6ee7f3ecd5111cd5306792fd3141515d
This file seems to be a .NET executable.
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Sadly, Manalyzer's analysis techniques were designed for native code, so it's likely that this report won't tell you much.
Sorry!
Summary
| Architecture |
IMAGE_FILE_MACHINE_I386
|
|---|---|
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| Compilation Date | 2015-Aug-10 07:45:14 |
| Comments | |
| CompanyName | MSFree Inc. |
| FileDescription | KMSAuto Net |
| FileVersion | 1.3.8 |
| InternalName | KMSAuto Net.exe |
| LegalCopyright | |
| LegalTrademarks | |
| OriginalFilename | KMSAuto Net.exe |
| ProductName | KMSAuto Net |
| ProductVersion | 1.3.8 |
| Assembly Version | 1.3.8.0 |
Plugin Output
| Info | Matching compiler(s): |
Microsoft Visual C++ 6.0 - 8.0
Microsoft Visual C# v7.0 / Basic .NET Microsoft Visual C++ 8.0 MASM/TASM - sig2(h) Microsoft Visual C++ Microsoft Visual C++ v6.0 .NET executable -> Microsoft |
| Suspicious | Strings found in the binary may indicate undesirable behavior: |
Contains references to system / monitoring tools:
|
| Info | Cryptographic algorithms detected in the binary: |
Uses constants related to CRC32
Uses constants related to MD5 Uses constants related to SHA1 Uses constants related to SHA256 Uses constants related to AES |
| Info | The PE is digitally signed. |
Signer: Ratiborus MSFree Inc.
Issuer: Ratiborus MSFree Inc. |
| Malicious | VirusTotal score: 39/66 (Scanned on 2018-03-11 13:59:37) |
Bkav:
W32.HfsAdware.6B84
MicroWorld-eScan: Application.Hacktool.KMSAuto.B CAT-QuickHeal: HackTool.AutoKMS.FC.3225 McAfee: Generic HTool.h Cylance: Unsafe K7GW: Unwanted-Program ( 004fa0b21 ) K7AntiVirus: Unwanted-Program ( 004fa0b21 ) Invincea: heuristic Cyren: W32/Trojan.TLVG-1451 Symantec: Trojan.Gen ESET-NOD32: a variant of MSIL/HackKMS.I potentially unsafe TrendMicro-HouseCall: CRCK_KMS ClamAV: Win.Tool.Kmsauto-2 Kaspersky: not-a-virus:RiskTool.Win32.HackKMS.i BitDefender: Application.Hacktool.KMSAuto.B Ad-Aware: Application.Hacktool.KMSAuto.B Sophos: KMS Activator (PUA) Comodo: ApplicUnsaf.Win32.HackTool.AutoKMS F-Secure: Application.Hacktool.KMSAuto VIPRE: Trojan.Win32.Generic!BT TrendMicro: CRCK_KMS McAfee-GW-Edition: Generic HTool.h Emsisoft: Application.HackTool (A) SentinelOne: static engine - malicious Jiangmin: HackTool.KMSAuto.n Webroot: W32.Hacktool.Kms Antiy-AVL: RiskWare[RiskTool]/MSIL.HackKMS Microsoft: HackTool:Win32/AutoKMS Endgame: malicious (high confidence) Arcabit: Application.Hacktool.KMSAuto.B ZoneAlarm: not-a-virus:HEUR:RiskTool.MSIL.HackKMS.gen GData: Application.Hacktool.KMSAuto.B AhnLab-V3: HackTool/Win32.KMSAuto.R209007 AVware: Trojan.Win32.Generic!BT MAX: malware (ai score=98) Yandex: Riskware.HackTool!7QxPaUSMW1c Ikarus: PUA.HackTool.Kmsauto Fortinet: Riskware/KMSAuto Cybereason: malicious.cd5111 |
Hashes
DOS Header
| e_magic | MZ |
|---|---|
| e_cblp | 0x90 |
| e_cp | 0x3 |
| e_crlc | 0 |
| e_cparhdr | 0x4 |
| e_minalloc | 0 |
| e_maxalloc | 0xffff |
| e_ss | 0 |
| e_sp | 0xb8 |
| e_csum | 0 |
| e_ip | 0 |
| e_cs | 0 |
| e_ovno | 0 |
| e_oemid | 0 |
| e_oeminfo | 0 |
| e_lfanew | 0x80 |
PE Header
| Signature | PE |
|---|---|
| Machine |
IMAGE_FILE_MACHINE_I386
|
| NumberofSections | 3 |
| TimeDateStamp | 2015-Aug-10 07:45:14 |
| PointerToSymbolTable | 0 |
| NumberOfSymbols | 0 |
| SizeOfOptionalHeader | 0xe0 |
| Characteristics |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
|
Image Optional Header
| Magic | PE32 |
|---|---|
| LinkerVersion | 80.0 |
| SizeOfCode | 0x69a600 |
| SizeOfInitializedData | 0xc000 |
| SizeOfUninitializedData | 0 |
| AddressOfEntryPoint | 0x0069C4C2 (Section: .text) |
| BaseOfCode | 0x2000 |
| BaseOfData | 0x69e000 |
| ImageBase | 0x400000 |
| SectionAlignment | 0x2000 |
| FileAlignment | 0x200 |
| OperatingSystemVersion | 4.0 |
| ImageVersion | 0.0 |
| SubsystemVersion | 6.0 |
| Win32VersionValue | 0 |
| SizeOfImage | 0x6ac000 |
| SizeOfHeaders | 0x200 |
| Checksum | 0x6ab464 |
| Subsystem |
IMAGE_SUBSYSTEM_WINDOWS_GUI
|
| DllCharacteristics |
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
|
| SizeofStackReserve | 0x100000 |
| SizeofStackCommit | 0x1000 |
| SizeofHeapReserve | 0x100000 |
| SizeofHeapCommit | 0x1000 |
| LoaderFlags | 0 |
| NumberOfRvaAndSizes | 16 |
.text
.rsrc
.reloc
Imports
| mscoree.dll |
_CorExeMain
|
|---|
Delayed Imports
1
2
3
4
5
6
7
8
9
32512
1 (#2)
1 (#3)
Version Info
| Signature | 0xfeef04bd |
|---|---|
| StructVersion | 0x10000 |
| FileVersion | 1.3.8.0 |
| ProductVersion | 1.3.8.0 |
| FileFlags | (EMPTY) |
| FileOs |
VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
|
| FileType |
VFT_APP
|
| Language | UNKNOWN |
| Comments | |
| CompanyName | MSFree Inc. |
| FileDescription | KMSAuto Net |
| FileVersion (#2) | 1.3.8 |
| InternalName | KMSAuto Net.exe |
| LegalCopyright | |
| LegalTrademarks | |
| OriginalFilename | KMSAuto Net.exe |
| ProductName | KMSAuto Net |
| ProductVersion (#2) | 1.3.8 |
| Assembly Version | 1.3.8.0 |
| Resource LangID | UNKNOWN |
|---|