Gridinsoft Logo
File Icon

The KMSTools Lite.exe File Analysis

Updated 1 year ago
Checked by Malware Check
KMSTools Lite.exe

Technical Analysis

File Name KMSTools Lite.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386, for MS Windows
SSDEEP Hash
393216:okQeWIB6YcXX4BHSczO9X+hPjAPdHPNGmHCAkB/L4uTn/KolvzHb:o3K6YZy3WsPdHlMAi4uT/KU
Scanner Version 1.0.178.174
Database Version 2024-06-07 21:00:48 UTC
⚠

Suspicious File Detected

Detected by 31 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
42%
Detection Rate
21,145,088
File Size (bytes)
31/73
Engines Detected
2024-06-07
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
3f197f581fb5ccf132b755e901f14bc4
SHA1
4b1c93db087f9c3a3e7fea68092249cf1d8a02a2
SHA256
bc1915790f5e64cf2a814370afa8ea37e32d3417d818783620cbcd7d67a62b47
SHA512
da4eac8c78dcea1fd237f40fb13bf86ca229f4861bd09514f16e40e75a9c223c13663d48b0ddf7bee6dd7be891b37670efa46507d167c43f8fb4cb5bca4e776b
ImpHash
04ee027b004efb3ea882ad3295c21d97

Security Engines with Detections (31 of 73)

Bkav
W32.AIDetectMalware Malicious
Lionic
Trojan.Win32.HackKMS.4!c Malicious
AVG
Win32:Malware-gen Malicious
Elastic
malicious (high confidence) Malicious
CAT-QuickHeal
Trojan.AutoKMS Malicious
Cylance
unsafe Malicious
Sangfor
Trojan.Win32.HackKMS.Vk8a Malicious
K7AntiVirus
Unwanted-Program ( 005b06b01 ) Malicious
K7GW
Unwanted-Program ( 005b06b01 ) Malicious
Symantec
ML.Attribute.HighConfidence Malicious
tehtris
Generic.Malware Malicious
ESET-NOD32
a variant of Win32/HackKMS.CI potentially unsafe Malicious
APEX
Malicious Malicious
Paloalto
generic.ml Malicious
Avast
Win32:Malware-gen Malicious
FireEye
Generic.mg.3f197f581fb5ccf1 Malicious
Sophos
Generic Reputation PUA (PUA) Malicious
SentinelOne
Static AI - Malicious PE Malicious
Webroot
W32.Hacktool.Kms Malicious
Varist
W32/ABApplication.XSSO-3153 Malicious
Antiy-AVL
RiskWare/Win32.HackKMS Malicious
Xcitium
ApplicUnwnt@#k4zdwivw10nn Malicious
Microsoft
HackTool:Win32/AutoKMS Malicious
GData
Win32.Trojan.Agent.H0PGBM Malicious
Google
Detected Malicious
Malwarebytes
RiskWare.AutoKMS Malicious
Rising
PUF.HackKMS!8.185 (TFE:5:wM6XM73tlXE) Malicious
Yandex
Trojan.Igent.b2cmHJ.1 Malicious
Fortinet
Riskware/HackKMS Malicious
DeepInstinct
MALICIOUS Malicious
alibabacloud
Trojan:Win/HackKMS.d53a7218 Malicious
42 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: 94411a7ac6c8b4bf932b5dac2210f721
Fuzzy: 73da8a07a83dd014e1f1a85021f0cd92
dHash: b848c8f8b8d87426
Image Base 0x00400000
Entry Point 0x00412107
Compilation Time 2024-04-13 06:26:25
Checksum 0x01433502 (Actual: 0x01433502)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature The PE file does not contain a certificate table.
Imports 21 libraries
Exports 0 functions
Resources 9 Resources
Sections 7 Sections

Version Information

▼
CompanyName Ratiborus
ProductName KMS Tools Portable x86
LegalCopyright Ratiborus
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.code 0x00001000 64,247 bytes 64,512 bytes 5.96 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ D9F2D98EE66627D6FBC37D31691B0292
.text 0x00011000 1,093,050 bytes 1,093,120 bytes 6.69 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 1EBD67ADFEC1C5BCAD91EB314047EB51
.rdata 0x0011c000 203,708 bytes 203,776 bytes 5.91 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 1B4E66E2618C4C591630FFECD99B49A3
.gfids 0x0014e000 448 bytes 512 bytes 2.59 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9C306B3E75065207BE966FD258926F11
.00cfg 0x0014f000 8 bytes 512 bytes 0.06 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ FDD661400E683EDC0698F3C405183FDC
.data 0x00150000 19,682,708 bytes 19,670,528 bytes 7.94 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 4A6F540CE9D1FBF7320437CEADFD2289
.rsrc 0x01416000 110,724 bytes 111,104 bytes 7.72 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3BEBC986A5D4A7EF1F01517D587D0864
Entropy Analysis Alert

2 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 9 (110,169 bytes)
Resource Type Count Total Size Percentage
RT_ICON 6 105,502 bytes
95.8%
RT_GROUP_ICON 1 90 bytes
0.1%
RT_VERSION 1 408 bytes
0.4%
RT_MANIFEST 1 4,169 bytes
3.8%

Certificate Chain Analysis

▼
Certificate Information
Product KMS Tools Portable x86
Copyright Ratiborus
Certificate Chain Summary
Nir Sofer #1 Primary
Validity Period: 2019-09-09 00:00:00 → 2023-09-09 23:59:59
Signature Algorithm: sha256RSA
Serial Number: F7 A0 A7 30 C8 7D 94 CD 83 02 E3 EA 7F 66 1B B7
Sectigo RSA Code Signing CA #2 Chain
Validity Period: 2018-11-02 00:00:00 → 2030-12-31 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 1D A2 48 30 6F 9B 26 18 D0 82 E0 96 7D 33 D3 6A
Sectigo RSA Time Stamping Signer #2 #3 Chain
Validity Period: 2020-10-23 00:00:00 → 2032-01-22 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 8C 77 A0 00 8F F4 D1 B0 C6 3D 9F 3A 48 83 8D 6B
Sectigo RSA Time Stamping CA #4 Chain
Validity Period: 2019-05-02 00:00:00 → 2038-01-18 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 30 0F 6F AC DD 66 98 74 7C A9 46 36 A7 78 2D B9

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

The PE file does not contain a certificate table.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
31 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware