C:\Users\Liuyi\Documents\Visual Studio 2010\Projects\KMS Tool\KMS Tool\obj\x86\Release\KMS Tool.pdb
Behavioral task
behavioral1
Sample
KMS_Tool/KMS Tool.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
KMS_Tool/KMS Tool.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
KMS_Tool/ZWT-KMS.exe
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
KMS_Tool/ZWT-KMS.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
KMS_Tool/ɫ.url
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
KMS_Tool/ɫ.url
Resource
win10v2004-20231215-en
General
-
Target
7d74ac456770ddb8bee0ac54cb863f8c
-
Size
158KB
-
MD5
7d74ac456770ddb8bee0ac54cb863f8c
-
SHA1
2fb4da76be3249216d70443e251c4450c3ddc291
-
SHA256
a8851ee6211fdaa0b44563904ee16db920cbecbb93c317bec635d48f9873e1a3
-
SHA512
3f975e5cf41b5f44530bb857e4b042af07bfd5da4204d177cb0293c7db4fcada342304952b2bbf8a5f47df2da6dd1f8ab8e1815bc7e0175ab6959ebccdd65f49
-
SSDEEP
3072:t36MSGJeE6ReqCXjooTm3IZ0qZIrtlgsxAizdtU9z6XpS7sssAINaTyO:twGJogNjoo63mhutOsKiJtUQXs7sDH2
Malware Config
Signatures
-
resource yara_rule static1/unpack001/KMS_Tool/ZWT-KMS.EXE upx -
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/KMS_Tool/KMS Tool.exe unpack001/KMS_Tool/ZWT-KMS.EXE unpack002/out.upx
Files
-
7d74ac456770ddb8bee0ac54cb863f8c.zip
-
KMS_Tool/KMS Tool.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 94KB - Virtual size: 94KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sdata Size: 512B - Virtual size: 152B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
KMS_Tool/ZWT-KMS.EXE.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
yILF Size: - Virtual size: 80KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yILF Size: 74KB - Virtual size: 76KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX2 Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 96KB - Virtual size: 93KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
KMS_Tool/ɫ.url
-
KMS_Tool/.txt