KMSSS[.]exe | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

KMSSS.exe
Size

34KB
MD5

add80e5d9fad482705c3807bacfe1993
SHA1

c41c16d39994a4a8d7d0aeab64afd00ae634d013
SHA256

bb3830b14df80838fb201c611abf0c1f3714c6b8b103ed084eafc170036631be
SHA512

3f0cc9cbe1b518728eb09c6db8259e0768ac7d67d39d9055125e62ca8a76c00a0a613c7013698826d0b0e436d2dbc7d0f3ea9a993e0427cfd9a0ad8ffb836e53
SSDEEP

768:8w87OST3RNnlvsnUr4S3kDDvsYBya1TkCt:8w87OSTBNlvQUr4SUPkM1TkC

Score

N/A

Malware Config

Signatures

Files

KMSSS.exe
.exe windows x86

d09a14e1fb5c5aa5a973010186c50390

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

Issuer

CN=WZTeam

Not Before

02-11-2016 18:47

Not After

31-12-2039 23:59

Subject

CN=WZTeam

Extended Key Usages

ExtKeyUsageCodeSigning

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Not Before

21-12-2012 00:00

Not After

30-12-2020 23:59

Subject

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

Issuer

CN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=US

Not Before

18-10-2012 00:00

Not After

29-12-2020 23:59

Subject

CN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

1e:1a:90:4d:b4:d5:cd:d9:aa:b6:68:4b:d4:ae:af:47:6b:22:65:57
Signer

Actual PE Digest

1e:1a:90:4d:b4:d5:cd:d9:aa:b6:68:4b:d4:ae:af:47:6b:22:65:57

Digest Algorithm

sha1

PE Digest Matches

true

Signature Validations

Trusted

false

Verification

Signing Certificate

CN=WZTeam

05-11-2016 10:15
Valid: false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

??2@YAPAXI@Z
_time64
toupper
system
atoi
strchr
__iob_func
malloc
calloc
free
strncmp
_flushall
_gmtime64
vprintf
_wfreopen
_vsnprintf
memcpy
memset

rpcrt4

RpcStringFreeA
RpcServerUseProtseqEpA
RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIfEx
NdrServerCall2
RpcBindingServerFromClient
RpcStringFreeW
RpcBindingFree
RpcBindingToStringBindingW
RpcStringBindingParseW
UuidToStringA

kernel32

GetSystemTime
CompareStringA
GetLocalTime
GetLastError
MultiByteToWideChar
CompareStringW
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
GetProcAddress
GetModuleHandleA
ExitProcess
GetCommandLineW
GetSystemTimeAsFileTime
SetConsoleCP
GetConsoleCP
WideCharToMultiByte

advapi32

SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CryptSetHashParam
CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptGenRandom
CryptSetKeyParam
CryptAcquireContextW
CryptGetHashParam

shell32

CommandLineToArgvW

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d09a14e1fb5c5aa5a973010186c50390

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9eCertificate

Extended Key Usages

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate

Extended Key Usages

Key Usages

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate

Extended Key Usages

Key Usages

1e:1a:90:4d:b4:d5:cd:d9:aa:b6:68:4b:d4:ae:af:47:6b:22:65:57Signer

Signature Validations

Verification

05-11-2016 10:15 Valid: false

Headers

DLL Characteristics

File Characteristics

Imports

msvcrt

rpcrt4

kernel32

advapi32

shell32

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 10KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 4KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 2KB - Virtual size: 1KB

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3b
Certificate

0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50
Certificate

1e:1a:90:4d:b4:d5:cd:d9:aa:b6:68:4b:d4:ae:af:47:6b:22:65:57
Signer

05-11-2016 10:15
Valid: false

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 10KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 2KB - Virtual size: 1KB