KMSAutoPlusPlus.1.5.4_www.Downloadha.com___2_.zip
- SHA256 8bb7c7e5bbcef2a3f0f9039925de0dfff59086dd170fe830bed91cd402a57e67
Behavioral task
behavioral1
Sample
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/OInstallLite.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target KMSAutoPlusPlus.1.5.4_www.Downloadha.com___2_.zip
- Size 20.7MB
- Sample261102-dc5qraev7t
- SHA256 8bb7c7e5bbcef2a3f0f9039925de0dfff59086dd170fe830bed91cd402a57e67
- MD5 cd6c6559c53c35cc670cadb80195fc1d
- SHA1 234b1aa670acaceb5fd60cc31b86644c7b79690f
- SHA512 f68a4c9b8752c8a57d48b87bef64991a8142083063fcf72636ca188aaae51c28af0f77448c4c79d65a78c876621e4c16d66b1180ac409c7f9de716de36443ccb
- SSDEEP 393216:Pj99aW43pwwpa32bZiuvZiauGJvBLr0+7AXqME4mENf4hhd4pcEKkTF+6Hsq:PhsawQ32RJJpLl7AXNHmc4zd4TVp
- TLSH T1092733752465F150027EAEEB36AF248D3FC1A38F1EEDAB561061A45301BBFC1784B1A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe upx static1/unpack001/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/OInstallLite.exe upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack002/out.upx unpack003/out.upx - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe unpack001/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/OInstallLite.exe
File Explorer
-
KMSAutoPlusPlus.1.5.4_www.Downloadha.com___2_.zip.zip 20.7MB
-
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe.exe 15.1MB
-
out.upx.exe 16.8MB
-
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.ini1KB
-
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/OInstallLite.exe.exe 6.1MB
-
out.upx.exe 13.9MB
-
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/readme_en.txt6KB
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.exe
- SHA256 30693d020456f4f4b0d2a6c6c13d907787283fcea11f0459e75bf9c55e100350
- MD5 dc363fc9636f9474c44b123afba3e899
- SHA1 2c25821a4106f2ae48b7f8c46d0e1344694c6414
- SHA512 5780c86a6ed0d6f7a4682ac9b471831a2cd9bfd7b4125c7f094dc8e396d454af759ec07f551c209b7299bff2b33acf36b51ce6db36a1d15369a8e1086de8d40a
- SSDEEP 393216:Y2oMfRxxyaqpOeD5lXBMA16PQyp+Ap8KRoM/vR:Y2o2jQaqpOeDfXKA1TypSm5
- TLSH T106F6337B485261E8F4813C705A2EFCE4351978232E4579712D47CAE9887AEC3E7DA70B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b6:dd:e5:48:c4:e9:34:5b:24:4d:ec:e4:b7:02:65:39:d2:a2:52:b0:14:b9:26:19:8c:e7:bf:86:27:48:6a:75
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
PE Signature issue
Digest
8a:8c:f4:ad:bb:d8:25:2c:72:ff:bb:b4:16:28:e8:e2:5c:a2:e0:11
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
17679936
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
1.8MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
15.1MB
Virtual Size
15.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
46KB
Virtual Size
48KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 9ba65440dd9d2f4e8e9b1c3e5c2588213248572fdd3f8843eb6555c59f79ad9f
- MD5 350be6d81e6edb6c6ebb908464261317
- SHA1 a35004442cbcf0048ae4f78eced05dff603b64f0
- SHA512 58418c8fabca7a8864971ed03ad6699cc9038a32431910975fd8f5de609a8ed7d78d3c2d71e38477583dc463f56361d3e1de4e0da41f38ca574c3576a281166a
- SSDEEP 393216:Xju/RVtp8BOgoB+rhegiehqprEnIuEfjf+i7eFw:XjuZVtmA+sDewpInv+jf+Ye+
- TLSH T1A80712327BD2C0B1E5A21AB184EA1272552DBE044B37CCD7D2847E09FB726F1A93935D
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.code
Size
228KB
Virtual Size
228KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
678KB
Virtual Size
677KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
'.text'
Size
512B
Virtual Size
21B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
148KB
Virtual Size
148KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
15.7MB
Virtual Size
15.8MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
45KB
Virtual Size
44KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAuto++.ini
- SHA256 a3b4854cbcb03570c93bf51663b3bb8b372cc68f32a67001b47b6ab9171d1831
- MD5 ab5603a43605c04115ee53f0a4e0f11d
- SHA1 f4aa6bda6e82f38c86def0940428c5c9db5a5231
- SHA512 38f4944ef571390ad17fbd70a499c49f959ce4a82f4a9123a41f475eb467f73b4e9550a0ab7086458b0ca1ce2c2351bade95f35cf9cc0d1211c331ce52a6f041
- TLSH T1C4414C521F0139EE837EE3A29C9C64D9CBFD23404D0105DD27767A888D7A20E8DDCA9A
- MD5 SHA1 SHA512 TLSH
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/OInstallLite.exe
- SHA256 8fce30699b9de40656b887dc483aadfe1bba8e025f079fbb96e88ae3f228825b
- MD5 8605742e929696f5aac1dd37194d8323
- SHA1 8be480d208875a08582c9b4e11bf3ad66ff991c2
- SHA512 69baac6b46bad32cf78a03f2c004e3fd5701dc32224f4dde508205662c988ef5c7fb08cb72488cb4b9018b97695fd382acd92136b7b36266d8b8421027b185f1
- SSDEEP 196608:5bHW796hKqQjgiXuhqprEnIziE0+RO0f+SBoz4H+ty:xrhegiehqprEnIuEfjf+i7e
- TLSH T13B5633F58911A07BF84A55BD98396481244E7C0A1C43FC787E57EEF4BB35AC2A49238F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
1f:96:88:6a:fc:ea:a6:67:13:45:24:ef:d9:c2:f6:da:73:b0:60:fd:67:31:b9:7e:e7:8b:db:3e:43:54:11:2a
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
PE Signature issue
Digest
bb:33:1f:df:43:ae:45:db:91:62:79:f2:27:66:c8:8b:8d:c2:c0:27
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
NO CERTIFICATE
Chains
Jan 1, 0001
Subject
CN=COMODO SHA-256 Time Stamping Signer,O=COMODO CA Limited,L=Salford,ST=Greater Manchester,C=GB
Serial Number
4e:b0:87:8f:cc:24:35:36:b2:d8:c9:f7:bf:39:55:77
Issuer
CN=UTN-USERFirst-Object,OU=http://www.usertrust.com,O=The USERTRUST Network,L=Salt Lake City,ST=UT,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageContentCommitment
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Dec 31, 2015 - Jul 9, 2019
Minor OS version
0
Major OS version
4
Entry point
15167248
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
UPX0
Size
Virtual Size
8.4MB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
6.0MB
Virtual Size
6.0MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
84KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
out.upx
- SHA256 63b54ab8f4aeb02679a4001645f2155ef7440d3688283acfc32b03d06e222bc1
- MD5 da42542d5f80016b9686d175b226f303
- SHA1 f888107d64862b62216efd61722856f935e6f01d
- SHA512 5266280e12ad032c2c603680ea3cb2d032268082be94741ab4802e9090b81ac744c2bee61ebc2cb48bfad595d35ce77bfb53a7c3e7ca20a8946d4a4987c0b07b
- SSDEEP 196608:rBuywrbtpmzVy9/P5xaFfWwh7+AkZnXI1NmECL2fGwyNA28IJv+A5VsnJHi4U3VS:FjwntUVyNYWw9oPcr86
- TLSH T1D7E67C11E7D74074F9B31B309976A32A4637BD215931CDCFE28C694DABBB981883172B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4096
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
Name
.code
Size
165KB
Virtual Size
165KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.text
Size
594KB
Virtual Size
594KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
114KB
Virtual Size
113KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
13.0MB
Virtual Size
13.5MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
83KB
Virtual Size
82KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.modplug
Size
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/KMSAutoPlusPlus.1.5.4_www.Downloadha.com_/readme_en.txt
- SHA256 c7a2d7fa7dcf9a08a5179720f81b947221f0e94bc797878352ecae52d923c939
- MD5 7a4fb804af171ad041c65e3e46fd00b2
- SHA1 9beb5c6be92ab6129c8577efb1bda567b5f67006
- SHA512 e67221d43349a57baa48b7631eaa2fe6863d444dbe84a231392de42d6c0386de04fb700cde79cd42eadc4b059d6e5e82aa063932777601db0d05d3dbe0688965
- SSDEEP 96:A40LUpRsFvxeAKVaUJK7xKi53Db2mJ/Mg/gRhpIWDIfNaDmK8FMYz/Xc:RiBx6EUQVKW3/2c/UMLK8FMWfc
- TLSH T13BE1303B52F7567902E391A11B4F1FA2B32940D8B2192404B15ED02DA3E2DAD73BF2CD
- MD5 SHA1 SHA512 SSDEEP TLSH