D:\Bamboo\home\xml-data\build-dir\OEMSDK-UNINSTALL-SOURCES\bin\x64\Release\OEMUninstall.pdb
Static task
static1
Behavioral task
behavioral1
Sample
3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.dll
Resource
win7-20240319-en
Behavioral task
behavioral2
Sample
3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.dll
Resource
win10v2004-20240226-en
General
-
Target
3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.zip
-
Size
246KB
-
MD5
e6206b9ad59718ba0b51d514fe501ac6
-
SHA1
c3f6d3ad52a0d90070ed44a5b5f7dac837c13c6d
-
SHA256
b83f12387a8c3bd5d2f7b23a4019b85771bd49fa4f61943771d4e7c6d3e72be5
-
SHA512
bb66d395af0c853a0c43ad29f64eaf78f8e458668681efd05c54e49a00bb17f423670bd5a9ec252c056b3c267e305fffcac1df9e7d715f094083bd714da2a613
-
SSDEEP
6144:AOQQGqD3ve6FkJpOL+0MaG8hd98P7LYHj4mTD:AO8Mfe6FHiAGkdGP3YHjPTD
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.exe
Files
-
3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.zip.zip
Password: infected
-
3b63ea8b6f9b2aa847faa11f6cd3eb281abd9b9cceedb570713c4d78a47de567.exe.dll windows:6 windows x64 arch:x64
Password: infected
b3fa4aa3c7d2c22e73d7a820bc5c7b27
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
advapi32
RegOpenKeyExW
RegEnumKeyExW
RegQueryInfoKeyW
RegCloseKey
RegQueryValueExW
ole32
CoCreateInstance
CoInitializeEx
CoUninitialize
CLSIDFromString
oleaut32
SysFreeString
SysAllocString
VariantClear
crypt32
CertFreeCertificateContext
CryptQueryObject
CertCloseStore
CryptMsgGetParam
CertFindCertificateInStore
CertGetNameStringW
CryptMsgClose
wintrust
WinVerifyTrust
Exports
Exports
oemuninstall_init
vgml
Sections
.text Size: 283KB - Virtual size: 282KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 512B - Virtual size: 244B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ