The KZMM EXE File Malware Analysis

Technical Analysis

File Name	KZMM.EXE
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.217.174
Database Version	2025-05-27 20:00:15 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	3264a7c13394482bffe41a5bd4a84654
SHA1	b93db4ec8583796072a931199ca8d95452ea033a
SHA256	8edcf8097eda4dadcf73cdca0a05a95bce6bd01bd5d29a39dd110af8b321adb4
SHA512	5e26d2810d2d3116707bdf73527cf5f908b90e6ae14a43395eeeea066b98fe393698cac9178c3493865535c20e8d51857ef6ffa222fd3df7b925fc172bc96742
ImpHash	eb2759d1491d1769c3c6ecc4d35648ac

PE Analysis

Basic Information

▼

Icon	Hash: be70f492191ad3aa5e6f0b439bbbed6e Fuzzy: adc951d96ae859968fa717f0293d738a dHash: 6024c4c4f4f4f1b0
Image Base	`0x00400000`
Entry Point	`0x00466b0c`
Compilation Time	1992-06-19 22:22:17
Checksum	0x00000000 (Actual: 0x001245f6)
OS Version	1.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	7 libraries kernel32, user32, advapi32, oleaut32, gdi32, ole32, comctl32
Exports	0 functions
Resources	59 Resources
Sections	8 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`CODE`	`0x00001000`	416,872 bytes	417,280 bytes	6.54 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`7CE1193656D7429F64ED61591519630E`
`DATA`	`0x00067000`	6,112 bytes	6,144 bytes	4.80 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`8D32D05CC84532D1CEA28AF829BF5419`
`BSS`	`0x00069000`	2,265 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0006a000`	8,084 bytes	8,192 bytes	5.01 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7940806835E99CFFDBF1C58D51ED9CF6`
`.tls`	`0x0006c000`	16 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x0006d000`	24 bytes	512 bytes	0.20 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`821B2862E0DA3613124FC0DBA9C8981C`
`.reloc`	`0x0006e000`	27,244 bytes	27,648 bytes	6.62 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`9F278A846E77C851B9CE2A569AD6AA26`
`.rsrc`	`0x00075000`	688,640 bytes	688,640 bytes	7.81 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`1E4E4F4E12C919F3387A996BC30CEE82`

Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 59 (684,910 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	7	2,156 bytes	0.3%
RT_BITMAP	12	4,964 bytes	0.7%
RT_ICON	1	744 bytes	0.1%
RT_STRING	13	9,652 bytes	1.4%
RT_RCDATA	18	667,234 bytes	97.4%
RT_GROUP_CURSOR	7	140 bytes	0%
RT_GROUP_ICON	1	20 bytes	0%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The KZMM.EXE File Analysis