Gridinsoft Logo

The KwExternal.exe File Analysis

Updated 2 months ago
Checked by Malaware Check
KwExternal.exe

Technical Analysis

File Name KwExternal.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows
SSDEEP Hash
24576:2mqf3D70e+oPcbfrWwBkRI5wZJt3zQLQMJCak6nB7XxWZET08p7:Avtul6PnlYCaHXwZETVp7
Scanner Version 1.0.212.174
Database Version 2025-04-05 05:00:48 UTC
⚠

Suspicious File Detected

Detected by 19 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
27%
Detection Rate
1,179,072
File Size (bytes)
19/71
Engines Detected
2025-04-05
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
8a9f1379155425dd083599ff238bf0b0
SHA1
0b2d02da628de1a005ee60c32aae51db9788947d
SHA256
8c8549a44104773048a00aac12c76d4da3a23b0518a6ad1471f96f633ba2e643
SHA512
a3bb19b18710e9dbfeaf4a6f4309d84545a9c99482cba34f633c85561a6df493862b14ea4d1de3a9a48f256fb4f5ab6ba251d3788c3501966f1d4b85d1d2d0f4
ImpHash
efdf0bd375f1e3765d0ae7acf2e50c95

Security Engines with Detections (19 of 71)

Elastic
malicious (high confidence) Malicious
CTX
exe.trojan.kuwo Malicious
Cylance
Unsafe Malicious
Zillya
Trojan.Generic.Win32.457587 Malicious
K7AntiVirus
Adware ( 004faddc1 ) Malicious
K7GW
Adware ( 004faddc1 ) Malicious
CrowdStrike
win/grayware_confidence_100% (W) Malicious
huorong
TrojanSpy/KuwoExt.b Malicious
ESET-NOD32
a variant of Win32/Kuwo.D potentially unwanted Malicious
NANO-Antivirus
Trojan.Win32.Kuwo.fmsnhh Malicious
Sophos
Generic ML PUA (PUA) Malicious
Ikarus
PUA.Kuwo Malicious
Jiangmin
Trojan.Generic.cwhtw Malicious
McAfee
Artemis!8A9F13791554 Malicious
VBA32
BScope.Trojan.Snojan Malicious
Malwarebytes
Generic.Malware.AI.DDS Malicious
Yandex
Trojan.GenAsa!jiZbocYDCbc Malicious
MaxSecure
Trojan.Malware.11743943.susgen Malicious
DeepInstinct
MALICIOUS Malicious
52 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Image Base 0x00400000
Entry Point 0x004a8eac
Compilation Time 2018-11-09 07:56:28
Checksum 0x00128d39 (Actual: 0x00128d39)
OS Version 5.1
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
PDB Path F:\DataRepair\trunk\Bin\Release\DataRepair.pdb
Digital Signature OK
Imports 11 libraries
Exports 0 functions
Resources 1 Resources
Sections 5 Sections

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 863,623 bytes 863,744 bytes 6.73 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ A92F4BFC756C2EB440698DD7061D7ACE
.rdata 0x000d4000 257,838 bytes 258,048 bytes 6.16 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ D06B00A39DC5E9073E7CEC1093E4956D
.data 0x00113000 30,652 bytes 12,288 bytes 4.12 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 13A3041B11AEA3F3DE0A76D907275AD4
.rsrc 0x0011b000 480 bytes 512 bytes 4.72 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 339E64CE0F79B52BC2F600388E76D3A0
.reloc 0x0011c000 36,364 bytes 36,864 bytes 6.66 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 5CFE8EA11562F5D1CC22EFE15AE343DF
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 1 (381 bytes)
Resource Type Count Total Size Percentage
RT_MANIFEST 1 381 bytes
100%

Certificate Chain Analysis

▼
Certificate Information
Signing Date 07:57 AM 11/09/2018 (2402 days ago)
Verification Status Signed
Signers BEIJING KUWO TECHNOLOGY CO.,LTD.; Symantec Class 3 SHA256 Code Signing CA; VeriSign
Counter Signers GlobalSign TSA for Advanced - G2; GlobalSign Timestamping CA - SHA256 - G2; GlobalSign Root CA - R3
Certificate Chain Summary
BEIJING KUWO TECHNOLOGY CO.,LTD. #1 Primary
Validity Period: 2016-12-16 00:00:00 → 2020-02-14 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 06 59 13 BF 67 E5 B8 1F E1 E8 A8 31 67 EE FB FC
Symantec Class 3 SHA256 Code Signing CA #2 Chain
Validity Period: 2013-12-10 00:00:00 → 2023-12-09 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 3D 78 D7 F9 76 49 60 B2 61 7D F4 F0 1E CA 86 2A
GlobalSign TSA for Advanced - G2 #3 Chain
Validity Period: 2018-02-19 00:00:00 → 2029-03-18 10:00:00
Signature Algorithm: sha256RSA
Serial Number: 0C A7 CF 5D 07 07 24 AC 89 E7 9A 3A
GlobalSign Timestamping CA - SHA256 - G2 #4 Chain
Validity Period: 2011-08-02 10:00:00 → 2029-03-29 10:00:00
Signature Algorithm: sha256RSA
Serial Number: 04 00 00 00 00 01 31 89 C6 50 04

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
19 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware