Static task
static1
Behavioral task
behavioral1
Sample
KMSAuto NET.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
KMSAuto NET.exe
Resource
win10v2004-20240709-en
General
-
Target
dist.7z
-
Size
3.3MB
-
MD5
54877f8902da1705b943c5d6491e2b05
-
SHA1
ca175c80f9b05e747311458522dd880ac28d7471
-
SHA256
03c3f82d61aa5949f899d3be2d1ba4a15a3fd30b407d5dffc1bb9853486f3aa5
-
SHA512
d2876a980950f5e92eaba3902d0a7bf4d90f118abd4ca6d01a167c13ab4f0067c7f25b8b57e7587bf15f319aa0b482a4dd9a6b69f93129f0d6da6c8f50cbb5bd
-
SSDEEP
49152:rEB8rQtw041gsJIKCferA5PLvHkfEnKAlGkqfk3gmxevcdw5Ko6CSmS0P3NO6IA:rgvwTgkQjRnKyZqfk2UdcKx7mnI6p
Malware Config
Signatures
Files
-
dist.7z.7z
Password: 123456
-
KMSAuto NET.exe.exe windows:4 windows x86 arch:x86
Password: 123456
f34d5f2d4577ed6d9ceec516c1f5a744
Code Sign
08:a8:e8:26:95:0f:1a:99:40:26:25:89:fc:af:0b:8fCertificate
IssuerCN=WZTNot Before08/11/2015, 08:15Not After31/12/2039, 23:59SubjectCN=WZT7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21/12/2012, 00:00Not After30/12/2020, 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18/10/2012, 00:00Not After29/12/2020, 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
a3:d9:7c:6b:39:30:01:77:e7:a6:30:ae:7c:60:cc:da:39:51:01:a4Signer
Actual PE Digesta3:d9:7c:6b:39:30:01:77:e7:a6:30:ae:7c:60:cc:da:39:51:01:a4Digest Algorithmsha1PE Digest MatchestrueHeaders
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
mscoree
_CorExeMain
Sections
.text Size: 8.6MB - Virtual size: 8.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 47KB - Virtual size: 47KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ