RomensLicenseServices[.]dll | Triage

Sharing

General

Target

RomensLicenseServices.dll
Size

117KB
MD5

9bb6b089752b5385c9648516b5c39c24
SHA1

17413d8520fd9c026a58ca94227ae73e1199ed4d
SHA256

d97f628b06d410aa5f2c9d422412d98d0a699dccfb7931dd62b8331b2884ed5e
SHA512

22acdab3601f4eb884f5956c7320deb644602bac00d68e1d262323639e29eaf9150fe9b17cd1b4351bd96bb033d23b19775f91d7c730fcd25b70b6ece423a879
SSDEEP

1536:+lWSv3v67jG+Ozcco3qZEXHUuynqtuXd3v6U:+6/GHIcnE3jvoJ6

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RomensLicenseServices.dll

Files

RomensLicenseServices.dll
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Users\allen\SourceCode\Workspaces\License\License.Core\RomensLicenseServices\obj\8076\netcoreapp3.1\win-x86\RomensLicenseServices.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ