Gridinsoft Logo
File Icon

OInstall.exe Hack AutoKMS Analysis

Updated 1 month ago
Checked by Malaware Check
OInstall.exe

Technical Analysis

File Name OInstall.exe
File Type
PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version 1.0.213.174
Database Version 2025-04-11 04:00:33 UTC
⚠

Hack.Win32.AutoKMS.sa

Malware family: AutoKMS

AutoKMS is a tool associated with illegal Microsoft software activation that bypasses legitimate licensing processes. It introduces security risks and potential legal consequences.
N/A
Detection Rate
17,655,296
File Size (bytes)
2025-04-11
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
c1cb9faebab25bbdee47989ed6d12b66
SHA1
9e270f9b0b608f8d0f6accc8850d85fb29101543
SHA256
f4b9cac47895ae95567cb390ed5aad24c9d08f4ebb5c06fd4a4a12291802ba54
SHA512
063041458669b1103b1eaf72b90b1f80302b69918cfcc37e2d530190685da7bb05989d484ac8635d23006b7ee991557588d23e65efeca440b6b456c7941e6800
ImpHash
d5ed9b64c3705aa7067197f0b9f72cdc

PE Analysis

Basic Information

▼
Icon
Hash: cf8b3d44cc80ac3d3f5b2c3f6848133a
Fuzzy: 71fcd2e860bbcd562ce257f969072383
dHash: e0c8ccc6c6c6c0e0
Image Base 0x00400000
Entry Point 0x00456a80
Compilation Time 2024-11-23 07:48:15
Checksum 0x010ddbec (Actual: 0x010ddbec)
OS Version 4.0
PEiD Signatures PE32 executable (GUI) Intel 80386, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 12 libraries
Exports 0 functions
Resources 7 Resources
Sections 9 Sections

Version Information

▼
ProductName Office 2013-2024 C2R Install
FileDescription Office 2013-2024 C2R Install
Translation 0x0000 0x04b0

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.code 0x00001000 346,359 bytes 346,624 bytes 6.15 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 371280F1E3A8AC975D8E8697EDEE8B3A
.text 0x00056000 1,393,187 bytes 1,393,664 bytes 6.68 (Compressed) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 119053599850186B2210E370EFD9060B
'.text' 0x001ab000 21 bytes 512 bytes 0.36 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ AEC4484D7C8AABC2F1D66D45D3E6AAF2
.rdata 0x001ac000 254,196 bytes 254,464 bytes 5.90 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 7220AE5FB916DBA2D9497072876A02A2
.gfids 0x001eb000 492 bytes 512 bytes 2.77 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3A0D0BD6932FEF545BB6E9B378FB3ECA
.00cfg 0x001ec000 8 bytes 512 bytes 0.06 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 47588083E7AC7178FE95023B9461F53B
.data 0x001ed000 16,076,880 bytes 15,569,920 bytes 7.04 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE 1079AB5EB5DD2A3E3E7E9734BF952408
.rsrc 0x01143000 87,752 bytes 88,064 bytes 2.17 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ AB6F71F1FD0E02F6235D6B1A7DCF4B12
.modplug 0x01159000 20,480 bytes 0 bytes 0.00 (Normal) IMAGE_SCN_CNT_UNINITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE D41D8CD98F00B204E9800998ECF8427E
Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 7 (87,299 bytes)
Resource Type Count Total Size Percentage
RT_ICON 4 82,656 bytes
94.7%
RT_GROUP_ICON 1 62 bytes
0.1%
RT_VERSION 1 412 bytes
0.5%
RT_MANIFEST 1 4,169 bytes
4.8%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Hack.Win32.AutoKMS.sa Removal

Gridinsoft has the capability to identify and eliminate Hack.Win32.AutoKMS.sa without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

* Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.
Your Score for

Gridinsoft Anti-Malware

Cure your PC from any kind of malware

GridinSoft Anti-Malware will help you to protect your computer from spyware, trojans, backdoors, rootkits. It cleans your system from annoying advertisement modules and other malicious stuff developed by hackers.

Anti-Malware Download Now
Gridinsoft Anti-Malware