InstallerKms[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
InstallerKms.exe
Size 68.0MB
Sample240923-ekdsnswajf
SHA256 9f18caf887db4cccec90f1d018538b77fd5b6e2f7bcaaecbd66fee016f98e10d
MD5 f53efc191a90dd0ba78c961b513efb56
SHA1 0a30f6b17900dd62ba3c76289ae7f427dd8c26cd
SHA512 a4b05a36ce2b58821a14d2f13d176756e0293e777e50e052a52a0543cc2fbee93ae4b0f46af21aa4b5ba86a5414ebc400da60201f25c1da8820620ad408e67a7
SSDEEP 786432:qxGBxG0xG4xGRxGXxGWxGmxGjxGBxG/xG8xGvxGqxGixG:qEBE0E4EREXEWEmEjEBE/E8EvEqEiE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
InstallerKms.exe

File Explorer

InstallerKms.exe

.exe 68.0MB

InstallerKms.exe

IMPHASH 7aa92096b259e09d092b7ede5bb0f176
SHA256 9f18caf887db4cccec90f1d018538b77fd5b6e2f7bcaaecbd66fee016f98e10d
MD5 f53efc191a90dd0ba78c961b513efb56
SHA1 0a30f6b17900dd62ba3c76289ae7f427dd8c26cd
SHA512 a4b05a36ce2b58821a14d2f13d176756e0293e777e50e052a52a0543cc2fbee93ae4b0f46af21aa4b5ba86a5414ebc400da60201f25c1da8820620ad408e67a7
SSDEEP 786432:qxGBxG0xG4xGRxGXxGWxGmxGjxGBxG/xG8xGvxGqxGixG:qEBE0E4EREXEWEmEjEBE/E8EvEqEiE
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

132895

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VerifyVersionInfoW SetSystemPowerState VerLanguageNameW HeapSize GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW IsSystemResumeAutomatic GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc GetFileType HeapAlloc HeapFree RequestWakeupLatency LoadLibraryA GetProcAddress FreeLibrary GetLastError CloseHandle WriteFile CreateFileW SetFilePointerEx VerSetConditionMask GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle LoadLibraryExW TlsFree TlsSetValue WideCharToMultiByte MultiByteToWideChar GetStringTypeW RaiseException EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue WriteConsoleW

ole32

StringFromGUID2 CLSIDFromProgID StringFromCLSID CoInitializeSecurity CoRevokeClassObject CoTaskMemAlloc CoGetClassObject CoInitializeEx CoGetCurrentProcess CoUninitialize CoGetMalloc CoTaskMemFree CoCreateGuid CoRegisterClassObject

powrprof

GetPwrCapabilities PowerDeterminePlatformRoleEx PowerSettingRegisterNotification PowerSettingUnregisterNotification IsPwrSuspendAllowed IsPwrHibernateAllowed IsPwrShutdownAllowed SetSuspendState

shlwapi

PathAddBackslashW StrCmpW StrTrimW PathFileExistsW StrStrW StrChrW PathFindExtensionW PathRemoveFileSpecW StrToIntW PathIsDirectoryW

cfgmgr32

CM_Locate_DevNodeW CM_Is_Version_Available CM_Get_Sibling CM_Get_Parent CM_Get_Device_Interface_List_SizeW CM_Get_DevNode_Status CM_Get_Device_ID_Size CM_Get_Device_IDW CM_Get_Depth CM_Get_Child

version

GetFileVersionInfoW GetFileVersionInfoSizeExW GetFileVersionInfoExW VerQueryValueW GetFileVersionInfoSizeW VerInstallFileW VerFindFileW

Name

.text

Size

258KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

67.6MB

Virtual Size

67.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

InstallerKms.exe

kernel32

ole32

powrprof

shlwapi

cfgmgr32

version

generic