Static task
static1
Behavioral task
behavioral1
Sample
KLL.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
KLL.exe
Resource
win10v2004-20240802-en
General
-
Target
KLL.exe.v
-
Size
20.7MB
-
MD5
976a0e758697585e7ec0b15dc64cdf39
-
SHA1
3a718ae387b3d72d1c1d1d26ecb6b7c710068bf3
-
SHA256
03fda7398f21574d671ac5b4cf7e01ab5093c65098e2760ed34cd46e3772fad8
-
SHA512
d08aebff7eb1e9d91d7aed8bb6db897cda6decf8f67c9de9ac07eaa52640414f8cbab04611ea48c64f9469ee87e8d89eb363201e2807c9e024cebd614897a2df
-
SSDEEP
393216:8G9bEyuUfOtWAm2dk6Y3itRMj1n9ea96baU3zKY9/qJ:8G9bEti80DmfMR3bBY9/
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource KLL.exe.v
Files
-
KLL.exe.v.exe windows:5 windows x64 arch:x64
1fc1af76ca8889c981dd2b9f416abbee
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
HeapSize
InitializeCriticalSectionAndSpinCount
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
LCMapStringW
MultiByteToWideChar
LCMapStringA
EnterCriticalSection
LeaveCriticalSection
GetCurrentProcessId
GetTickCount
QueryPerformanceCounter
DeleteCriticalSection
GetFileType
SetHandleCount
lstrcatW
CreateFileW
WriteFile
CloseHandle
LoadLibraryA
GetProcAddress
GetEnvironmentStringsW
WideCharToMultiByte
GetSystemTimeAsFileTime
RtlUnwindEx
GetLastError
HeapReAlloc
GetCommandLineA
GetStartupInfoA
HeapSetInformation
HeapCreate
HeapFree
HeapAlloc
GetCPInfo
GetACP
GetOEMCP
IsValidCodePage
EncodePointer
DecodePointer
FlsGetValue
FlsSetValue
FlsFree
SetLastError
GetCurrentThreadId
FlsAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetModuleHandleW
Sleep
ExitProcess
GetStdHandle
GetModuleFileNameA
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
user32
LoadIconW
LoadCursorW
RegisterClassW
UpdateWindow
TranslateMessage
DispatchMessageW
GetMessageW
DefWindowProcW
KillTimer
MessageBoxW
EnableMenuItem
ModifyMenuW
SendMessageW
CheckMenuItem
BeginPaint
EndPaint
PostQuitMessage
GetMenu
CreateWindowExW
GetForegroundWindow
ShowWindow
DrawEdge
wsprintfW
SetWindowTextW
InvalidateRect
LoadBitmapW
SetTimer
gdi32
DeleteObject
CreateCompatibleDC
SelectObject
BitBlt
DeleteDC
CreatePatternBrush
shell32
SHGetSpecialFolderPathW
Sections
.text Size: 31KB - Virtual size: 31KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 20.5MB - Virtual size: 20.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 232KB - Virtual size: 231KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ