Overview
overview
7Static
static
7dcccbb455b...79.rar
windows7-x64
3dcccbb455b...79.rar
windows10-2004-x64
3Download L...om.url
windows7-x64
1Download L...om.url
windows10-2004-x64
1Download L...om.url
windows7-x64
1Download L...om.url
windows10-2004-x64
1HEU_KMS_Ac....0.exe
windows7-x64
7HEU_KMS_Ac....0.exe
windows10-2004-x64
7Behavioral task
behavioral1
Sample
dcccbb455bc904745623cd6f2bb52364cff6f179cd2bdb8ba46ca5ec7b2ba479.rar
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
dcccbb455bc904745623cd6f2bb52364cff6f179cd2bdb8ba46ca5ec7b2ba479.rar
Resource
win10v2004-20231023-en
Behavioral task
behavioral3
Sample
Download Latest Cracks and Apps from CracksHash.com.url
Resource
win7-20231020-en
Behavioral task
behavioral4
Sample
Download Latest Cracks and Apps from CracksHash.com.url
Resource
win10v2004-20231020-en
Behavioral task
behavioral5
Sample
Download Latest Cracks and Apps from CracksHash.com.url
Resource
win7-20231020-en
Behavioral task
behavioral6
Sample
Download Latest Cracks and Apps from CracksHash.com.url
Resource
win10v2004-20231025-en
Behavioral task
behavioral7
Sample
HEU_KMS_Activator_42.0.0.exe
Resource
win7-20231023-en
Behavioral task
behavioral8
Sample
HEU_KMS_Activator_42.0.0.exe
Resource
win10v2004-20231023-en
General
-
Target
dcccbb455bc904745623cd6f2bb52364cff6f179cd2bdb8ba46ca5ec7b2ba479
-
Size
4.3MB
-
MD5
db3a8ad6e15d726825e66d2a7bbbcc6c
-
SHA1
b70c473720d307780bf308e7c46cf905f6acf3fe
-
SHA256
dcccbb455bc904745623cd6f2bb52364cff6f179cd2bdb8ba46ca5ec7b2ba479
-
SHA512
407cf0f40e8341f4024a474972bbe83294a0258c8644772ad5208dd4797ffd476128f00ad4e0fa2a14f4ff9f6e83e0f553ac31b0089cee38ae230178627dc3a5
-
SSDEEP
98304:+XqF2GXXMgA8U6lc4phwFTI/rxqzsxytpyGTVgNq6LOqew7:+6gGXXMR8U6C4EF0/wzjvyyVg8669w7
Malware Config
Signatures
-
resource yara_rule static1/unpack002/HEU_KMS_Activator_42.0.0.exe upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack003/out.upx autoit_exe -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/HEU_KMS_Activator_42.0.0.exe unpack003/out.upx
Files
-
dcccbb455bc904745623cd6f2bb52364cff6f179cd2bdb8ba46ca5ec7b2ba479.rar .zip polyglot
-
Download Latest Cracks and Apps from CracksHash.com.url.url
-
Downloaded from CracksHash.com.txt
-
HEU_KMS/HEU_KMS_Activator_v42.0.0.crackshash.zip.zip
-
Download Latest Cracks and Apps from CracksHash.com.url.url
-
Downloaded from CracksHash.com.txt
-
HEU_KMS_Activator_42.0.0.exe.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 4.8MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 372KB - Virtual size: 376KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:5 windows x86 arch:x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 619KB - Virtual size: 618KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 191KB - Virtual size: 190KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 29KB - Virtual size: 29KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
Info!.txt