The kmyHook exe (DotNetDetour) File Malware Analysis
Gridinsoft Logo

The kmyHook.exe (DotNetDetour) File Analysis

Updated 6 months ago
Checked by Malware Check
kmyHook.exe

Technical Analysis

File Name kmyHook.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
SSDEEP Hash
6144:sRqh89zbCWwtOVtWwyidmTJiCAOI8jn48uXskDX1LGhyU7DFrVS:7sbCWwBn9MskDXAYkDPS
Scanner Version 1.0.218.174
Database Version 2025-06-14 20:00:18 UTC
⚠

Suspicious File Detected

Detected by 9 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
12%
Detection Rate
349,392
File Size (bytes)
9/73
Engines Detected
2025-06-14
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
c40103ec023a25f4183fd671253b28bc
SHA1
7e393269cc1456299c1c1087345cff323f286623
SHA256
525e5efb17967c620d67a7e5c343def2e9d2bc3370e7b0dfea7d30fbcfb3e388
SHA512
3836964f97ffab5f650f33c6c66096346cd30149a7928ac7f03beac72c4e716d15084ecb758a7fb1091af48be3e5fc25a2c32f96697ef517ffaea57aca73c54f
ImpHash
f34d5f2d4577ed6d9ceec516c1f5a744

Security Engines with Detections (9 of 73)

K7AntiVirus
Riskware ( 00584baa1 ) Malicious
K7GW
Riskware ( 00584baa1 ) Malicious
Avast
Win32:Malware-gen Malicious
Fortinet
W32/Wacapew.C!tr Malicious
Ikarus
Trojan.Win32.VMProtect Malicious
Webroot
W32.Malware.gen Malicious
Google
Detected Malicious
AVG
Win32:Malware-gen Malicious
DeepInstinct
MALICIOUS Malicious
64 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x004538b2
Compilation Time 2100-06-21 14:47:11
Checksum 0x00057ef2 (Actual: 0x00057ef2)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PDB Path C:\Users\Cirno\Documents\rpgProjs\loaders\kmyHook\obj\Release\kmyHook.pdb
Digital Signature OK
Imports 1 libraries
mscoree
Exports 0 functions
Resources 2 Resources
Sections 3 Sections

Version Information

▼
Translation 0x0000 0x04b0
Comments
CompanyName
FileDescription DotNetDetour
FileVersion 1.0.0.0
InternalName kmyHook.exe
LegalCopyright Copyright © 2015
LegalTrademarks
OriginalFilename kmyHook.exe
ProductName DotNetDetour
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00002000 334,864 bytes 335,360 bytes 6.01 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D11EAEC333EB6570FB60F98C687B9296
.rsrc 0x00054000 1,460 bytes 1,536 bytes 4.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 6BE097717ED142380DEC9DA5E3CC9AA3
.reloc 0x00056000 12 bytes 512 bytes 0.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 6576F000F8E2B3AD815EE99215A2F17E

Resource Analysis

▼
Total Resources: 2 (1,294 bytes)
Resource Type Count Total Size Percentage
RT_VERSION 1 804 bytes
62.1%
RT_MANIFEST 1 490 bytes
37.9%

Certificate Chain Analysis

▼
Certificate Information
Product DotNetDetour
Description DotNetDetour
File Version 1.0.0.0
Original Name kmyHook.exe
Signing Date 04:33 AM 11/25/2023 (750 days ago)
Verification Status Signed
Signers 刘沛轩; Sectigo Public Code Signing CA R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)
Counter Signers DigiCert Timestamp 2023; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4; DigiCert
Internal Name kmyHook.exe
Copyright Copyright © 2015
Certificate Chain Summary
Sectigo Public Code Signing Root R46 #1 Primary
Validity Period: 2021-05-25 00:00:00 → 2028-12-31 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16
Sectigo Public Code Signing CA R36 #2 Chain
Validity Period: 2021-03-22 00:00:00 → 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 62 1D 6D 0C 52 01 9E 3B 90 79 15 20 89 21 1C 0A
刘沛轩 #3 Chain
Validity Period: 2022-04-07 00:00:00 → 2025-04-06 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 91 18 48 44 28 A4 40 16 60 91 F7 13 DE AA 62 DB
DigiCert Timestamp 2023 #4 Chain
Validity Period: 2023-07-14 00:00:00 → 2034-10-13 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 05 44 AF F3 94 9D 08 39 A6 BF DB 3F 5F E5 61 16
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #5 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Trusted Root G4 #6 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
9 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware