfcd61718866dc2953558805b49c228bdadd192c3a501dce155ba39f4856d712978c0296f2c905aab93df167e
SSDEEP 12288:iEfHLFxnf9SAz6ExVglO/AYcjXxE/Gh4JARzQ3C69QwEsFEjJhIyCD5tip/7m3Ji:iEfHLTHKO9cjGC4qRzUC693ejJqyCDWj
TLSH
T1B5E41211F2E681E9D529C13486138906A9B5BC118B50AAFF93D8E73E0F777E4833EB51
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

tagrez.pdb

kernel32

CloseHandle CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetConsoleTitleW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetPhysicallyInstalledSystemMemory GetProcAddress GetProcessAffinityMask GetProcessHandleCount GetProcessHeap GetProcessId GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemPowerStatus GetSystemTimeAsFileTime GetSystemTimes GetThreadId GetThreadPriority GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

88KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

336KB

Virtual Size

335KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

256KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

137B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jli.dll.exe

kernel32

api-ms-win-core-synch-l1-2-0

generic