LicensingDiagSpp[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

LicensingDiagSpp.dll
Size

363KB
MD5

000f5f55d48ea6bf0f42efa084f67bc6
SHA1

316c5b806e5c5ec7b8283ff58659f097c9d91596
SHA256

2ea05e6260e00f3b1d3ac85be0682826384c10b1fcd00dcdfce5bc4acaa08e29
SHA512

3c9270f09887292670ec747fe4676beb525df9043a86958caf2b36ae2e54a041f665e5cf7711fc3c8446ff11cb3ef5fef891c71142bec4b8cb47c382c23457a8
SSDEEP

6144:md2FDwn3gVk2lrViA/hw0pEdURn2+KgNKqaYm+Wm7EXdB:TFDw3C/FCfgNKqaYmA7Sf

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LicensingDiagSpp.dll

Files

LicensingDiagSpp.dll
.dll windows:10 windows x86 arch:x86

083a3bf482f05780fdd33b68aba69909

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

LicensingDiagSpp.pdb

Imports

msvcrt

_except_handler4_common
memmove
__dllonexit
_unlock
_lock
wprintf
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
_wcsnicmp
_wcsicmp
wcsrchr
wcschr
memmove_s
memcpy_s
wcsstr
_vsnwprintf
_onexit
memcmp
memcpy
memset

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
LoadLibraryExW
GetModuleFileNameA
LockResource
LoadResource
FindResourceExW
GetProcAddress
DisableThreadLibraryCalls
GetModuleHandleW
GetModuleFileNameW

oleaut32

VarUdateFromDate
VariantInit
SysAllocString
VariantClear
SysFreeString

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetVersionExW
GetSystemDirectoryW
GetVersionExA
GetSystemTimeAsFileTime

api-ms-win-core-file-l1-1-0

GetFileAttributesW
CreateFileW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance

api-ms-win-core-localization-l1-2-0

GetFileMUIPath
GetUserDefaultLCID
GetUserPreferredUILanguages
FormatMessageW

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetCurrentProcess
CreateProcessW
GetExitCodeProcess
TerminateProcess
GetCurrentProcessId

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
DebugBreak
IsDebuggerPresent

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
CreateMutexExW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseMutex
ReleaseSRWLockExclusive
OpenSemaphoreW
AcquireSRWLockShared
WaitForSingleObject
ReleaseSemaphore
ReleaseSRWLockShared
InitializeCriticalSectionEx
DeleteCriticalSection
LeaveCriticalSection

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-memory-l1-1-0

VirtualQuery

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
GetTimeZoneInformation

api-ms-win-core-registry-l1-1-0

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-sysinfo-l1-2-0

GetNativeSystemInfo

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
OpenServiceW
CloseServiceHandle

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

crypt32

CertVerifyCertificateChainPolicy

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable
Sleep
SleepConditionVariableSRW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-localization-obsolete-l1-2-0

GetSystemDefaultUILanguage

api-ms-win-security-lsapolicy-l1-1-0

LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
LsaFreeMemory

wintrust

CryptCATAdminEnumCatalogFromHash
WTHelperGetProvSignerFromChain
WinVerifyTrust
CryptCATAdminReleaseContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminReleaseCatalogContext
CryptCATCatalogInfoFromContext
CryptCATAdminAcquireContext
WTHelperProvDataFromStateData

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

InitializeCollector

Sections

.text
Size: 339KB - Virtual size: 338KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

083a3bf482f05780fdd33b68aba69909

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-core-heap-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-service-management-l1-1-0

api-ms-win-service-winsvc-l1-1-0

crypt32

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-security-lsapolicy-l1-1-0

wintrust

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 339KB - Virtual size: 338KB

.data Size: 1KB - Virtual size: 2KB

.idata Size: 6KB - Virtual size: 6KB

.didat Size: 512B - Virtual size: 80B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 339KB - Virtual size: 338KB

.data
Size: 1KB - Virtual size: 2KB

.idata
Size: 6KB - Virtual size: 6KB

.didat
Size: 512B - Virtual size: 80B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 13KB - Virtual size: 12KB