win10key.exe

First submission 2024-10-15 18:43:03

File details

File type: PE32 executable (GUI) Intel 80386, for MS Windows
Mime type: application/x-dosexec
File size: 6078.5 KB (6224384 bytes)
Compile time: 2020-11-22 12:33:03
MD5: 11205f15a2dc7c76c9bd555d4163f80d
SHA1: 01c1f0debf7c81562c9ca48994793ae94b251117
SHA256: 98fe499fc7070f2c91b721739c81055a52be7cc0ad664e69cd52a4d131a1e8b6
Import Hash : afcdf79be1557326c854b6e20cb900a7
Sections 5 .text .rdata .data .rsrc .reloc
Directories 4 import resource debug relocation

File features detected

Is DLL
Packers
Anti Debug
Anti VM
Signed
XOR

OSINT Enrichments

Virus Total: 52/79 VT report date: 2024-08-05 14:00:59
Malware Type 3 hacktool trojan pua
Threat Type 3 kmsactivator hackkms kmsauto

URLs, FQDN and IP indicators 1

URL Host (FQDN/IP) Date Added
hXXp://101.34.82.183/win10key.exe VirusTotal Report 101.34.82.183 VirusTotal Report 2024-10-15 18:43:03

PE Sections 1 suspicious

Name VAddress VSize Size SHA1 MD5 Suspicious
.text 0x1000 0x8dd2e 581120 6ca4f81d951a00335345adcc6c9699211bfef144 c2c2260508750422d20cd5cbb116b146
.rdata 0x8f000 0x2e10e 188928 57b47ecaac29f80d8daf40951c7d7f4f16ac6d05 4513b58651e3d8d87c81a396e5b2f1d1
.data 0xbe000 0x8f74 20992 bd045801410191cce6558498902a89353b03fcb6 c2de4a3d214eae7e87c7bfc06bd79775
.rsrc 0xc7000 0x527050 5403136 c744ace9f619639857e092846b32c13ec7f725a6 dcb875a2284a24215228359e6e32e75d
.reloc 0x5ef000 0x7130 29184 55df6e389cdefeadf102dce6c3b142530d4153c5 1254908a9a03d2bcf12045d49cd572b9

PE Resources 6

Name Language Sublanguage Offset Size Data
RT_ICON LANG_ENGLISH SUBLANG_ENGLISH_UK 0x10cb80 1128
RT_STRING LANG_ENGLISH SUBLANG_ENGLISH_UK 0x10f158 344
RT_RCDATA LANG_NEUTRAL SUBLANG_NEUTRAL 0x10f2b0 5104543
RT_GROUP_ICON LANG_ENGLISH SUBLANG_ENGLISH_UK 0x5ed690 20
RT_VERSION LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x5ed6a4 876
RT_MANIFEST LANG_CHINESE SUBLANG_CHINESE_SIMPLIFIED 0x5eda10 1597

Meta infos 10

LegalCopyright: \xa92012-2020 www.heu8.com & \x77e5\x5f7c\x800c\x77e5\x5df1
InternalName: HEU_KMS_Activator_v19.6.4
FileVersion: 19.6.4.0
CompanyName: \x77e5\x5f7c\x800c\x77e5\x5df1
OriginalFilename: HEU_KMS_Activator_v19.6.4
ProductVersion: 3.3.14.2
FileDescription: HEU KMS Activator\x2122
Translation: 0x0804 0x04b0
Comments: \x672c\x5730KMS\x6fc0\x6d3b/Win10\x6570\x5b57\x6743\x5229\x6fc0\x6d3b/KMS38\x6fc0\x6d3b
Productname: HEU KMS Activator

Packers detected 2

Microsoft Visual C++ 8
VC8 -> Microsoft Corporation

Anti debug functions 12

FindWindowExW
FindWindowW
GetLastError
GetWindowThreadProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
OutputDebugStringW
Process32FirstW
Process32NextW
RaiseException
TerminateProcess
UnhandledExceptionFilter

Anti debug functions 1

VMCheck.dll

Strings analysis - File found

Library
USER32.dll
KERNEL32.dll
mscoree.dll
combase.dll
ADVAPI32.dll
WSOCK32.dll
SHELL32.dll
GDI32.dll
VERSION.dll
UxTheme.dll
COMCTL32.dll
IPHLPAPI.DLL
WINMM.dll
PSAPI.DLL
WININET.dll
USERENV.dll
COMDLG32.dll
OLEAUT32.dll
ole32.dll
MPR.dll

Strings analysis - Possible IPs found 2

255.255.255.255
3.3.14.2

Import functions

Name Latest seen MD5
ransom_builder.exe 2022-09-26 11:13:02 43a2c7ba0ecd3a1b8ff0b82a0e82296d
HVC.exe 2024-05-18 06:22:04 d3d4eadf3c33f7f479c4e647ac76ed25
eee.exe 2024-05-18 07:07:09 db8d5c5808856045722588e5c2e589fb
Document0984757478.exe 2024-05-19 08:56:03 c36f798f2646092c180c6fc904c418f7
EAP.exe 2024-05-19 10:54:03 76609684d4f0fdd1e46ddf8353c389bf
ngown.exe 2024-05-23 06:15:01 66e5c9de148b496d53b2968c6a03c257
wxijgyp.exe 2024-05-24 12:26:01 ca82319fef771a184d1f98750e5bbb21
gywervcyuj.exe 2024-05-23 08:45:01 d90f41701d76908bf5a1519fe7b99f23
tsaplQyj.exe 2024-05-24 06:47:02 bcdda917607e4c698f148d10466c3b80
zwuivg.exe 2024-05-24 10:10:02 9bd9e74ec90979f70c3e6ceead15aa5a
wsiopohwqsd.exe 2024-05-24 10:53:01 a7e106df2ca7b17bd39ec582d19522a0
QEwecfyhj.exe 2024-05-27 06:26:09 9efd5e60fd358a4bed2382d3815783ae
ESF.exe 2024-05-30 15:27:04 38ed148872d265a595e39e1763a88427
IGCC.exe 2024-06-06 18:20:02 29b2b081df5861fed9651766f37b7738
Satin06.exe 2024-06-08 18:03:03 09ab6049a1abaac4ce2aef0dc60b6b6d
Delivery%2007.exe 2024-06-08 18:04:03 b94b6c27e410388cd4e7dfeb352b75ce
Auto%20R.exe 2024-06-08 18:05:03 351650a422e427140d74d8c68185fa24
proposal%20report.exe 2024-06-08 18:06:03 092cd26903ed79eb7da016adbb7c928d
Delivery%2006.exe 2024-06-08 18:07:03 132e9cb76def326daa4088f99587b759
DELIVERED%200606.exe 2024-06-08 18:09:03 2eebcdd0e833ba968a9cac360aed72de
jonny.exe 2024-06-11 21:22:02 00511c6ef7405a6b00333eaeed463824
twapcdhuj20shds2WOP90sdhy.exe 2024-06-11 21:23:02 49771fd313935046468ff48e9a97f287
DIP.exe 2024-06-12 08:18:02 3f02a2516380a49f81ae8e15e7f548cc
qgtplfgy2.exe 2024-06-13 12:43:03 3d033b03106e5b46abde0df781c164d5
nomi.exe 2024-06-13 12:44:02 5dba79262866002740d9fc8e10d35e7d
QmU99jUVU4mWEyUw7e6kKW8mHeocJZoEM5nUeB87FDFPEh 2024-06-21 08:20:02 2c5a6d97f9c1c28cd3a644ff896b5d95
snukingorig2.5.exe 2024-07-01 21:47:06 7d50650cd2ba63482d4caf875ae65a8e
pilnmAc2.6.exe 2024-07-02 09:22:04 9929a1a4d2ec5d72c028435c6b71054f
PO%2012.04%20pdf.exe 2024-07-06 22:08:03 d90a72256615ac3ba74c924012fea42c
igccu.exe 2024-07-07 11:50:03 c3ebea7cd7e96887d0fffff22bf00101
igccu.exe 2024-07-07 13:54:04 7e65b6742284236fdd138467fad4a26b
notebyx.exe 2024-09-05 18:25:03 7a8463b22eb60bf18f4df8444e006d96
abQOhgu.exe 2024-09-05 18:26:03 387d4b12ac9e87b9db76589fcca2b937
d4eb98701bc0c33b5f9c3e202bf55c1b2e2cb1c1e4b7c81ad6305d7938d0f959.exe.exe 2024-09-28 23:06:04 7b793a4247b701bd24c86920b237acd0
e05adb9434907f4eb8d318c414ced92c177236d5f28d4e2814bbe5719a38fa27.exe.exe 2024-09-30 18:29:04 e9d7eea6b6f3734d4f1f79f0ecf22429
6e99f41ac17bbbcfbb0bcd6ea1f2b3a9c7b659981ff6da15ff24d44385d58f3b.exe.exe 2024-09-30 18:41:04 e7077a89901f62b2ef9559d7631d02c0
taskhostw.exe 2024-10-13 07:07:03 6539c2c942c9aa3ab9c7fe14fccf0b4e