Kms激活[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Kms激活.exe
Size

550KB
MD5

67a8423e96167a5bad51a5a9725e1815
SHA1

dc311e71e840c878bda51dd4fa8d4af589aeee75
SHA256

3139049a2af631db93aab5cbc8307e123ed193cd42d1e8012950824192253440
SHA512

fdc12b5e087a0325bd94b61072a6ef8b3c80171fb3b990260614dce3e4f5b6dde6a07091935561232803c8e4f89808931b734220bc57c9a757883a5d88319354
SSDEEP

12288:HwxZ58niWNRxxVmVZINzPf+lE0MBnO0YNAgwlgG1:QanTRxeVMnOE0HbwlgG1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Kms激活.exe

Files

Kms激活.exe
.exe windows:5 windows x64 arch:x64

d0b576aa1597bfc88eef11f7320a63ec

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

GetModuleHandleA
GetProcAddress

wsock32

__WSAFDIsSet

version

VerQueryValueW

winmm

timeGetTime

comctl32

ImageList_Remove

mpr

WNetUseConnectionW

wininet

FtpOpenFileW

psapi

GetProcessMemoryInfo

iphlpapi

IcmpSendEcho

userenv

LoadUserProfileW

uxtheme

IsThemeActive

user32

GetDC

gdi32

LineTo

comdlg32

GetSaveFileNameW

advapi32

AddAce

shell32

DragFinish

ole32

CoGetObject

oleaut32

SysStringLen

Sections

.MPRESS1
Size: 373KB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.MPRESS2
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 172KB - Virtual size: 172KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE