The klite-mega-codec-17.2.5-installer_8Y-PWp1.exe (FH Managеr) File Analysis

Updated 1 year ago

Checked by Malware Check

klite-mega-codec-17.2.5-installer_8Y-PWp1.exe

Technical Analysis

File Name	klite-mega-codec-17.2.5-installer_8Y-PWp1.exe
File Type	Win32 EXE
Magic Bytes	`PE32 executable (GUI) Intel 80386, for MS Windows`
SSDEEP Hash	24576:h4nXubIQGyxbPV0db26WSUMIO0tnYwpTGRVYbdRj/hRYEcm03i3Elaea+NI9m:hqe3f6UNcYxR7H+3pja+j
Scanner Version	1.0.143.174
Database Version	2023-10-20 15:02:05 UTC

⚠

Suspicious File Detected

Detected by 8 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.

11%

Detection Rate

1,762,208

File Size (bytes)

8/71

Engines Detected

2023-10-20

Analysis Date

Scan Another File

File Identification

Hash Type	Value	Action
MD5	a58d41606dcaa46dd3a417aa86dcda43
SHA1	f40fdd402e420383ee982795a35c08398c047f26
SHA256	7a4205ecf09a09e68cecf4c2cc52ccf8cbc3484cf58b073336c8745038164ba4
SHA512	4c1aa84a2d4836139fde0678263a3dc1bb8330df33540111e83970041327cf2c7308d35c712d3a1ff1735b8aa6f598a9924d19625d3eab4e5773b845a7ca6063
ImpHash	5a594319a0d69dbc452e748bcf05892e

Security Engines with Detections (8 of 71)

Elastic

malicious (moderate confidence) Malicious

Malwarebytes

PUP.Optional.BundleInstaller Malicious

CrowdStrike

win/grayware_confidence_60% (D) Malicious

ESET-NOD32

a variant of Win32/OfferCore.E potentially unwanted Malicious

DrWeb

Adware.Downware.20416 Malicious

Webroot

W32.Adware.Gen Malicious

Xcitium

ApplicUnwnt@#223kfgqm3d97f Malicious

Rising

[email protected] (RDML:zMMfASmF416hU5/yUveq4g) Malicious

63 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼

Icon	Hash: a0ef7c81eee20e999575764306184ccf Fuzzy: 8341e53a6f1047f3c936b4d36dc8f542 dHash: 5050d274ccec82ae
Image Base	`0x00400000`
Entry Point	`0x004b5eec`
Compilation Time	2021-06-03 08:09:11
Checksum	0x001bb068 (Actual: 0x001bb068)
OS Version	6.1
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	OK
Imports	7 libraries kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
Exports	3 functions
Resources	30 Resources
Sections	10 Sections

Digital Signatures

▼

AAA Certificate Services	Sectigo Limited (GB)
Sectigo Public Code Signing Root R46	Sectigo Limited (GB)
Sectigo Public Code Signing CA R36	FH Manager (IL)

Version Information

▼

Comments	This installation was built with Inno Setup.
CompanyName
FileDescription	FH Managеr
FileVersion	36.26.2683.9493
LegalCopyright	©2023 FH Managеr
OriginalFileName
ProductName	FH Managеr
ProductVersion	36.26.2683.9493
Translation	0x0000 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	734,748 bytes	735,232 bytes	6.36 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`AD6E46E3A3ACDB533EB6A077F6D065AF`
`.itext`	`0x000b5000`	5,768 bytes	6,144 bytes	5.97 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D40FC822339D01F2ABCC5493AC101C94`
`.data`	`0x000b7000`	14,244 bytes	14,336 bytes	5.04 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`4C195D5591F6D61265DF08A3733DE3A2`
`.bss`	`0x000bb000`	28,136 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x000c2000`	3,894 bytes	4,096 bytes	4.90 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A73D686F1E8B9BB06EC767721135E397`
`.didata`	`0x000c3000`	420 bytes	512 bytes	2.76 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`41B8CE23DD243D14BEEBC71771885C89`
`.edata`	`0x000c4000`	154 bytes	512 bytes	1.87 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`37C1A5C63717831863E018C0F51DABB7`
`.tls`	`0x000c5000`	24 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x000c6000`	93 bytes	512 bytes	1.38 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`8F2F090ACD9622C88A6A852E72F94E96`
`.rsrc`	`0x000c7000`	69,120 bytes	69,120 bytes	3.71 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`F5362495FF2AD9549D2896D8AD107324`

Resource Analysis

▼

Total Resources: 30 (67,411 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	13	55,173 bytes	81.8%
RT_STRING	11	8,040 bytes	11.9%
RT_RCDATA	3	768 bytes	1.1%
RT_GROUP_ICON	1	188 bytes	0.3%
RT_VERSION	1	1,412 bytes	2.1%
RT_MANIFEST	1	1,830 bytes	2.7%

Certificate Chain Analysis

▼

Certificate #1

Subject	Sectigo Public Code Signing Root R46 Sectigo Limited GB
Issuer	AAA Certificate Services
Serial Number	`97015870309959729927281967672979788822`

Certificate #2

Subject	Sectigo Public Code Signing CA R36 Sectigo Limited GB
Issuer	Sectigo Public Code Signing Root R46
Serial Number	`130417131954583740712891216934480190474`

Certificate #3

Subject	FH Manager FH Manager IL
Issuer	Sectigo Public Code Signing CA R36
Serial Number	`4328158927895735047930368666597956184`

Certificate Verification Status

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
Email Security: Be cautious with email attachments and links, even from known contacts.

Proactive Protection

8 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for

5 4 3 2 1