jli[.]dll[.]exe | Triage™

General

Target
jli.dll.exe
Size 613KB
Sample261110-3mt5face34
SHA256 195def79a0387a94f7a1e1c4776b701003a25483de66d646f33aab41838c7266
MD5 d58e9f5152567c1bdf9cd0631e565476
SHA1 7d633370b42182d2706e3ce539da0e29b80e0b4f
SHA512 630fea9a5cb0ead8e2de610244dc1f9af6a71d504056edf9a8623a0d4c089ed96fb829f4b58221ae4bb0c71d18522328bd5a5aa221bf49ee0a4395a642923e74
SSDEEP 12288:mh03duOsXqcp+7+sFXxf613N6DOnK3mEKJIoLqyKW9jZe0x8Y/Vxj+c:mK38w7DjfS3gDOnK3TKJIoLqZAoDY/Vd
TLSH
T196D40202FAA681E9E42AC63A84774616E2B278494B50E5FB93549B1F1F337E0D73DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jli.dll.exe

File Explorer

jli.dll.exe

.dll 613KB

jli.dll.exe

IMPHASH 9c136ced8baf5c29a24bdd3baa71ef3f
SHA256 195def79a0387a94f7a1e1c4776b701003a25483de66d646f33aab41838c7266
MD5 d58e9f5152567c1bdf9cd0631e565476
SHA1 7d633370b42182d2706e3ce539da0e29b80e0b4f
SHA512 630fea9a5cb0ead8e2de610244dc1f9af6a71d504056edf9a8623a0d4c089ed96fb829f4b58221ae4bb0c71d18522328bd5a5aa221bf49ee0a4395a642923e74
SSDEEP 12288:mh03duOsXqcp+7+sFXxf613N6DOnK3mEKJIoLqyKW9jZe0x8Y/Vxj+c:mK38w7DjfS3gDOnK3TKJIoLqZAoDY/Vd
TLSH
T196D40202FAA681E9E42AC63A84774616E2B278494B50E5FB93549B1F1F337E0D73DF10
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

49456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

lokost.pdb

kernel32

CloseHandle CreateFileW DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileType GetLastError GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessAffinityMask GetProcessHandleCount GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemTimeAsFileTime GetThreadPriority GetThreadTimes GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess UnhandledExceptionFilter VirtualProtect WideCharToMultiByte WriteConsoleW WriteFile

user32

GetDesktopWindow GetDpiForSystem GetDpiForWindow GetForegroundWindow GetSysColor GetSystemMetrics GetWindowRect MonitorFromWindow

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll

Name

.text

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

278KB

Virtual Size

278KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

225KB

Virtual Size

227KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

209B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jli.dll.exe

kernel32

user32

api-ms-win-core-synch-l1-2-0

generic