Installer_Kms[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

Installer_Kms.exe
Size

68.0MB
MD5

f53efc191a90dd0ba78c961b513efb56
SHA1

0a30f6b17900dd62ba3c76289ae7f427dd8c26cd
SHA256

9f18caf887db4cccec90f1d018538b77fd5b6e2f7bcaaecbd66fee016f98e10d
SHA512

a4b05a36ce2b58821a14d2f13d176756e0293e777e50e052a52a0543cc2fbee93ae4b0f46af21aa4b5ba86a5414ebc400da60201f25c1da8820620ad408e67a7
SSDEEP

786432:qxGBxG0xG4xGRxGXxGWxGmxGjxGBxG/xG8xGvxGqxGixG:qEBE0E4EREXEWEmEjEBE/E8EvEqEiE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs
Checks for missing Authenticode signature.

Processes:

resource

Installer_Kms.exe

resource
Installer_Kms.exe

Files

Installer_Kms.exe
.exe windows:6 windows x86 arch:x86

7aa92096b259e09d092b7ede5bb0f176

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VerifyVersionInfoW
SetSystemPowerState
VerLanguageNameW
HeapSize
GetProcessHeap
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
IsSystemResumeAutomatic
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
HeapAlloc
HeapFree
RequestWakeupLatency
LoadLibraryA
GetProcAddress
FreeLibrary
GetLastError
CloseHandle
WriteFile
CreateFileW
SetFilePointerEx
VerSetConditionMask
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
LoadLibraryExW
TlsFree
TlsSetValue
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
WriteConsoleW

ole32

StringFromGUID2
CLSIDFromProgID
StringFromCLSID
CoInitializeSecurity
CoRevokeClassObject
CoTaskMemAlloc
CoGetClassObject
CoInitializeEx
CoGetCurrentProcess
CoUninitialize
CoGetMalloc
CoTaskMemFree
CoCreateGuid
CoRegisterClassObject

powrprof

GetPwrCapabilities
PowerDeterminePlatformRoleEx
PowerSettingRegisterNotification
PowerSettingUnregisterNotification
IsPwrSuspendAllowed
IsPwrHibernateAllowed
IsPwrShutdownAllowed
SetSuspendState

shlwapi

PathAddBackslashW
StrCmpW
StrTrimW
PathFileExistsW
StrStrW
StrChrW
PathFindExtensionW
PathRemoveFileSpecW
StrToIntW
PathIsDirectoryW

cfgmgr32

CM_Locate_DevNodeW
CM_Is_Version_Available
CM_Get_Sibling
CM_Get_Parent
CM_Get_Device_Interface_List_SizeW
CM_Get_DevNode_Status
CM_Get_Device_ID_Size
CM_Get_Device_IDW
CM_Get_Depth
CM_Get_Child

version

GetFileVersionInfoW
GetFileVersionInfoSizeExW
GetFileVersionInfoExW
VerQueryValueW
GetFileVersionInfoSizeW
VerInstallFileW
VerFindFileW

Sections

.text
Size: 258KB - Virtual size: 257KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.fptable
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67.6MB - Virtual size: 67.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7aa92096b259e09d092b7ede5bb0f176

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ole32

powrprof

shlwapi

cfgmgr32

version

Sections

.text Size: 258KB - Virtual size: 257KB

.rdata Size: 79KB - Virtual size: 79KB

.data Size: 5KB - Virtual size: 8KB

_RDATA Size: 1KB - Virtual size: 1KB

.fptable Size: 512B - Virtual size: 128B

.rsrc Size: 67.6MB - Virtual size: 67.6MB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 258KB - Virtual size: 257KB

.rdata
Size: 79KB - Virtual size: 79KB

.data
Size: 5KB - Virtual size: 8KB

_RDATA
Size: 1KB - Virtual size: 1KB

.fptable
Size: 512B - Virtual size: 128B

.rsrc
Size: 67.6MB - Virtual size: 67.6MB

.reloc
Size: 12KB - Virtual size: 11KB