Gridinsoft Logo
File Icon

The kmyHook.exe (DotNetDetour) File Analysis

Updated 2 months ago
Checked by Malaware Check
kmyHook.exe

Technical Analysis

File Name kmyHook.exe
File Type
Win32 EXE
Magic Bytes PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
SSDEEP Hash
6144:4Rqh89zbCWwtOVtWwyidmTJiCAOI8jn48uXskDX1LGhmU7DeEV:PsbCWwBn9MskDXAMkD5
Scanner Version 1.0.210.174
Database Version 2025-03-15 07:01:09 UTC
⚠

Suspicious File Detected

Detected by 29 security engines - requires caution

This file requires additional checking for potential threats. Based on suspicious indicators, we will soon add it to our virus database.
40%
Detection Rate
353,488
File Size (bytes)
29/73
Engines Detected
2025-03-15
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
6beaac58443606857f12ec6bc32e503a
SHA1
b889a888efa106ccd5c0e0ea750395cb1b47f90f
SHA256
cbad81d9eb150241277ae37201f9be2733057b81738d2d157e2763f3e0b1b6f1
SHA512
2f9c286cd47ca52d70caacff21531194669a9bd80b7479ffa6bf6cd49cbd66a1bb3473c4b2b75bb9ae602c5f96d6e74da269483831a24d10e0c037959cb92efc
ImpHash
f34d5f2d4577ed6d9ceec516c1f5a744

Security Engines with Detections (29 of 73)

Lionic
Trojan.Win32.Generic.4!c Malicious
MicroWorld-eScan
Trojan.GenericKD.76000060 Malicious
CTX
exe.trojan.yomal Malicious
CAT-QuickHeal
Trojan.Ghanarava.17418509662e503a Malicious
ALYac
Trojan.GenericKD.76000060 Malicious
Cylance
Unsafe Malicious
K7GW
Riskware ( 00584baa1 ) Malicious
K7AntiVirus
Riskware ( 00584baa1 ) Malicious
Symantec
Trojan.Gen.MBT Malicious
GData
Win32.Trojan.Agent.T1QL6B Malicious
BitDefender
Trojan.GenericKD.76000060 Malicious
Avast
MalwareX-gen [Trj] Malicious
Sophos
Mal/Generic-S Malicious
VIPRE
Trojan.GenericKD.76000060 Malicious
McAfeeD
ti!CBAD81D9EB15 Malicious
Emsisoft
Trojan.GenericKD.76000060 (B) Malicious
Ikarus
Trojan.Win32.VMProtect Malicious
FireEye
Trojan.GenericKD.76000060 Malicious
Webroot
W32.Malware.gen Malicious
Google
Detected Malicious
Varist
W32/ABTrojan.ZCKB-7565 Malicious
Kingsoft
Win32.Troj.yomal.v Malicious
Arcabit
Trojan.Generic.D487AB3C Malicious
Microsoft
Trojan:Win32/Yomal!rfn Malicious
McAfee
Artemis!6BEAAC584436 Malicious
Panda
Trj/Chgt.AD Malicious
Fortinet
W32/Wacapew.C!tr Malicious
AVG
MalwareX-gen [Trj] Malicious
DeepInstinct
MALICIOUS Malicious
44 engines reported no threats - Only engines with detections are shown above for clarity

PE Analysis

Basic Information

▼
Icon
Hash: e6489ef819b55ce2751b98ae1c9482e7
Fuzzy: 81da930f6fb90ff10d72a7f10cd4c269
dHash: 8eb2e8d4b6c8f0f0
Image Base 0x00400000
Entry Point 0x004538b2
Compilation Time 2055-09-28 13:01:26
Checksum 0x0005c6d3 (Actual: 0x0005c6d3)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
PDB Path C:\Users\Cirno\Documents\rpgProjs\loaders\kmyHook\obj\Release\kmyHook.pdb
Digital Signature OK
Imports 1 libraries
mscoree
Exports 0 functions
Resources 3 Resources
Sections 3 Sections

Version Information

▼
Translation 0x0000 0x04b0
Comments
CompanyName
FileDescription DotNetDetour
FileVersion 1.0.0.0
InternalName kmyHook.exe
LegalCopyright Copyright © 2015
LegalTrademarks
OriginalFilename kmyHook.exe
ProductName DotNetDetour
ProductVersion 1.0.0.0
Assembly Version 1.0.0.0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.text 0x00002000 334,864 bytes 335,360 bytes 6.01 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 4F8CDD91ABF966B0223EE7A4D1B475DF
.rsrc 0x00054000 5,324 bytes 5,632 bytes 5.82 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 521B27D37B46076F2C803AAC5CADB900
.reloc 0x00056000 12 bytes 512 bytes 0.10 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_DISCARDABLE|IMAGE_SCN_MEM_READ 6576F000F8E2B3AD815EE99215A2F17E

Resource Analysis

▼
Total Resources: 3 (5,088 bytes)
Resource Type Count Total Size Percentage
RT_ICON 1 4,264 bytes
83.8%
RT_GROUP_ICON 1 20 bytes
0.4%
RT_VERSION 1 804 bytes
15.8%

Certificate Chain Analysis

▼
Certificate Information
Product DotNetDetour
Description DotNetDetour
File Version 1.0.0.0
Original Name kmyHook.exe
Signing Date 04:29 AM 03/08/2025 (90 days ago)
Verification Status Signed
Signers 刘沛轩; Sectigo Public Code Signing CA R36; Sectigo Public Code Signing Root R46; Sectigo (AAA)
Counter Signers DigiCert Timestamp 2024; DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA; DigiCert Trusted Root G4; DigiCert
Internal Name kmyHook.exe
Copyright Copyright © 2015
Certificate Chain Summary
Sectigo Public Code Signing Root R46 #1 Primary
Validity Period: 2021-05-25 00:00:00 → 2028-12-31 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 48 FC 93 B4 60 55 94 8D 36 A7 C9 8A 89 D6 94 16
Sectigo Public Code Signing CA R36 #2 Chain
Validity Period: 2021-03-22 00:00:00 → 2036-03-21 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 62 1D 6D 0C 52 01 9E 3B 90 79 15 20 89 21 1C 0A
刘沛轩 #3 Chain
Validity Period: 2022-04-07 00:00:00 → 2025-04-06 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 91 18 48 44 28 A4 40 16 60 91 F7 13 DE AA 62 DB
DigiCert Timestamp 2024 #4 Chain
Validity Period: 2024-09-26 00:00:00 → 2035-11-25 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 0B AE 66 BC 5A BA 7F 95 87 C6 F9 E9 04 E3 33 04
DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA #5 Chain
Validity Period: 2022-03-23 00:00:00 → 2037-03-22 23:59:59
Signature Algorithm: sha256RSA
Serial Number: 07 36 37 B7 24 54 7C D8 47 AC FD 28 66 2A 5E 5B
DigiCert Trusted Root G4 #6 Chain
Validity Period: 2022-08-01 00:00:00 → 2031-11-09 23:59:59
Signature Algorithm: sha384RSA
Serial Number: 0E 9B 18 8E F9 D0 2D E7 EF DB 50 E2 08 40 18 5A

✓ This file has been digitally signed and the certificate chain has been verified

  • The signature ensures file integrity and authenticity from the publisher
  • Timestamping proves when the signature was applied
Certificate Verification Status

OK

Remember: This is Result of Online Virus Scanner

Gridinsoft Anti-Malware has a much more powerful virus scanning engine. We recommend using it for a more precise diagnosis of infected systems. This brief guide will help you install our flagship product for more accurate diagnostics:

Download Anti-Malware

Keep Your System Protected

This file appears clean, but regular security maintenance is important

  1. Regular Scans: Run weekly system scans to detect new threats before they can cause damage.
  2. Keep Software Updated: Ensure your operating system and all applications have the latest security patches.
  3. Safe Browsing: Avoid suspicious websites and never download software from untrusted sources.
  4. Email Security: Be cautious with email attachments and links, even from known contacts.
Proactive Protection
29 antivirus engines detected potential threats. This could be a false positive, especially for system tools or packed software. Verify the file source and check if it's digitally signed by a trusted publisher.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware