mKMSAct[.]exe | Triage™

General

Target
mKMSAct.exe
Size 2.0MB
Sample260724-fw2vbaee66
SHA256 0621080ebec2a6eadf2d0fb40279d4ebaadc617b31634d754c66e08aa30d6702
MD5 ba804e62f9c39f87b9f0e009614e55ba
SHA1 528fbb0e7ed33fe9ba7f1225866986190b3951ae
SHA512 6e0c74ad7ba34703c0d1b5ebc7dd0f43a60b136a3454783ee75f40627cc42cc93c788f6b0fac97f86ec0748cfda722fb260d05b0ef430d92fc6b77be8f21a23e
SSDEEP 49152:IWWW1/PNXzVqOQessR+EJvHq7HZCjfiizMmP9twV/1VN3px8Hm:xT1/15trpfvHqNCDiifXW1X3pV
TLSH
T1FAA533F5E88D50FCDA975AB58FE1A034D271A95492C21DC7B6E8E8231CC37C0F84976A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

upx

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
mKMSAct.exe

SHA256 0621080ebec2a6eadf2d0fb40279d4ebaadc617b31634d754c66e08aa30d6702
MD5 ba804e62f9c39f87b9f0e009614e55ba
SHA1 528fbb0e7ed33fe9ba7f1225866986190b3951ae
SHA512 6e0c74ad7ba34703c0d1b5ebc7dd0f43a60b136a3454783ee75f40627cc42cc93c788f6b0fac97f86ec0748cfda722fb260d05b0ef430d92fc6b77be8f21a23e
SSDEEP 49152:IWWW1/PNXzVqOQessR+EJvHq7HZCjfiizMmP9twV/1VN3px8Hm:xT1/15trpfvHqNCDiifXW1X3pV
TLSH
T1FAA533F5E88D50FCDA975AB58FE1A034D271A95492C21DC7B6E8E8231CC37C0F84976A
MD5 SHA1 SHA512 SSDEEP TLSH

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

6720688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths