5a91a10ae449221605e333a4875e209b383ba3317a860dba7d8b52494edfcd58
- SHA256 5a91a10ae449221605e333a4875e209b383ba3317a860dba7d8b52494edfcd58
Behavioral task
behavioral1
Sample
HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral3
Sample
HEU KMS Activator v63.3.0/办文绿软.url
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
HEU KMS Activator v63.3.0/办文绿软.url
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 5a91a10ae449221605e333a4875e209b383ba3317a860dba7d8b52494edfcd58
- Size 4.2MB
- Sample261003-p8e1rayfrb
- SHA256 5a91a10ae449221605e333a4875e209b383ba3317a860dba7d8b52494edfcd58
- MD5 92210c98ab48f1ac1d3a8fb9d362146d
- SHA1 dd3cc38f4453c3e7ef6dd7d5c47ddb106ebdfaac
- SHA512 9258225a7974c57ebec9db2410431844bd63594c131288330ebca32aab856a9bf1cce3b075be75162214f08f17da8142060ea8e51a6c371dd1ff31fca5531d8c
- SSDEEP 98304:L21N2fGe9gS1IGxsn2sSIzjXB34BrCk61+ky2UQo:L2OfGeuut+nZzLR1MXQo
- TLSH T1AA16336DA22B0993D39B14A07DF023CDBDE04E9CB9CD27C517946F263F242BA599805F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule static1/unpack002/out.upx autoit_exe -
resource yara_rule static1/unpack001/HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe unpack002/out.upx
File Explorer
-
5a91a10ae449221605e333a4875e209b383ba3317a860dba7d8b52494edfcd58.zip 4.2MB
-
HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe.exe 4.3MB
-
out.upx.exe 4.8MB
-
HEU KMS Activator v63.3.0/办文绿软.url.url 114B
-
HEU KMS Activator v63.3.0/安装步骤.txt418B
HEU KMS Activator v63.3.0/HEU_KMS_Activator_v63.3.0.exe
- SHA256 9cd237d04d1b2dbf2610e1ed5ca130295a8640664f9bc33bf0ee73997e360ff0
- MD5 574f39c2c5e78ced0755cae991e0ab61
- SHA1 8b9dcc94ec61c899d031ce53d91c499afa4b9b30
- SHA512 c8adb347e2854d9f94855fe2c44ba102e47f29abcf2ca531ec76fe65b039f9345d872d27ef37db372821799f6cecf18a07be077a8189d2d6ca9d5931638097ac
- SSDEEP 98304:2+S9bg0UTqy14GZOiRQL+IyA/r7v3IlhCA6l+UeOq8:tMc1TqyiwT2LH/vXlmP8
- TLSH T1842633D5B11FDD0ED5A2D7F0691C0D46EE92AF9E6A4F338E7BA02AA91B1035008CC5D7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
5049600
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
4.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
372KB
Virtual Size
372KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
out.upx
- SHA256 6be4cef3c0b60ba863112ac4b2dd2ee7b123230952fe0496b35487653fd5abd3
- MD5 a2c5ef42370f07b51ce539a8fb86f450
- SHA1 d5e3fcdad56047fe7f3dd778bd3f4a02662da486
- SHA512 b060d7ca1ddfaceef2e15e655d5e2547d4835fa1ad0154b2287d6772bcc69f27020b9863c7f1a7f6843b958c42fc9a82955be1660521241482c7b1a4850e77d2
- SSDEEP 98304:MjTQYxsW5TUTqy14GZOiRQL+IyA/r7v3IlhCA6l+UeOq8:M3dxfCTqyiwT2LH/vXlmP8
- TLSH T1C03623427346C02AFF97D3724F4AEE019B796A6A0117B65F23981D79BE30370067D6A3
- MD5 SHA1 SHA512 SSDEEP TLSH
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
5
Entry point
132471
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.text
Size
619KB
Virtual Size
618KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
191KB
Virtual Size
190KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
3.9MB
Virtual Size
3.9MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=35, id=241, version=40116,
count=157, id=243, version=40116,
count=35, id=242, version=40116,
count=1, id=199, version=41118,
count=45, id=261, version=26706,
count=18, id=260, version=26706,
count=21, id=259, version=26706,
count=9, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=37, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=553, id=1, productName=Unmarked objects,
count=80, id=270, version=27045,
count=1, id=259, version=27045,
count=1, id=255, version=27045,
count=1, id=151,
count=1, id=258, version=27045,
HEU KMS Activator v63.3.0/办文绿软.url
- SHA256 77fff6ceb634e8b3512c81b05ee0d07c4a6501f7426efaf288f903c811fa02f6
- MD5 453de2c12c01d5a14cf7d57916e89eee
- SHA1 7adcbb6d42cd75f4899b79c8709e6be6320a955e
- SHA512 b6c173be893d62a354e94bbe7a5b22b8a1395918513638dd1ae1b03c66993b5e481095d9d0e6060bc6f3058651eb969c91f737e75b19634f19a4b6c9ac7bb2cf
- TLSH T1E5B012AE5509C69AD141C41A5070F9089C0F79A08CD2D0DC6548DEDB4C480D2C565B37
- MD5 SHA1 SHA512 TLSH
HEU KMS Activator v63.3.0/安装步骤.txt
- SHA256 140726d31285e9fb7dc38e690d23ddbdac610fd111317bf517a0019cd451c790
- MD5 3159d1657a372bb79de63ad7c7dbc271
- SHA1 c2bacb59a20840809ee7f3e9a62be97dfc0d2879
- SHA512 a42bb0524137e0b300acfc269052bac54dbe85d564252a2e55df23d7f48e0f8cf155d53ef10113bb534e16446c8dee226c428f34d69eeff5b2ffe27eff9b991f
- TLSH T1F5E0AB4FA63B4BB3F31761254B808F6B3A2D2180C932C1DB7B000F44594262203E98BF
- MD5 SHA1 SHA512 TLSH