OEMLicense.pdb
Static task
static1
Behavioral task
behavioral1
Sample
OEMLicense.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
OEMLicense.dll
Resource
win10v2004-20240426-en
General
-
Target
OEMLicense.dll
-
Size
104KB
-
MD5
3d8cc49c0978a1bb023bae207c062c12
-
SHA1
e2e21002f92e1d3aec2e3a90f741bfbdc8f9580d
-
SHA256
6bf55abd400b1b1007638159f6d74c604e8df2de7743e2dfaf5c8845e576d188
-
SHA512
e116c2c04230499def9d2950520c147b7f63d786a47fbb70884f39bcc524d3cfb44bc42c3fe7a80d720e53cbbd78bae3ba9c39816cbcab6883a33ef3ec7e14e3
-
SSDEEP
1536:XdcuVk+C+OGgGSiMVlYehHnTORQkSljlDqf34GwyjSPeEep:tcuVk+qGmiMVCeJORlSHDqfoG/j+u
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource OEMLicense.dll
Files
-
OEMLicense.dll.dll windows:6 windows x86 arch:x86
0823c3b2e90c4c5f577549a21ec59b4d
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB Paths
Imports
msvcrt
memset
wcsrchr
wcschr
memcpy
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
malloc
free
_amsg_exit
_XcptFilter
_purecall
memmove
memcmp
wcsncmp
_vsnwprintf
_wcsnicmp
_wcsicmp
shlwapi
ord12
kernel32
GetProcAddress
DisableThreadLibraryCalls
LocalAlloc
LocalFree
GetProcessHeap
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
CloseHandle
CreateFileW
GetFileSize
ReadFile
InitializeCriticalSectionAndSpinCount
Sleep
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
ChangeTimerQueueTimer
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleExW
HeapFree
HeapAlloc
FlushFileBuffers
SetFilePointer
GetLastError
GetCurrentThreadId
SleepEx
GetModuleFileNameW
GetModuleHandleW
DeleteTimerQueueEx
CreateTimerQueue
CreateTimerQueueTimer
CopyFileW
MoveFileExW
RaiseException
CreateSemaphoreW
CreateEventW
SetFileAttributesW
ExpandEnvironmentStringsW
LCMapStringW
HeapReAlloc
DecodePointer
DeleteFileW
WriteFile
GetFileAttributesW
DeleteTimerQueueTimer
EncodePointer
CreateDirectoryW
ReleaseSemaphore
SetEvent
WaitForSingleObject
xmllite
CreateXmlReader
rpcrt4
I_RpcExceptionFilter
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcBindingSetAuthInfoExW
RpcStringFreeW
RpcBindingFree
NdrClientCall2
I_RpcMapWin32Status
advapi32
EventWrite
NotifyServiceStatusChangeW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
StartServiceW
CloseServiceHandle
FreeSid
AllocateAndInitializeSid
DeregisterEventSource
ReportEventW
RegisterEventSourceW
ConvertStringSecurityDescriptorToSecurityDescriptorW
ole32
CLSIDFromString
oleaut32
VariantInit
SysAllocString
SysFreeString
Exports
Exports
AddDemoAppLicense
HrAddAppxLicense
HrRemoveAppxLicense
RemoveDemoAppLicense
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ