windows-kms-upload[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

windows-kms-upload.exe
Size

4.6MB
MD5

9ec770c9125916d55d1ee7bd09b99a8b
SHA1

6200f516b417caaf91edc93d52b864edb5871ef2
SHA256

1df1586e2f6a43dcd1df73ea88cb642db2f704ab06bdc40fdb78e1f1a0d3b963
SHA512

43639abc92b8617a19df6a8f9f98ad157c90a4e1cc059aab4dfe4ec57dc42c41fd0db3c7238259603992dd9f0ee812eb87260b65da12a132c6330f2ace666cb5
SSDEEP

98304:YhxaV7/eZnw8VpeD7QQ8jSN7/eZnw8VpeD7QQ8jSL7/eZnw8VpeD7QQ8jSkBvd:mxj28TeD7QQIv28TeD7QQI928TeD7QQ4

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
windows-kms-upload.exe

Files

windows-kms-upload.exe
.exe windows:4 windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.code
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 340KB - Virtual size: 339KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4.1MB - Virtual size: 4.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ