D:\Bamboo\home\xml-data\build-dir\OEMSDK-UNINSTALL-SOURCES\bin\x64\Release\OEMUninstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
falcon.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
falcon.dll
Resource
win10v2004-20240226-en
General
-
Target
falcon.dll
-
Size
469KB
-
MD5
e27c6586dba78d5d302589f3b231be40
-
SHA1
305031a6d93a744cf61552ab673ddb27843ee845
-
SHA256
3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567
-
SHA512
1f0c126e38eed21ee51e04ebe4717fcbb3545d9ccdcc24ba0125f82c5f9b94d1406cbf3ba9f58958e4f180bdd6931bc3a3cb5390de990f8265baabfd414f89c2
-
SSDEEP
12288:YERU04ML77eb/yVydk3+qloeDFgZkF7o:YEfDLP4qVydk3+qlpDkS
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource falcon.dll
Files
-
falcon.dll.dll windows:6 windows x64 arch:x64
b3fa4aa3c7d2c22e73d7a820bc5c7b27
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CLSIDFromString
oleaut32
SysFreeString
SysAllocString
VariantClear
crypt32
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptMsgClose
wintrust
WinVerifyTrust
Exports
Exports
oemuninstall_init
vgml
Sections
.text Size: 283KB - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ