KMS[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

KMS.exe
Size

1.7MB
MD5

0f7ae75bde16c261d817cf6fab4e7770
SHA1

030733fd3ed1ad22a1842ee53ffc7ae312652ecd
SHA256

6d880189693cf93dd4ca145b0d3cc8e9295da375654d04ea68a5f67c9f62ae87
SHA512

51698c963bd829c6875d6d70e4e3f44cd99b87bcb2b589f0a1d268cec008a07cd8d9182a51b0eb7714b8cd0c0261e1e279a0404ef59b5877a6e6d5f1c2f69f67
SSDEEP

1536:RbEp4Z40d4I4I4I4I4I4I4I4I4V3424GI5Ac4dONlIKO67gHrc64hUQyOCH1Rog5:Rbnfu

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KMS.exe

Files

KMS.exe
.exe windows:4 windows x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.7MB - Virtual size: 1.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ