Architecture |
IMAGE_FILE_MACHINE_I386
|
---|---|
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
Compilation Date | 1992-Jun-19 22:22:17 |
Detected languages |
English - United States
|
Comments | This installation was built with Inno Setup. |
CompanyName | |
FileDescription | KMSpico Setup |
FileVersion | 10.0.4 |
LegalCopyright | ByELDI |
ProductName | KMSpico |
ProductVersion | 10.0.4 |
Malicious | The PE contains functions mostly used by malware. |
[!] The program may be hiding some of its imports:
|
Info | The PE is digitally signed. |
Signer: \x00@\x00B\x00y\x00E\x00L\x00D\x00I
Issuer: \x00@\x00B\x00y\x00E\x00L\x00D\x00I\x00 \x00C\x00e\x00r\x00t\x00i\x00f\x00i\x00c\x00a\x00t\x00e\x00 \x00A\x00u\x00t\x00h\x00o\x00r\x00i\x00t\x00y |
Malicious | VirusTotal score: 46/71 (Scanned on 2020-01-07 22:22:03) |
Bkav:
W32.HfsAdware.216A
MicroWorld-eScan: Application.Hacktool.AGR McAfee: Crack-KMS Sangfor: Malware Alibaba: HackTool:Win32/AutoKMS.964035eb K7GW: Unwanted-Program ( 004d38111 ) K7AntiVirus: Unwanted-Program ( 004d38111 ) TrendMicro: HKTL_AUTOKMS Cyren: W32/S-eb8730b5!Eldorado Symantec: PUA.Keygen.KMS!g3 ESET-NOD32: a variant of MSIL/HackTool.IdleKMS.C potentially unsafe ClamAV: Win.Malware.Agent-6417223-0 Kaspersky: not-a-virus:NetTool.Win64.RPCHook.a BitDefender: Application.Hacktool.AGR NANO-Antivirus: Trojan.Win32.IdleKMS.dmgkwf Rising: PUF.HackKMS!1.AA7B (TFE:C:hqpsE8bNVGV) Ad-Aware: Application.Hacktool.AGR Sophos: KMS Activator (PUA) Comodo: Malware@#oerpsnk3ir9l DrWeb: Trojan.Moneyinst.709 VIPRE: Trojan.Win32.Generic!BT Invincea: heuristic McAfee-GW-Edition: Crack-KMS MaxSecure: Trojan.Malware.8763703.susgen FireEye: Application.Hacktool.AGR Emsisoft: Application.HackTool (A) F-Prot: W32/S-eb8730b5!Eldorado Jiangmin: HackTool.MSIL.dgy Webroot: W32.Hacktool.Kms Microsoft: PUA:Win32/AutoKMS Endgame: malicious (high confidence) Arcabit: Application.Hacktool.AGR AegisLab: Riskware.Win64.RPCHook.1!c ZoneAlarm: not-a-virus:NetTool.Win64.RPCHook.a GData: BAT.Application.Agent.TPLV1J AhnLab-V3: HackTool/Win32.Crack.C509549 VBA32: Trojan.Moneyinst MAX: malware (ai score=100) Cylance: Unsafe TrendMicro-HouseCall: HKTL_AUTOKMS Yandex: Riskware.NetTool! Ikarus: HackTool.Win32.AutoKMS eGambit: Unsafe.AI_Score_93% Fortinet: Riskware/RPCHook BitDefenderTheta: Gen:NN.ZemsilF.33558.cn1@a0vxRcm AVG: FileRepMetagen [PUP] |
e_magic | MZ |
---|---|
e_cblp | 0x50 |
e_cp | 0x2 |
e_crlc | 0 |
e_cparhdr | 0x4 |
e_minalloc | 0xf |
e_maxalloc | 0xffff |
e_ss | 0 |
e_sp | 0xb8 |
e_csum | 0 |
e_ip | 0 |
e_cs | 0 |
e_ovno | 0x1a |
e_oemid | 0 |
e_oeminfo | 0 |
e_lfanew | 0x100 |
Signature | PE |
---|---|
Machine |
IMAGE_FILE_MACHINE_I386
|
NumberofSections | 8 |
TimeDateStamp | 1992-Jun-19 22:22:17 |
PointerToSymbolTable | 0 |
NumberOfSymbols | 0 |
SizeOfOptionalHeader | 0xe0 |
Characteristics |
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_RELOCS_STRIPPED
|
Magic | PE32 |
---|---|
LinkerVersion | 2.0 |
SizeOfCode | 0x9e00 |
SizeOfInitializedData | 0x6c00 |
SizeOfUninitializedData | 0 |
AddressOfEntryPoint | 0x0000A5F8 (Section: CODE) |
BaseOfCode | 0x1000 |
BaseOfData | 0xb000 |
ImageBase | 0x400000 |
SectionAlignment | 0x1000 |
FileAlignment | 0x200 |
OperatingSystemVersion | 1.0 |
ImageVersion | 6.0 |
SubsystemVersion | 4.0 |
Win32VersionValue | 0 |
SizeOfImage | 0x17000 |
SizeOfHeaders | 0x400 |
Checksum | 0x2d5e59 |
Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
SizeofStackReserve | 0x100000 |
SizeofStackCommit | 0x4000 |
SizeofHeapReserve | 0x100000 |
SizeofHeapCommit | 0x1000 |
LoaderFlags | 0 |
NumberOfRvaAndSizes | 16 |
kernel32.dll |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc WideCharToMultiByte TlsSetValue TlsGetValue MultiByteToWideChar GetModuleHandleA GetLastError GetCommandLineA WriteFile SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetSystemTime GetFileType ExitProcess CreateFileA CloseHandle |
---|---|
user32.dll |
MessageBoxA
|
oleaut32.dll |
VariantChangeTypeEx
VariantCopyInd VariantClear SysStringLen SysAllocStringLen |
advapi32.dll |
RegQueryValueExA
RegOpenKeyExA RegCloseKey OpenProcessToken LookupPrivilegeValueA |
kernel32.dll (#2) |
DeleteCriticalSection
LeaveCriticalSection EnterCriticalSection InitializeCriticalSection VirtualFree VirtualAlloc LocalFree LocalAlloc WideCharToMultiByte TlsSetValue TlsGetValue MultiByteToWideChar GetModuleHandleA GetLastError GetCommandLineA WriteFile SetFilePointer SetEndOfFile RtlUnwind ReadFile RaiseException GetStdHandle GetFileSize GetSystemTime GetFileType ExitProcess CreateFileA CloseHandle |
user32.dll (#2) |
MessageBoxA
|
comctl32.dll |
InitCommonControls
|
advapi32.dll (#2) |
RegQueryValueExA
RegOpenKeyExA RegCloseKey OpenProcessToken LookupPrivilegeValueA |
'%s' is not a valid integer value |
'%s' is not a valid floating point value |
'%s' is not a valid date |
'%s' is not a valid time |
'%s' is not a valid date and time |
Invalid argument to time encode |
Invalid argument to date encode |
Out of memory |
I/O error %d |
File not found |
Invalid filename |
Too many open files |
File access denied |
Read beyond end of file |
Disk full |
Invalid numeric input |
Division by zero |
Range check error |
Integer overflow |
Invalid floating point operation |
Floating point division by zero |
Floating point overflow |
Floating point underflow |
Invalid pointer operation |
Invalid class typecast |
Access violation at address %p. %s of address %p |
Stack overflow |
Control-C hit |
Privileged instruction |
Operation aborted |
Exception %s in module %s at %p. |
%s%s |
Application Error |
Format '%s' invalid or incompatible with argument |
No argument for format '%s' |
Invalid variant type conversion |
Invalid variant operation |
Variant method calls not supported |
Read |
Write |
Format result longer than 4096 characters |
Format string too long |
Error creating variant array |
Variant is not an array |
Variant array index out of bounds |
External exception %x |
Jan |
Feb |
Mar |
Apr |
May |
Jun |
Jul |
Aug |
Sep |
Oct |
Nov |
Dec |
January |
February |
March |
April |
May |
June |
July |
August |
September |
October |
November |
December |
Sun |
Mon |
Tue |
Wed |
Thu |
Fri |
Sat |
Sunday |
Monday |
Tuesday |
Wednesday |
Thursday |
Friday |
Saturday |
Signature | 0xfeef04bd |
---|---|
StructVersion | 0x10000 |
FileVersion | 10.0.4.0 |
ProductVersion | 10.0.4.0 |
FileFlags | (EMPTY) |
FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
FileType |
VFT_APP
|
Language | UNKNOWN |
Comments | This installation was built with Inno Setup. |
CompanyName | |
FileDescription | KMSpico Setup |
FileVersion (#2) | 10.0.4 |
LegalCopyright | ByELDI |
ProductName | KMSpico |
ProductVersion (#2) | 10.0.4 |
Resource LangID | English - United States |
---|
StartAddressOfRawData | 0x40e000 |
---|---|
EndAddressOfRawData | 0x40e008 |
AddressOfIndex | 0x40c3d0 |
AddressOfCallbacks | 0x40f010 |
SizeOfZeroFill | 0 |
Characteristics |
IMAGE_SCN_TYPE_REG
|
Callbacks | (EMPTY) |