The K Lite Codec Pack 1890 Standard exe (K Lite Codec Pack Setup) KLCP File Malware Analysis

The K-Lite_Codec_Pack_1890_Standard.exe (K-Lite Codec Pack Setup) File Analysis

Updated 7 months ago

Checked by Malware Check

K-Lite_Codec_Pack_1890_Standard.exe

Hash Type	Value	Action
MD5	f5b27434073f6864861a37a4d1741db3
SHA1	330ce84993c66db1fe3261189983b74da08e849a
SHA256	aaf9fb7d368872fd41fee9d60cc76f3db1b146ffd382037e2179ec8ea6c7d62f
SHA512	17e5b8d3e2737fc0eefbb11bd7afdd8a3c54611671ee92db715a0d03c5fbc3c75fdda3b83209e37e66c9759ba69e7a0d0787c07c6fa30e120ed1ed271f2d98e2
ImpHash	d49abfb90f0d15b695e11db93279f37d

Hash Type

Value

Action

MD5

f5b27434073f6864861a37a4d1741db3

SHA1

330ce84993c66db1fe3261189983b74da08e849a

SHA256

aaf9fb7d368872fd41fee9d60cc76f3db1b146ffd382037e2179ec8ea6c7d62f

SHA512

17e5b8d3e2737fc0eefbb11bd7afdd8a3c54611671ee92db715a0d03c5fbc3c75fdda3b83209e37e66c9759ba69e7a0d0787c07c6fa30e120ed1ed271f2d98e2

ImpHash

d49abfb90f0d15b695e11db93279f37d

PE Analysis

Basic Information

▼

Icon	Hash: 34727259dc02708ebedd407f16f3aebc Fuzzy: cf33a6215df9936c3e27223ff2ba263b dHash: 80a8abe8ead2d87c
Image Base	`0x00400000`
Entry Point	`0x0043e9d8`
Compilation Time	2025-04-17 18:50:32
Checksum	0x00000000 (Actual: 0x0253d097)
OS Version	6.1
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	7 libraries kernel32, comctl32, version, user32, oleaut32, netapi32, advapi32
Exports	3 functions
Resources	24 Resources
Sections	11 Sections

Version Information

▼

Comments	This installation was built with Inno Setup.
CompanyName	KLCP
FileDescription	K-Lite Codec Pack Setup
FileVersion	18.9.0.0
LegalCopyright
OriginalFileName
ProductName	K-Lite Codec Pack
ProductVersion	18.9.0
Translation	0x0000 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	247,400 bytes	247,808 bytes	6.48 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`13D278F0A835A4ECE87274444DDD8510`
`.itext`	`0x0003e000`	4,464 bytes	4,608 bytes	6.10 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`9FF7E27DF2D60D9C5E6DE59018BB38DF`
`.data`	`0x00040000`	10,368 bytes	10,752 bytes	3.99 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`37D5EF507D2757D0E6BCD4679B08FAA8`
`.bss`	`0x00043000`	28,084 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0004a000`	3,930 bytes	4,096 bytes	4.96 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F83D9985D9F14C685270F4231E75F7F0`
`.didata`	`0x0004b000`	420 bytes	512 bytes	2.75 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`BC57C8B795B84E4E2A2E22E3EC1767E7`
`.edata`	`0x0004c000`	154 bytes	512 bytes	1.87 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`9B82C949D7CD129D1413894CFF4485CA`
`.tls`	`0x0004d000`	20 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x0004e000`	93 bytes	512 bytes	1.37 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`EC8F4F0208BF69309F101B45E9BCFA9F`
`.reloc`	`0x0004f000`	23,592 bytes	24,064 bytes	6.51 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`83667E7B32BC9F16857148ADA540FD18`
`.rsrc`	`0x00055000`	152,532 bytes	152,576 bytes	4.65 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`124DB7A1D1D10CE1C1D9844E581FB09C`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 24 (151,162 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	10	142,288 bytes	94.1%
RT_STRING	8	4,484 bytes	3%
RT_RCDATA	3	872 bytes	0.6%
RT_GROUP_ICON	1	146 bytes	0.1%
RT_VERSION	1	1,412 bytes	0.9%
RT_MANIFEST	1	1,960 bytes	1.3%

Certificate Chain Analysis

▼

Certificate Information

Product	K-Lite Codec Pack
Description	K-Lite Codec Pack Setup
File Version	18.9.0.0

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	K-Lite_Codec_Pack_1890_Standard.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.216.174
Database Version	2025-05-16 15:00:24 UTC

The K-Lite_Codec_Pack_1890_Standard.exe (K-Lite Codec Pack Setup) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification