Overview

overview

7

Static

static

7

HEU_KMS_Ac....0.exe

windows7-x64

7

HEU_KMS_Ac....0.exe

windows10-2004-x64

7

HEU_KMS_Ac...��.url

windows7-x64

1

HEU_KMS_Ac...��.url

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target

    70bddbbb0e41d7299d659299e065cc0b4f927959af7e6ccd157ae7d8053960e8

  • Size

    5.0MB

  • MD5

    43fb18e1a3403b157520af4064eceec1

  • SHA1

    1fd0d8e79b7d5c489ec1d9a8f197dfd0918ef0b2

  • SHA256

    70bddbbb0e41d7299d659299e065cc0b4f927959af7e6ccd157ae7d8053960e8

  • SHA512

    7107b8f1243153efa039bc0fac8b2ee6f33f51b675cac7ff39281f243d6bb544b6e79d9df1205fa8bb3fdcf2e0e277d41e5e9e6301573e001ecd16f5a3b785ce

  • SSDEEP

    98304:C3sGgAAnmeoflnqTZS2zGvCcIAHVO0HNBiSfYPMf1yGPpIVywEI+0wwqJdPNC:UwAAnmydSYAH5z5ft9ycpIYw7LwBk

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Unsigned PE 2 IoCs

    Checks for missing Authenticode signature.

Files

  • 70bddbbb0e41d7299d659299e065cc0b4f927959af7e6ccd157ae7d8053960e8
    .zip
  • HEU_KMS_Activator_v30.4.0/HEU_KMS_Activator_30.4.0.exe
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • out.upx
    .exe windows:5 windows x86 arch:x86


    Headers

    Sections

  • HEU_KMS_Activator_v30.4.0/关注奇迹秀&设计利器公众号.gif
    .gif
  • HEU_KMS_Activator_v30.4.0/更多请访问奇迹秀.url
    .url
  • HEU_KMS_Activator_v30.4.0/更新日志.txt