Behavioral task
behavioral1
Sample
mini-KMS_Activator_v1.3_Office2010_VL_ENG.exe
Resource
win7-20240708-en
General
-
Target
15232b8fb355080763d355a5c75e117b_JaffaCakes118
-
Size
1003KB
-
MD5
15232b8fb355080763d355a5c75e117b
-
SHA1
e680967b1ccb1ee4e5f700e1ee35c573fca76c6d
-
SHA256
e60d799e17e5037920d824c89e6020877784f2fd4b0b05940bab381471e237fa
-
SHA512
7514235e560589b2987efb6c3d4feaa49876461232535262c8cd2720fa8ab91faf5a9d38fc633553656ddcfedd37d17d901e14b936b5900d45619846b56acd3c
-
SSDEEP
24576:Hf1yuHt9a4vqJEPAnTp6eL+PZJoqe0KiEimTd:H9RN9a02rYJomyimTd
Malware Config
Signatures
-
resource yara_rule static1/unpack001/mini-KMS_Activator_v1.3_Office2010_VL_ENG.exe upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/mini-KMS_Activator_v1.3_Office2010_VL_ENG.exe
Files
-
15232b8fb355080763d355a5c75e117b_JaffaCakes118.rar
-
mini-KMS_Activator_v1.3_Office2010_VL_ENG.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 988KB - Virtual size: 992KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 29KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE