LicensingWinRT[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

LicensingWinRT.dll
Size

605KB
MD5

0fdfffee8fd95c477e5b6639c3f865e4
SHA1

15baef03495efe18252f731162f07e9bab04ce4f
SHA256

8e2b4bceb5b367e6f6ed6fefb2d7dae3fb78edb3f4c88ce20c1d272d41ac83d5
SHA512

cd621f7a80d73963d416829fe4ef3f8afa0cda7a88b0a868fae321e218d279db26acf7d71b0c7f8091b63e77a6b1da7b66aa960752d4c6b37aa5e7e1ff7ce768
SSDEEP

6144:tL6opCE0Mb6uldioDQioro9AdcAcn/sQDMADmkcS8:j2ubXDnEoXAcn/sRAqkcV

Score

1^/10

Malware Config

Signatures

Files

LicensingWinRT.dll
.dll windows:10 windows x86 arch:x86

29f425c784d199c2c76222bf73c598ab

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/07/2018, 20:45

Not After

26/07/2019, 20:45

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

42:e4:d3:3a:dd:2b:fe:85:80:4e:0b:d6:b3:d1:26:18:fa:35:be:23:57:22:ef:c8:4b:91:d7:f8:6a:cb:60:e2
Signer

Actual PE Digest

42:e4:d3:3a:dd:2b:fe:85:80:4e:0b:d6:b3:d1:26:18:fa:35:be:23:57:22:ef:c8:4b:91:d7:f8:6a:cb:60:e2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

LicensingWinRT.pdb

Imports

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo
_o__purecall
_o__register_onexit_function
_o__seh_filter_dll
_o__wcsicmp
memmove
_o_free
_o_malloc
_except_handler4_common
_o__crt_atexit
_o__configure_narrow_argv
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsnprintf_s
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
_o__execute_onexit_table
wcschr
wcsstr
memchr
_CxxThrowException
_o__errno
__std_terminate
__CxxFrameHandler3
memcmp
memcpy

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
GetModuleHandleExW
DisableThreadLibraryCalls
FreeLibrary
LoadLibraryExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore
WaitForSingleObject
CreateMutexW
CreateEventExW
InitializeCriticalSection
CreateEventW
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
InitializeCriticalSectionEx
CreateSemaphoreExW

api-ms-win-core-heap-l1-1-0

HeapAlloc
HeapFree
GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventActivityIdControl
EventUnregister
EventSetInformation
EventRegister

api-ms-win-core-util-l1-1-0

EncodePointer
DecodePointer

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId
GetExitCodeProcess
GetCurrentProcessId
OpenProcessToken
CreateProcessW
GetCurrentProcess
TerminateProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW
LCMapStringEx

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
OpenProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetLocalTime
GlobalMemoryStatusEx
GetSystemDirectoryW
GetTickCount
GetSystemTimeAsFileTime
GetVersionExW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

rpcrt4

NdrDllCanUnloadNow
NdrCStdStubBuffer_Release
CStdStubBuffer_Invoke
NdrStubForwardingFunction
NdrStubCall2
NdrDllGetClassObject
NdrCStdStubBuffer2_Release
CStdStubBuffer_QueryInterface
IUnknown_AddRef_Proxy
NdrOleAllocate
CStdStubBuffer_DebugServerRelease
CStdStubBuffer_Disconnect
CStdStubBuffer_CountRefs
UuidFromStringW
IUnknown_QueryInterface_Proxy
CStdStubBuffer_IsIIDSupported
CStdStubBuffer_DebugServerQueryInterface
I_RpcMapWin32Status
IUnknown_Release_Proxy
CStdStubBuffer_AddRef
NdrOleFree
CStdStubBuffer_Connect

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient3
NdrProxyForwardingFunction4
NdrProxyForwardingFunction5
ObjectStublessClient6
ObjectStublessClient18
ObjectStublessClient9
CStdStubBuffer2_CountRefs
ObjectStublessClient11
ObjectStublessClient14
ObjectStublessClient12
CStdStubBuffer2_QueryInterface
CStdStubBuffer2_Connect
CStdStubBuffer2_Disconnect
ObjectStublessClient10
ObjectStublessClient13
ObjectStublessClient8
ObjectStublessClient7
ObjectStublessClient16
NdrProxyForwardingFunction3
ObjectStublessClient17
ObjectStublessClient15

api-ms-win-core-localization-l1-2-3

GetUserDefaultGeoName

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

api-ms-win-core-synch-l1-2-0

InitOnceExecuteOnce

api-ms-win-shcore-taskpool-l1-1-0

SHTaskPoolQueueTask
SHTaskPoolAllowThreadReuse

api-ms-win-security-base-l1-1-0

CreateWellKnownSid
SetSecurityDescriptorDacl
SetSecurityDescriptorGroup
InitializeSecurityDescriptor
SetSecurityDescriptorOwner
GetTokenInformation

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-file-l1-1-0

ReadFile
GetFileSize
GetFileAttributesW
CreateFileW
CreateDirectoryW
SetFilePointer
WriteFile
FindClose
FindFirstFileW
FindNextFileW

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegCreateKeyExW
RegSetKeySecurity
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-security-provider-l1-1-0

SetEntriesInAclW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

oleaut32

SafeArrayUnaccessData
SafeArrayGetUBound
VariantClear
SafeArrayAccessData
SafeArrayCreateVector
SafeArrayGetLBound
SysFreeString
SafeArrayDestroy
SysAllocString
SysAllocStringLen
VariantInit

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
CreateThreadpoolTimer
SetThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-security-lsalookup-l1-1-2

LsaLookupUserAccountType

clipc

ClipGetSubscriptionStatus
ClipCallServer
ClipClose
ClipOpen

dmcmnutils

DmWnfQuery

ole32

CoGetObject

sppc

SLInstallLicense
SLGetPKeyId
SLClose
SLGetProductSkuInformation
SLOpen
SLpTriggerServiceWorker
SLInstallProofOfPurchaseEx
SLGetPKeyInformation

slc

SLIsWindowsGenuineLocal
SLGetWindowsInformation
SLConsumeWindowsRight
SLGetWindowsInformationDWORD

sppcext

SLActivateProduct

winsku

SkuGetEditionEulaFilePath

dismapi

_DismGetTargetEditions
DismOpenSession
DismDelete
DismInitialize
DismCloseSession
DismShutdown
_DismSetEdition

pkeyhelper

GetEditionIdFromName
SkuGetUpgradeProductKeyFromDownlevelEdition

api-ms-win-eventing-classicprovider-l1-1-0

RegisterTraceGuidsW
GetTraceLoggerHandle
UnregisterTraceGuids
GetTraceEnableLevel
GetTraceEnableFlags

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-devices-config-l1-1-1

CM_Get_Device_IDW
CM_Get_Parent
CM_Get_DevNode_Status
CM_Get_DevNode_Registry_PropertyW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjects

api-ms-win-security-cryptoapi-l1-1-0

CryptHashData
CryptGetHashParam
CryptCreateHash
CryptAcquireContextW
CryptReleaseContext
CryptDestroyHash

Exports

Exports

DllCanUnloadNow
DllGetActivationFactory
DllGetClassObject

Sections

.text
Size: 560KB - Virtual size: 559KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

29f425c784d199c2c76222bf73c598ab

Code Sign

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

42:e4:d3:3a:dd:2b:fe:85:80:4e:0b:d6:b3:d1:26:18:fa:35:be:23:57:22:ef:c8:4b:91:d7:f8:6a:cb:60:e2Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

rpcrt4

api-ms-win-core-com-midlproxystub-l1-1-0

api-ms-win-core-localization-l1-2-3

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-shcore-taskpool-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-provider-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

oleaut32

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-security-lsalookup-l1-1-2

clipc

dmcmnutils

ole32

sppc

slc

sppcext

winsku

dismapi

pkeyhelper

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-devices-config-l1-1-1

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-rtcore-ntuser-synch-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

Exports

Exports

Sections

.text Size: 560KB - Virtual size: 559KB

.data Size: 512B - Virtual size: 2KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 224B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 23KB - Virtual size: 22KB

33:00:00:01:c4:22:b2:f7:9b:79:3d:ac:b2:00:00:00:00:01:c4
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

42:e4:d3:3a:dd:2b:fe:85:80:4e:0b:d6:b3:d1:26:18:fa:35:be:23:57:22:ef:c8:4b:91:d7:f8:6a:cb:60:e2
Signer

.text
Size: 560KB - Virtual size: 559KB

.data
Size: 512B - Virtual size: 2KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 224B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 23KB - Virtual size: 22KB