LicensingDiagSpp[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

LicensingDiagSpp.dll
Size

153KB
MD5

6512f12d2e8cb23ec9d7232046d99a68
SHA1

f74e0729511c12ac8338985f967d3fe69eb70580
SHA256

958b872940e6c44074965ab556b73155ab4df81ed5215b558963a8fe5ce3ad32
SHA512

dfa7b852d5cbef71f6cf7a9d58bc14063f952074808b0ecc1e877d0d9552b734295ab982dc0882319f2d01e4be2ab8db98348980643561c9916451e318fca5a1
SSDEEP

3072:1vsoLwvLwG7iIvkIkgmGUCBDs+8lfoK2UcxjRUuduyAE/LRrdg+diHZpf+j6t6De:MigmGUCls3lfSUcxnlrOU65QG7Um

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LicensingDiagSpp.dll

Files

LicensingDiagSpp.dll
.dll windows:10 windows x86 arch:x86

ac2f6b46c93b5842e84d79af26ab91c7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

LicensingDiagSpp.pdb

Imports

msvcrt

malloc
free
_amsg_exit
_XcptFilter
wcschr
_purecall
strchr
memchr
wcsrchr
_wcsicmp
_wcsnicmp
_initterm
memcpy_s
_except_handler4_common
_onexit
wprintf
__dllonexit
_unlock
memmove
wcsstr
_vsnwprintf
_lock
memcmp
memcpy
memset

api-ms-win-core-heap-l1-2-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadLibraryExW
DisableThreadLibraryCalls
GetModuleFileNameW
GetModuleHandleW
GetProcAddress
FreeLibrary

oleaut32

SysFreeString
SysAllocString
VariantInit
VarUdateFromDate
VariantClear

api-ms-win-core-heap-l2-1-0

LocalFree
LocalAlloc

api-ms-win-core-errorhandling-l1-1-1

GetLastError
UnhandledExceptionFilter
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-sysinfo-l1-2-1

GetLogicalProcessorInformationEx
GetSystemFirmwareTable
GetTickCount
GetVersionExA
GetSystemTimeAsFileTime
GetNativeSystemInfo
GetVersionExW
GetPhysicallyInstalledSystemMemory
GetSystemDirectoryW

api-ms-win-core-file-l1-2-1

GetFileAttributesW
DeleteFileW
CreateFileW
SetFileAttributesW

api-ms-win-core-processenvironment-l1-2-0

ExpandEnvironmentStringsW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-1

CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventRegister
EventSetInformation

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObject
Sleep

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-processthreads-l1-1-2

CreateProcessW
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess
TerminateProcess
GetExitCodeProcess

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegQueryValueExW
RegOpenKeyExW

api-ms-win-core-memory-l1-1-2

VirtualQuery

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-security-lsalookup-l2-1-1

LookupAccountNameW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-core-localization-l1-2-1

GetFileMUIPath
GetUserDefaultLCID
GetUserPreferredUILanguages

api-ms-win-service-management-l1-1-0

OpenSCManagerW
CloseServiceHandle
OpenServiceW

api-ms-win-service-winsvc-l1-2-0

QueryServiceStatus

crypt32

CertVerifyCertificateChainPolicy

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-kernel32-legacy-l1-1-1

GetComputerNameW

api-ms-win-core-localization-obsolete-l1-3-0

GetSystemDefaultUILanguage

api-ms-win-security-lsapolicy-l1-1-0

LsaClose
LsaFreeMemory
LsaQueryInformationPolicy
LsaOpenPolicy

wintrust

WTHelperProvDataFromStateData
CryptCATAdminEnumCatalogFromHash
CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
WinVerifyTrust
CryptCATAdminReleaseContext
WTHelperGetProvSignerFromChain
CryptCATCatalogInfoFromContext

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx

api-ms-win-core-io-l1-1-1

DeviceIoControl

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI
DelayLoadFailureHook

hid

HidD_GetPreparsedData
HidP_GetCaps
HidD_FreePreparsedData

Exports

Exports

InitializeCollector

Sections

.text
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ac2f6b46c93b5842e84d79af26ab91c7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-2-1

api-ms-win-core-file-l1-2-1

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-2

api-ms-win-core-util-l1-1-0

api-ms-win-security-lsalookup-l2-1-1

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-2-0

crypt32

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-core-localization-obsolete-l1-3-0

api-ms-win-security-lsapolicy-l1-1-0

wintrust

api-ms-win-power-base-l1-1-0

api-ms-win-core-io-l1-1-1

api-ms-win-core-delayload-l1-1-1

hid

Exports

Exports

Sections

.text Size: 137KB - Virtual size: 137KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 104B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 137KB - Virtual size: 137KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 104B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 5KB - Virtual size: 5KB