jli[.]dll[.]exe | Triage™

General

Target
jli.dll.exe
Size 701KB
Sample261030-x9ltpass7j
SHA256 e8d05013f9fc7db819bda0ea2d7280cee95ca7ae325c3e1b3e78e9c88f40c568
MD5 3ce212d536a72b47603151a53c3395d7
SHA1 162a62d5fdfa3af3b48027ade279435620e1bdd7
SHA512 78f544b45da875e2ce0dc8a40dfa3d475911b7b484244bc24b52a2676dbf579ea8b573b48d47c91fc90ca6f18c2389c7c77c8f3c6eb36a83ef649096c47fb20c
SSDEEP 12288:WYLq1qA+hHPr+Cnojxf2C7UlkYmpJ6q1OP4XybWjwzZfxWil4MDkQR8van0j:WYLEq5vOuC7UlG/h1Ogy683Ws/j0j
TLSH
T1B3E40255B6D441A9E066D038CA139615E6B27C018F60EAFB13D2A73A2F377E4973EF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jli.dll.exe

File Explorer

jli.dll.exe

.dll 701KB

jli.dll.exe

IMPHASH 7e5d8128f1dd97b20b2caf9192f4e22c
SHA256 e8d05013f9fc7db819bda0ea2d7280cee95ca7ae325c3e1b3e78e9c88f40c568
MD5 3ce212d536a72b47603151a53c3395d7
SHA1 162a62d5fdfa3af3b48027ade279435620e1bdd7
SHA512 78f544b45da875e2ce0dc8a40dfa3d475911b7b484244bc24b52a2676dbf579ea8b573b48d47c91fc90ca6f18c2389c7c77c8f3c6eb36a83ef649096c47fb20c
SSDEEP 12288:WYLq1qA+hHPr+Cnojxf2C7UlkYmpJ6q1OP4XybWjwzZfxWil4MDkQR8van0j:WYLEq5vOuC7UlG/h1Ogy683Ws/j0j
TLSH
T1B3E40255B6D441A9E066D038CA139615E6B27C018F60EAFB13D2A73A2F377E4973EF10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

47984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

vahomontquemaclaleo.pdb

kernel32

CloseHandle CompareStringOrdinal CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDefaultLCID GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile

user32

GetDpiForSystem GetSysColor GetSystemMetrics

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

319KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

274KB

Virtual Size

276KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

185B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jli.dll.exe

kernel32

user32

api-ms-win-core-synch-l1-2-0

generic