Tom pearl ddoser.rar
- SHA256 94e4b8fa6e8bd678eaf283f17f5354b3c7159bd8cf9eb24ad1058eb8aaaa2bd2
Static task
static1
Behavioral task
behavioral1
Sample
Tom pearl ddoser/Tompearlddoser.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
Tom pearl ddoser/Tompearlddoser.exe
Resource
win11ltsc2024-20260709-en
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
| resource |
|---|
| unpack001/Tom pearl ddoser/intl.dll |
| unpack001/Tom pearl ddoser/intl.dll |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Tom pearl ddoser/intl.dll |
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=257, version=30034,
count=1, id=253, version=28518,
count=2, id=257, productName=VS2019 v16.11.1 build 30133, version=30133,
count=6, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=2, id=257, productName=VS2019 v16.2.3 build 27905, version=27905,
count=25, id=261, version=30034,
count=10, id=260, version=30034,
count=3, id=259, version=30034,
count=13, id=257, version=28900,
count=317, id=1, productName=Unmarked objects,
count=11, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=2, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jul 19, 2019
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=239, version=40116,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=1, productName=Unmarked objects,
count=12, id=259, version=26706,
count=16, id=260, version=26706,
count=31, id=261, version=26706,
count=1, id=256, version=26706,
count=1, id=255, version=26706,
count=1, id=258, version=26706,
Jun 10, 2025
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Jun 10, 2025
CN=Microsoft Windows Software Compatibility Publisher,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Windows Third Party Component CA 2013,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=257, version=30795,
count=2, id=257, version=35207,
count=11, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=53, id=1, productName=Unmarked objects,
count=7, id=260, version=35207,
count=27, id=261, version=35207,
count=5, id=259, version=35207,
count=1, id=256, version=35207,
count=1, id=255, version=35207,
count=1, id=258, version=35207,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=22, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=6, id=199, version=41118,
count=3, id=259, version=26706,
count=11, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=2, id=257, productName=VS2019 v16.7.1 build 29111, version=29111,
count=13, id=257, version=25711,
count=253, id=1, productName=Unmarked objects,
count=91, id=264, version=26729,
count=1, id=256, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=255, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.8.4 build 26729, version=26729,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=1, id=199, version=41118,
count=2, id=259, version=26706,
count=11, id=261, version=26706,
count=8, id=260, version=26706,
count=2, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=3, id=257, version=25711,
count=72, id=1, productName=Unmarked objects,
count=1, id=264, version=26729,
count=1, id=256, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=255, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.8.4 build 26729, version=26729,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=26706,
count=2, id=259, version=26706,
count=11, id=261, version=26706,
count=7, id=260, version=26706,
count=3, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=259, version=25711,
count=1, id=260, version=25711,
count=2, id=257, version=25711,
count=206, id=1, productName=Unmarked objects,
count=3, id=260, productName=VS2019 v16.4.3 build 28315, version=28315,
count=1, id=259, productName=VS2019 v16.4.3 build 28315, version=28315,
count=18, id=264, version=26729,
count=1, id=256, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=255, productName=VS2017 v15.8.4 build 26729, version=26729,
count=1, id=151,
count=1, id=258, productName=VS2017 v15.8.4 build 26729, version=26729,
DLL Hijacking vulnerability
Signed PE file loads submitted unsigned PE file, allowing DLL hijacking/sideloading/preloading.
Unsigned PE
Checks for missing Authenticode signature.
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=6, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=28920,
count=11, id=261, version=28920,
count=8, id=260, version=28920,
count=4, id=259, version=28920,
count=3, id=257, version=27412,
count=60, id=1, productName=Unmarked objects,
count=21, id=264, version=29111,
count=1, id=256, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=255, productName=VS2019 v16.7.1 build 29111, version=29111,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.7.1 build 29111, version=29111,
Nov 3, 2022
CN=VMware\, Inc.,O=VMware\, Inc.,L=Palo Alto,ST=California,C=US,1.2.840.113549.1.9.1=#0c126e6f7265706c7940766d776172652e636f6d
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
count=26, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=5, id=253, version=28518,
count=2, id=257, productName=VS2017 v15.8.4 build 26729, version=26729,
count=13, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=2, id=260, version=28900,
count=19, id=257, version=28900,
count=648, id=1, productName=Unmarked objects,
count=2, id=259, productName=VS2019 v16.11.1 build 30133, version=30133,
count=4, id=261, productName=VS2019 v16.11.1 build 30133, version=30133,
count=198, id=260, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=256, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=255, productName=VS2019 v16.11.1 build 30133, version=30133,
count=1, id=151,
count=1, id=258, productName=VS2019 v16.11.1 build 30133, version=30133,