56e45e7adde3c7ac7b491509587f1720N[.]exe

General

Target

56e45e7adde3c7ac7b491509587f1720N.exe
Size

74KB
MD5

56e45e7adde3c7ac7b491509587f1720
SHA1

9c2198dfd58b09626da6bf5b6c65228495aae60c
SHA256

1360f2cf198be3ba90bb76d440ca4e7913bbc9c29be13daf505ea33368988680
SHA512

01cd1ee50c900a4f7b46cd48ccf3a6172c040a4813507be0a1b7d56c452d023e37abc08397b75a900e3627712b5dc35e5ca2c3b59220c29676dd18e0d9f5b32e
SSDEEP

1536:IokvLFF/n1FcSPZuYw601UQR27YZf4dq3e:I9vBFzcStkUQR27YZf403e

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56e45e7adde3c7ac7b491509587f1720N.exe

Files

56e45e7adde3c7ac7b491509587f1720N.exe
.dll windows:6 windows x86 arch:x86

b771b76a3664eae68b0676a187eaf874

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

J:\KMS-8\KMSEmulator.NET\Release\KMSWrapper32.pdb

Imports

msvcr110

__crtUnhandledException
_crt_debugger_hook
_except_handler4_common
__CppXcptFilter
memset
rand_s
_itow_s
malloc
memcpy
__clean_type_info_names_internal
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
_initterm_e
_initterm
_malloc_crt
free
_amsg_exit
__crtTerminateProcess
_cexit
__FrameUnwindFilter

kernel32

IsProcessorFeaturePresent
IsDebuggerPresent
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
Sleep

rpcrt4

NdrServerCall2
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcServerRegisterIfEx

advapi32

CryptHashData
CryptDestroyHash
CryptDecrypt
CryptDestroyKey
CryptCreateHash
CryptEncrypt
CryptImportKey
CryptReleaseContext
CryptSetKeyParam
CryptAcquireContextW
CryptGetHashParam

mscoree

_CorDllMain

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b771b76a3664eae68b0676a187eaf874

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr110

kernel32

rpcrt4

advapi32

mscoree

Sections

.text Size: 11KB - Virtual size: 10KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 11KB - Virtual size: 10KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB