Behavioral task
behavioral1
Sample
KMS 1.3.1 Office 2010.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
KMS 1.3.1 Office 2010.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
www.losCorleone.org.url
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
www.losCorleone.org.url
Resource
win10v2004-20231215-en
General
-
Target
5563f9908594a315112232e4641ca1e3
-
Size
1013KB
-
MD5
5563f9908594a315112232e4641ca1e3
-
SHA1
9f6235b3af5a3ec0b4537236f9360b018f1757d5
-
SHA256
51fd3794ee1523b9db6c6f927f540534da0663928f29d04b90659963b930b625
-
SHA512
d5591e373ecd83e7bc2767dc16ca0c44af473d0df2c92f5546dfecf5226a83f7bbb0ba3e51188df02e450c38de12c3f0a2e6cc207456bb46933f216f986666f2
-
SSDEEP
24576:fLddv9GuD+gMu1qqtp8om27C2TN3ijamZvclHhBLOR:jnMuD+gp1qvoTN3iRMh9OR
Malware Config
Signatures
-
resource yara_rule static1/unpack001/KMS 1.3.1 Office 2010.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/KMS 1.3.1 Office 2010.exe
Files
-
5563f9908594a315112232e4641ca1e3.rar
-
KMS 1.3.1 Office 2010.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 998KB - Virtual size: 1000KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
www.losCorleone.org.URL