KMSAutox64[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

KMSAutox64.exe
Size

5.9MB
MD5

6ecf39f068e587aa11ee61f307b0da00
SHA1

d96ba5dcd69352161a907b5b627210ef980b174a
SHA256

ae8c825fb003b5aa90f7964da496033f9d0516e6744e89a010118fc6930808cb
SHA512

7fc55870553f26f925fbed061b73bf3c80359b82ee1ebae9885c73b9b32b6323664b92579494c8771fb1d37cef1249b8002528e07cf8b5e05370f180661c7cb0
SSDEEP

98304:BosFtqvtr/lkqM6WDEilHbShaFmv/MamYhplDsAFV6qzpuy98tKHT/EimO3SAvOb:B3TqvLXhU+k+LFV68RHTOQbN6H62UwX

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/out.upx

Files

KMSAutox64.exe
.exe windows:4 windows x64 arch:x64

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

Issuer

CN=WZTeam

Not Before

02-11-2016 18:47

Not After

31-12-2039 23:59

Subject

CN=WZTeam

Extended Key Usages

ExtKeyUsageCodeSigning

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

Issuer

CN=WZTeam

Not Before

02-11-2016 18:47

Not After

31-12-2039 23:59

Subject

CN=WZTeam

Extended Key Usages

ExtKeyUsageCodeSigning

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Not Before

23-10-2020 00:00

Not After

22-01-2032 23:59

Subject

CN=Sectigo RSA Time Stamping Signer #2,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageContentCommitment

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Not Before

02-05-2019 00:00

Not After

18-01-2038 23:59

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

f3:6e:c9:9b:0d:f1:05:2b:cb:f7:ee:36:17:f0:b3:fd:ff:7e:7b:b6:6a:cc:9f:bb:2f:7a:f5:da:e0:08:6a:9b
Signer

Actual PE Digest

f3:6e:c9:9b:0d:f1:05:2b:cb:f7:ee:36:17:f0:b3:fd:ff:7e:7b:b6:6a:cc:9f:bb:2f:7a:f5:da:e0:08:6a:9b

Digest Algorithm

sha256

PE Digest Matches

true

b4:f9:42:d3:da:e1:2f:e0:0a:1e:ac:41:a2:dc:87:20:c3:bf:df:6d
Signer

Actual PE Digest

b4:f9:42:d3:da:e1:2f:e0:0a:1e:ac:41:a2:dc:87:20:c3:bf:df:6d

Digest Algorithm

sha1

PE Digest Matches

true

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

UPX0
Size: - Virtual size: 1.3MB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

UPX1
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 46KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
out.upx
.exe windows:4 windows x64 arch:x64

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Sections

.code
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 789KB - Virtual size: 788KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5.7MB - Virtual size: 5.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 45KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Code Sign

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9eCertificate

Extended Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9eCertificate

Extended Key Usages

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6bCertificate

Extended Key Usages

Key Usages

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9Certificate

Extended Key Usages

Key Usages

f3:6e:c9:9b:0d:f1:05:2b:cb:f7:ee:36:17:f0:b3:fd:ff:7e:7b:b6:6a:cc:9f:bb:2f:7a:f5:da:e0:08:6a:9bSigner

b4:f9:42:d3:da:e1:2f:e0:0a:1e:ac:41:a2:dc:87:20:c3:bf:df:6dSigner

Headers

File Characteristics

Sections

UPX0 Size: - Virtual size: 1.3MB

UPX1 Size: 5.8MB - Virtual size: 5.8MB

.rsrc Size: 46KB - Virtual size: 48KB

Headers

File Characteristics

Sections

.code Size: 349KB - Virtual size: 349KB

.text Size: 789KB - Virtual size: 788KB

.rdata Size: 214KB - Virtual size: 214KB

.pdata Size: 35KB - Virtual size: 34KB

.data Size: 5.7MB - Virtual size: 5.7MB

.rsrc Size: 45KB - Virtual size: 44KB

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

75:3e:5c:ef:ec:b6:3d:75:b2:cc:6b:83:03:2f:89:9e
Certificate

8c:77:a0:00:8f:f4:d1:b0:c6:3d:9f:3a:48:83:8d:6b
Certificate

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9
Certificate

f3:6e:c9:9b:0d:f1:05:2b:cb:f7:ee:36:17:f0:b3:fd:ff:7e:7b:b6:6a:cc:9f:bb:2f:7a:f5:da:e0:08:6a:9b
Signer

b4:f9:42:d3:da:e1:2f:e0:0a:1e:ac:41:a2:dc:87:20:c3:bf:df:6d
Signer

UPX0
Size: - Virtual size: 1.3MB

UPX1
Size: 5.8MB - Virtual size: 5.8MB

.rsrc
Size: 46KB - Virtual size: 48KB

.code
Size: 349KB - Virtual size: 349KB

.text
Size: 789KB - Virtual size: 788KB

.rdata
Size: 214KB - Virtual size: 214KB

.pdata
Size: 35KB - Virtual size: 34KB

.data
Size: 5.7MB - Virtual size: 5.7MB

.rsrc
Size: 45KB - Virtual size: 44KB