Static task
static1
Behavioral task
behavioral1
Sample
Activator_windows_7-8/KMSAuto.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Activator_windows_7-8/KMSAuto.exe
Resource
win10v2004-20220812-en
General
-
Target
0daa2d60a47a1979a7924b435ffc054e3b4cebae856e9dc1656fee34d1ee15cb
-
Size
176KB
-
MD5
0dafbea5c376ec9e10ec9a71d1dc1aa8
-
SHA1
8d7901c2ffb2667a9e796f417fcf6c30186833f2
-
SHA256
0daa2d60a47a1979a7924b435ffc054e3b4cebae856e9dc1656fee34d1ee15cb
-
SHA512
061b226a5814f10b9a7b80331fefc85499534f70ee3f66d54d8c1c9fb9707ce56d4beb9482c25c0bb8969caab4ef1d7509d594501f2dc456b27de54c733ca0c4
-
SSDEEP
3072:XMCRDjBWzfPRst+JwD/ndiId5UA9TFbu1PPAJMIYKW9LTaWonJr:XMMBIJgvMoPTFK1PIJxYh9fa9r
Malware Config
Signatures
Files
-
0daa2d60a47a1979a7924b435ffc054e3b4cebae856e9dc1656fee34d1ee15cb.zip
-
Activator_windows_7-8/KMSAuto.exe.exe windows x86
691f1193f16065947032ace3a2329e55
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
Imports
kernel32
GetModuleHandleA
GetProcAddress
msvcrt
fabs
comctl32
InitCommonControls
user32
IsChild
gdi32
BitBlt
ole32
CoInitialize
shell32
ShellExecuteExA
shlwapi
PathQuoteSpacesA
Sections
.MPRESS1 Size: 151KB - Virtual size: 272KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.MPRESS2 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 45KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Activator_windows_7-8/config/PID_o10.ini
-
Activator_windows_7-8/config/PID_o13.ini
-
Activator_windows_7-8/config/PID_win.ini
-
Activator_windows_7-8/config/host.ini
-
Activator_windows_7-8/config/sai.ini
-
Activator_windows_7-8/config/sri.ini
-
Activator_windows_7-8/readme.txt