Overview

overview

7

Static

static

7

HEU_KMS_Ac...��.url

windows7-x64

1

HEU_KMS_Ac...��.url

windows10-2004-x64

1

HEU_KMS_Ac....0.exe

windows7-x64

7

HEU_KMS_Ac....0.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    ed3fd48d8b3cb18b606d78b3c63224ec5d15c5305cdfe386f1fb29e778e6e1f3

  • Size

    4.4MB

  • MD5

    f06c53c3f440ffbffee703fe20a8a9e7

  • SHA1

    4d2714e7d074785dba1e8caebd72f2be834d15e0

  • SHA256

    ed3fd48d8b3cb18b606d78b3c63224ec5d15c5305cdfe386f1fb29e778e6e1f3

  • SHA512

    ae2db8b4f5ea077c9f084fe19024d00bc9fbabe921f92373286e8585888d92b7bca8d07d19acbcfaed1edd752ad4fe7fb1806183a8ed5c9ca5d579ee007ee08b

  • SSDEEP

    98304:5KWeDPcGBvO6gYYWnayZf871ENHxUxmraP3eGhV+NwizeqEQT:5jEUGBvOLYYWayS7+NGxZveYV+SiqvQT

Score
7/10
qrlinkupx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • One or more HTTP URLs in qr code identified

    Detects presence of HTTP links in QR codes.

    qrlink
  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • ed3fd48d8b3cb18b606d78b3c63224ec5d15c5305cdfe386f1fb29e778e6e1f3
    .zip
  • HEU_KMS_Activator_v42.0.0/!关注微信 - 更多福利.png
    .png

    • http://weixin.qq.com/r/wii4oJjEU8UsrdzD933Q

  • HEU_KMS_Activator_v42.0.0/!果核剥壳 - 全网更新最快.url
    .url
  • HEU_KMS_Activator_v42.0.0/HEU_KMS_Activator_42.0.0.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections