{
  "family": "ljoiner",
  "sample_count": 2,
  "category": "ransomware",
  "description": "HackTool:Win32/Ljoiner is a heuristic detection for utilities known as 'File Binders' or 'Joiners'. These are specialized tools used by malware authors to combine multiple files—typically a legitimate, harmless application (like a PDF or a game installer) and a malicious payload (like a trojan or keylogger)—into a single, executable wrapper. When the victim runs the combined file, the legitimate application opens normally, while the malware silently executes in the background.<br><br><b>Understanding Ljoiner (File Binders)</b><br>To an end-user, a joined file appears perfectly normal; they double-click an invoice, the invoice opens, and they suspect nothing. For a security analyst, a file binder is a critical social engineering enabler (`T1204.002`). It masks the execution of the payload, increasing the likelihood of successful infection by exploiting the user's trust in the 'decoy' file.<br><br><b>Execution and Deception Mechanics</b><br>Attackers use tools flagged as Ljoiner (like the infamous 'IExpress' built into Windows, or custom underground tools) to package their malware. The binder configures a stub executable (`T1027`). Upon execution, the stub extracts both the decoy file and the malicious payload to a temporary directory (e.g., `%Temp%`). It then launches the decoy file visibly for the user, and simultaneously executes the hidden malware payload (`T1055`) using techniques like Process Hollowing or simply running it as a hidden background process.<br><br><b>Indicators of Compromise & Impact</b><br>The impact depends on the hidden payload (ransomware, RAT, etc.). Host-based IoCs include EDR alerts for 'Suspicious Process Spawning' (e.g., a PDF reader process unexpectedly spawning `cmd.exe` or `powershell.exe`). The sudden creation of unknown executables in the `%Temp%` directory immediately following the opening of a seemingly harmless document is a strong indicator. Static analysis of the joined file will often reveal a highly anomalous file structure, with multiple embedded PE (Portable Executable) headers.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1055",
    "T1027"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Tricking the user with a decoy)",
      "tactic": "Execution"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information (Hiding the payload within the wrapper)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1055",
      "name": "Process Injection (Often used to execute the hidden payload)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Quarantine the suspected joined file immediately to prevent further execution of the hidden payload.",
    "Analyze EDR telemetry to determine exactly what processes were spawned by the joined file to identify the true nature of the malware.",
    "Submit the joined file to a dynamic analysis sandbox (like Any.Run) to safely separate and analyze the decoy and the payload.",
    "Educate users on the dangers of opening unexpected attachments, even if they appear to be standard document formats."
  ],
  "what_to_avoid": [
    "Do not assume a file is safe simply because it has a familiar icon (like a PDF icon); binders easily spoof file icons.",
    "Avoid relying solely on static scanning; the binder often encrypts or obfuscates the payload, requiring behavioral analysis to detect the execution."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}