The KLC exe File Malware Analysis

Technical Analysis

File Name	KLC.exe
File Type	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Scanner Version	1.0.211.174
Database Version	2025-03-21 13:00:37 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	25d77c5a4e8633b9bef0e81f0c2c5604
SHA1	33ed90ebcf13ff7fafb02f063717345686c5c559
SHA256	8a6fc5cdc47d17134a29d93ff4e2de0c0213a119718792757fe42614660a550b
SHA512	3f08862bce6a2cc361940e908a02556c8f3ca1efd65b8476b879d0448eb131d4093b1f4887401ac3dd930aa19b5eb88908df506d83103bd6c78f32f82c67783c
ImpHash	dc5ddb8fccb29d4a0d58dde5db1dd4bf

PE Analysis

Basic Information

▼

Image Base	`0x00400000`
Entry Point	`0x00401284`
Compilation Time	2012-10-22 19:12:49
Checksum	0x0003ca3d (Actual: 0x0003ca3d)
OS Version	4.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	9 libraries ADVAPI32, COMCTL32, GDI32, GDIPLUS, KERNEL32, msvcrt, OLE32, SHELL32, USER32
Exports	86 functions
Resources	1 Resources
Sections	10 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	127,728 bytes	128,000 bytes	6.20 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_16BYTES`	`93A6932A408BA659D98F39C5C9EA34C7`
`.data`	`0x00021000`	29,560 bytes	29,696 bytes	7.82 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`25D6FECEE60EB31CEBE887011A52DD56`
`.rdata`	`0x00029000`	8,000 bytes	8,192 bytes	5.10 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_32BYTES`	`F6BD234EA0D4D754F73E7754F881C0AE`
`.bss`	`0x0002b000`	111,428 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_UNINITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_32BYTES`	`D41D8CD98F00B204E9800998ECF8427E`
`.edata`	`0x00047000`	2,326 bytes	2,560 bytes	5.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`FD398A19F537334EBE76E63398DAF11E`
`.idata`	`0x00048000`	6,104 bytes	6,144 bytes	5.42 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`C1C9AFD0DCD883F29FB0248BA5DEB55A`
`.CRT`	`0x0004a000`	24 bytes	512 bytes	0.11 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`10D960D943CBB88B6C754E95F9AC832D`
`.tls`	`0x0004b000`	32 bytes	512 bytes	0.23 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`4F2AC2C12A6BBC66A2644AA5F372E848`
`.rsrc`	`0x0004c000`	648 bytes	1,024 bytes	4.07 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE\|IMAGE_SCN_ALIGN_4BYTES`	`7680FEA8CE365636C90ADD6602C12DAB`
`.reloc`	`0x0004d000`	5,928 bytes	6,144 bytes	6.59 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_ALIGN_4BYTES`	`B76B7BF3F8E9CDF83009EFB396FA6D97`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 1 (560 bytes)

Resource Type	Count	Total Size	Percentage
RT_MANIFEST	1	560 bytes	100%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The KLC.exe File Analysis