KMSoffline_x64[.]exe | Triage

Sharing

General

Target

KMSoffline_x64.exe
Size

3.7MB
MD5

c8b7da9916bfa1939d782787fe01660b
SHA1

aeee4e9cf8858249f02ce87acbc3869a45100c4f
SHA256

515ba45f660fbce53f42d5446486b6dd94794a0ad14a81781b1a46b04c91787e
SHA512

86986730625a477427283aecb071de6b73602d591223fbbfee3a26dc603d9ec23197f8620b68c3ec6edb654131804a35f53a6895395461c39c811a40526a5b49
SSDEEP

98304:WalwBS07c6Ajk1/7CK1p/1+FrMdjU8wrgEPfLP+iVDl6:WaH07c6Z1Dv+GT2+G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
KMSoffline_x64.exe

Files

KMSoffline_x64.exe
.exe windows:4 windows x64 arch:x64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ