Gridinsoft Logo
File Icon

KMSAuto x64.exe Trojan Gen Analysis

Updated 1 year ago
Checked by Malware Check
KMSAuto x64.exe

Technical Analysis

File Name KMSAuto x64.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.174.174
Database Version 2024-05-04 08:00:22 UTC
⚠

Trojan.Win64.Gen.cl

Malware family: Gen

This is a generic detection identifier for files exhibiting Trojan horse characteristics. It indicates malware that disguises itself as legitimate software while containing malicious code designed to compromise system security or steal information.
N/A
Detection Rate
27,184,668
File Size (bytes)
2024-05-04
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
f8da43d9c6ee8a711db8975fff83a9c1
SHA1
f03f474f08e043200448cc89bb1375806349346d
SHA256
b0adbe005bd0fa86a32f745282f8a091f87210a9947dc78abfb7e67af6ed906c
SHA512
41f0a7b35bd06fccdb1365c0f599ace9fc0ed34a87e81aed9504cfe6e52f0a27d3c615c35695df1fb9fe444880d83ec56a5d24456e2f05daf2689c144ef8ede4
ImpHash
22e7125b95acf497b07e79559bdc556c

PE Analysis

Basic Information

▼
Icon
Hash: 7c527cd9cf664d4d93d62961b2149521
Fuzzy: d4bce5b2f880ce8ff726b9b396e3dd70
dHash: b369f1b1619132c0
Image Base 0x140000000
Entry Point 0x1400242ac
Compilation Time 2016-04-02 22:16:33
Checksum 0x019f416f (Actual: 0x019f416f)
OS Version 4.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 9 libraries
COMCTL32, SHELL32, GDI32, ADVAPI32, USER32, ole32, OLEAUT32, KERNEL32, msvcrt
Exports 0 functions
Resources 12 Resources
Sections 5 Sections

Version Information

▼
FileVersion 1.7.8.0
ProductVersion 1.7.8.0
Created 7z SFX Constructor v4.6.0.0 (http://usbtor.ru/viewtopic.php?t=798)
Builder alter444 12:43:07 14/01/2024
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00001000 146,508 bytes 146,944 bytes 6.43 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 09B6164115717E1DB8799A0CDA0F5895
.rdata 0x00025000 27,578 bytes 27,648 bytes 5.30 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 07D7B0DD22EEBD3822ED662585A7ED2E
.data 0x0002c000 21,168 bytes 3,072 bytes 2.88 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE A3548B58E737FA658E0B1C1071CE4536
.pdata 0x00032000 8,352 bytes 8,704 bytes 5.15 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ CDAAE7A693E638F660BF273F16BC0CF8
.rsrc 0x00035000 45,660 bytes 46,080 bytes 4.50 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ C531D7C1E3FB9E7C894074700CFF2C59

Resource Analysis

▼
Total Resources: 12 (44,971 bytes)
Resource Type Count Total Size Percentage
RT_ICON 9 43,496 bytes
96.7%
RT_GROUP_ICON 1 132 bytes
0.3%
RT_VERSION 1 564 bytes
1.3%
RT_MANIFEST 1 779 bytes
1.7%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Trojan.Win64.Gen.cl Removal

Gridinsoft has the capability to identify and eliminate Trojan.Win64.Gen.cl without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware