home

kmsnano.exe

KMSnano

This is a self-extracting archive and installer. The file has been seen being downloaded from s5707.chomikuj.pl and multiple other hosts.
Publisher:
KMSnano

Product:
KMSnano

Description:
7z Setup SFX (x86)

Version:
1.5.0.2478

MD5:
c1d306405e800aefb0c7ff68b7c54454

SHA-1:
0f3b69130b0344d3210b6c10bd5395eccb399523

SHA-256:
82f0ea93ce57e0d29c6e421ab3186f46a0917626ce43617160b3b801e5f3c2ea

Scanner detections:
9 / 68

Status:
Inconclusive  (not enough data for an accurate detection)

Analysis date:
12/27/2024 5:34:53 PM UTC  (today)

Scan engine
Detection
Engine version

Baidu Antivirus
Malware.Win32.RiskTool
4.0.3.131224

ESET NOD32
MSIL/HackTool.IdleKMS (variant)
7.9315

IKARUS anti.virus
not-a-virus:Keygen.SuspectCRC
t3scan.2.2.29

Microsoft Security Essentials
HackTool:Win32/Keygen
1.165.247.01

Panda Antivirus
Suspicious file
13.12.24.05

Quick Heal
HackTool.Keygen (Not a Virus)
12.13.12.00

Rising Antivirus
PE:Trojan.Win32.Generic.14956A4E!345336398
23.00.65.14119

VIPRE Antivirus
HackTool.Win32.Keygen
25644

ViRobot
JS.A.Pakes.41308036
2011.4.7.4223

File size:
39.4 MB (41,308,036 bytes)

Product version:
6.0

Original file name:
7ZSfxMod_x86.exe

File type:
Executable application (Win32 EXE)

Language:
Language Neutral

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\kmsnano.exe

File PE Metadata
Compilation timestamp:
5/10/2012 10:34:11 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
786432:EXhPMCiVJ4V3xyT9nurZmNiJoCZI3n2rPWllFxLadI:EXxM4q9FiDZWIullFhaG

Entry address:
0x168CF

Entry point:
55, 8B, EC, 6A, FF, 68, 60, A0, 41, 00, 68, 60, 6A, 41, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, DC, 81, 41, 00, 59, 83, 0D, 24, EB, 41, 00, FF, 83, 0D, 28, EB, 41, 00, FF, FF, 15, E0, 81, 41, 00, 8B, 0D, 04, CB, 41, 00, 89, 08, FF, 15, E4, 81, 41, 00, 8B, 0D, 00, CB, 41, 00, 89, 08, A1, E8, 81, 41, 00, 8B, 00, A3, 20, EB, 41, 00, E8, 1D, 01, 00, 00, 39, 1D, D0, C7, 41, 00, 75, 0C, 68, 58, 6A, 41, 00, FF, 15, EC, 81...
 
[+]

Entropy:
7.9964

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
88.5 KB (90,624 bytes)

The file kmsnano.exe has been seen being distributed by the following 20 URLs.

http://s5707.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoODeOUSaDCfs2ojt3YzF1sMzh4SqsqVHY54m4ay-LOXQFXYjdKKTb00kIcdicTEiyrwjwUYR1T3_9LNdKUeYzTa5upAm84qTF3n1zc9xG643nQ&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOCAegiO8hAajx0QiYIDlURTVasm5Gadrq4zVuZZCfjt-C62wb5LtiXj3VIbRiPOy7mfYxHfPYCGw0Y8Je7U2OeewfqRwkQR9sVPMNvdUKANpQ&pv=2

http://s5707.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOCp7qKG-UGV4U8sFpGOcPwcIcSVKitp2fGvXX78_WYJ4L189D9EszU5vLKblsgg4pl17aP13KRHItp7kIRdgIvFmWR_K45xtGWRZZKnyOMW5A&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOCeL-YOWwtTrlfxOz5y3_Z8e3h7keNrwckf9_an3CeaAKsCSePlkHWn-jFMt0H7YkavO1zP0VkHHNb-VdNRTIHoB47nutMXBRBQuCxJVmPmQQ&pv=2

http://s5707.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOD_U7Hap450QWn5QpLsF9lbxgq423-9prhO2m5SX6uIJybLhwc7kVAVLnSsYkPvblXnfFIIgS8CwJ1l-1_DxUygOXsNJkPtrx_6i7bFt81LCQ&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOCfR5HE6QnlFr0eFLxu-IOsxXMGXUq9kETdKW5olzFZlTr3t1MzG5DBTya_wQ-YvVlqH0-l1fMqFgcVMNKDbI2VUlbmepKgvtLIrMC8M59Leg&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOBuAvBPYOQsrdPjXimN4CaiWRcwU9DSkZJ7SN0eYUpKALVICwtjcOCw9rg7VOIxJef9qnd6pa0ccBZVpAp4fgyoAD1kgWcWVabdxlOSnd480w&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoODhPzOFkeg6DOfkUXUUH7pdSXnvsOvs8Vlqk6QYa3D8N5O58LkfRkG3qm6bPuYGV_zOHmvgsyG-qxtdbsiIAm6QcnR9kXv2b4dLUFKdTApSag&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOCJqYEIJY0GwZX3IRp7_THTI72lBUKllUfVvyAjV5y_3rcOl2iQAG7nHTg3k0d6MexyrQQh9h_e92owPjl_kVLCrCxTtKJb0_JatZnGwenPZg&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOBQltXAkt6tRvgaHUDeY2EJUXhBPpYUSzERc8P4JuDYns3XfwChlLe56m7CxC4RVQr69rurvtIeWQPHretv5N2RJaCdnmlXaGl-JHvZxwNepg&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOBIlCVXSFK-vzCWaj5jizjFtsPSWuMgeyw-EIOQSBFvTd1vNuppA2A0btlH6-s0huE7LgkHo5GIZYFxCDIGC_FF3t7GDdC8jaaDD3EM6FGtdw&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOAnS1ibGry1RKe_lAFVp8m8qFUGYPvyN0OJuA0laRxff65SAEVOoLnC8uqGFlKgkZiX4e0cJ8CQWKL73_Zb_N3BX2rc_SsKcICHLL_4uwyjuA&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOBkK8ccm4aSne5COR-bTkG4nZVCJrzq3zpYLSPuaSLl0NWl31FI1zqskw7UqLZYVCIOOJIC9EyjmpbRpb4BS2QM9w6uqUK-yJrREYtxoQO7Mw&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoODdN7BLrKIg9JSxTClqDrEsHFTSkvYHVwu9hLbWn02K95Pz1cPUcz1O4Un4-_n5EzkGlIGCWnTI7MCFw02AhcroWGXvV7hgJuo3pCQFzakw3w&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOBQVOSyLv5I2cHtNwmUwohEO6cLQVDZVK9nVWjjVsu62s8Pf5xxxOeU76dscYip0JL-PgdjPq5qr_WXLTrUjHPgSdVidoBh0_PwLRY26K01Vg&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOCKr7kpSUpn4Z4UdeAOcUcLP2o9JfSfOKHbRrLwNZ0a02jrFOqF_8O5upOp9uiJ_iCzn3uKASip-kpmNUqHFTFhK2xWYchClZcDv01xwxXKbg&pv=2

http://s7651.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOC827b-ApnqrkmTFqvBwnOUtsYUoI78VHFXCkk0BhzrM3hh6QG2fuzJ-zedF5XeeFWvzopE5ASRshq1ju8H6MgwwLyaxEVjxWn1zVAqcXtwjQ&pv=2

http://s5707.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoOCc0xpxIP2YPM1WQE59Icwh0MmlATf714aVyovVQRrNR5mEfSnpMjgvCBLmFdxwy70SSo-O6VVWTWUacgERvR0MXxS4vQf9AZqmlVy5j__atg&pv=2

https://dl.dropbox.com/sh/znqv8vywn4s51wm/.../KMSnano.exe

http://s5707.chomikuj.pl/File.aspx?e=3EyrYM5q1Ygg29x_51LFY7oUCS1Y0bxJuMjP1yxkoODLE2KKySi-rSr8TYZLXZAa6eYUpaJGNl0_8gOCJFSLf4cV-aHQ5eMNbpOexSWIP1pgC2lV-ON31WBieS7cJmP-OA-W5rX9R6oMqEes42dq1w&pv=2

Scan kmsnano.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.