Gridinsoft Logo
File Icon

The KMSELDI.exe (KMS GUI ELDI) File Analysis

Updated 1 year ago
Checked by Malaware Check
KMSELDI.exe

Technical Analysis

File Name KMSELDI.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
SSDEEP Hash
12288:sBMSCV2RM+V8PW/+jSZOgJ38Ry3niRTiAH7UrbwIpmOs8b2i:snCEM68Lj5gNi2niRTiq7UrbnbsQ2i
Scanner Version 1.0.151.174
Database Version 2023-12-12 15:01:11 UTC
⚠

Suspicious File Detected

Detected by 51 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

AutoKMS is a tool associated with illegal Microsoft software activation that bypasses legitimate licensing processes. It introduces security risks and potential legal consequences.
71%
Detection Rate
943,808
File Size (bytes)
51/72
Engines Detected
2023-12-12
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
f0280de3880ef581bf14f9cc72ec1c16
SHA1
43d348e164c35f9e02370f6f66186fbfb15ae2a3
SHA256
50ebfa1dd5b147e40244607d5d5be25709edf2cc66247a78beb920c77ac514cc
SHA512
ac31a972e9e93e6671f44d403139b0db89d950097c848fbaf6b9965b722215f74e9ed9bb9e083d31328101e6fcfe7f960a08b3bea0813900f11d5c1bb40539a6
ImpHash
f34d5f2d4577ed6d9ceec516c1f5a744

Security Engines with Detections (51 of 72)

Bkav
W32.Common.2B9B56E8 Malicious
Lionic
Hacktool.MSIL.KMSAuto.3!c Malicious
Elastic
malicious (high confidence) Malicious
Cynet
Malicious (score: 100) Malicious
CAT-QuickHeal
Trojan.YakbeexMSIL.ZZ4 Malicious
Skyhigh
Crack-KMS Malicious
ALYac
Misc.HackTool.AutoKMS Malicious
Cylance
unsafe Malicious
Zillya
Tool.IdleKMS.Win32.257 Malicious
Sangfor
Suspicious.Win32.Save.a Malicious
BitDefender
Application.Hacktool.OD Malicious
Cybereason
malicious.164c35 Malicious
Symantec
Hacktool.Kms Malicious
ESET-NOD32
MSIL/HackTool.IdleKMS.I potentially unsafe Malicious
APEX
Malicious Malicious
ClamAV
Win.Malware.Agent-6352022-0 Malicious
Kaspersky
HackTool.MSIL.KMSAuto.di Malicious
ViRobot
HackTool.943808 Malicious
MicroWorld-eScan
Application.Hacktool.OD Malicious
Avast
FileRepPup [PUP] Malicious
Rising
[email protected] (RDMK:IYUhqaJin+ZZeZqhKbCBFQ) Malicious
Emsisoft
Application.HackTool (A) Malicious
VIPRE
Application.Hacktool.OD Malicious
TrendMicro
HKTL_AUTOKMS Malicious
FireEye
Generic.mg.f0280de3880ef581 Malicious
Sophos
KMS Activator (PUA) Malicious
Ikarus
HackTool.KMSpico Malicious
Jiangmin
NetTool.RPCHook.d Malicious
Webroot
W32.Hack.Tool Malicious
Google
Detected Malicious
Microsoft
HackTool:Win32/AutoKMS Malicious
Xcitium
ApplicUnwnt@#28xsiha4qf9re Malicious
Arcabit
Application.KMS Malicious
ZoneAlarm
HackTool.MSIL.KMSAuto.di Malicious
GData
Application.Hacktool.OD Malicious
Varist
W32/S-eb8730b5!Eldorado Malicious
AhnLab-V3
Unwanted/Win32.HackTool.C974827 Malicious
McAfee
Crack-KMS Malicious
MAX
malware (ai score=100) Malicious
Panda
HackingTool/AutoKMS Malicious
Zoner
Trojan.Win32.65638 Malicious
TrendMicro-HouseCall
HKTL_AUTOKMS Malicious
Tencent
Malware.Win32.Gencirc.118f638b Malicious
Yandex
Trojan.Igent.bX8XMi.1 Malicious
SentinelOne
Static AI - Suspicious PE Malicious
MaxSecure
Trojan.Malware.8763703.susgen Malicious
Fortinet
Riskware/RPCHook Malicious
BitDefenderTheta
Gen:NN.ZemsilF.36738.5m1@aGyQElm Malicious
AVG
FileRepPup [PUP] Malicious
DeepInstinct
MALICIOUS Malicious
CrowdStrike
win/grayware_confidence_100% (W) Malicious
21 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 8bbb0a9939e7f4c93cd1e12408db5986
Fuzzy: bf664f70c0e768f7575f91389633fed5
dHash: 0c9f1f0f4f7f1706
Image Base 0x00400000
Entry Point 0x004e1e8e
Compilation Time 2016-01-11 22:28:07
Checksum 0x000ebd7c (Actual: 0x000ebd7c)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Digital Signature Chain verification from CN=@ByELDI (serial:-69403741341198612868765313511281709924, sha1:eaaf9045685acd5ad5846a5e9ee125d7aeac21c2) failed: Unable to build a validation path for the certificate "Common Name: @ByELDI" - no issuer matching "Common Name: @ByELDI Certificate Authority" was found
Imports 1 libraries
mscoree
Exports 0 functions
Resources 4 Resources
Sections 3 Sections

Digital Signatures

▼
@ByELDI Certificate Authority ()
@ByELDI Certificate Authority ()
Thawte Timestamping CA Symantec Corporation (US)
Symantec Time Stamping Services CA - G2 Symantec Corporation (US)

Version Information

▼
Translation 0x0000 0x04b0
Comments Activation GUI for KMS Host
CompanyName @ByELDI
FileDescription KMS GUI ELDI
FileVersion 37.1.0.0
InternalName KMSELDI.exe
LegalCopyright
LegalTrademarks
OriginalFilename KMSELDI.exe
ProductName KMS GUI ELDI
ProductVersion 37.1.0.0
Assembly Version 37.1.0.0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00002000 917,140 bytes 917,504 bytes 6.77 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 170CAFA364C3F012EDC6CFC39114912F
.rsrc 0x000e2000 20,792 bytes 20,992 bytes 5.06 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ AA3247D901AE5D369BEE5A66AC3DE307
.reloc 0x000e8000 12 bytes 512 bytes 0.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 33DEE5DBD9B3AE9B070060031D8FA474
Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 4 (20,475 bytes)
Resource Type Count Total Size Percentage
RT_ICON 1 16,936 bytes
82.7%
RT_GROUP_ICON 1 20 bytes
0.1%
RT_VERSION 1 846 bytes
4.1%
RT_MANIFEST 1 2,673 bytes
13.1%

Certificate Chain Analysis

▼
Certificate #1
Subject @ByELDI
Issuer @ByELDI Certificate Authority
Serial Number -69403741341198612868765313511281709924
Certificate #2
Subject @ByELDI Certificate Authority
Issuer @ByELDI Certificate Authority
Serial Number 49063419877276096425045120757534515564
Certificate #3
Subject Symantec Time Stamping Services CA - G2
Symantec Corporation
US
Issuer Thawte Timestamping CA
Serial Number 168250781398245547403531165097821404219
Certificate #4
Subject Symantec Time Stamping Services Signer - G4
Symantec Corporation
US
Issuer Symantec Time Stamping Services CA - G2
Serial Number 19688950797630895426199952712430983760
Certificate Verification Status

Chain verification from CN=@ByELDI (serial:-69403741341198612868765313511281709924, sha1:eaaf9045685acd5ad5846a5e9ee125d7aeac21c2) failed: Unable to build a validation path for the certificate "Common Name: @ByELDI" - no issuer matching "Common Name: @ByELDI Certificate Authority" was found

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
51 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware
An unexpected error occurred. Please try again later.