Kilohearts Installer[.]exe

Resubmissions

06/08/2026, 13:20

260806-qlaceswxd16

06/08/2026, 12:15

260806-pe675svvdw6

Sharing

Copy URL Twitter E-mail

General

Target
Kilohearts Installer.exe
Size 14.9MB
Sample260806-qlaceswxd1
SHA256 8f4c7b2bfaf8b6668f4cbb3585da6460fa622bbb0c195d49f03e5cba8263ec46
MD5 4f942a4da168f548997e5a6f4d077794
SHA1 e17ae90b14a0bab2cb352ae4f9a8b2bd54c6d449
SHA512 a4a6efdc7b749b5825785903d998734f2c39ed23c4e14012ecbb536a22e3a39a9ac521830e619dbdc20bbae25842b5c61c40c3b1543fc29bdaee2473f53ede91
SSDEEP 196608:8crGhCU9TN6k862vc7XBNGW1oXgWkphlK0LpXMaIFUI:8craEc/GW1oXgWkphxXMai
TLSH
T1EBF68E02B65550ADC19AC0749A5E8726DA31BCCE0BB4A9EF21C0B6752F776F07E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

Kilohearts Installer.exe

.exe 14.9MB

Kilohearts Installer.exe

IMPHASH 1ea773bfa4a3773384c5de169f709949
SHA256 8f4c7b2bfaf8b6668f4cbb3585da6460fa622bbb0c195d49f03e5cba8263ec46
MD5 4f942a4da168f548997e5a6f4d077794
SHA1 e17ae90b14a0bab2cb352ae4f9a8b2bd54c6d449
SHA512 a4a6efdc7b749b5825785903d998734f2c39ed23c4e14012ecbb536a22e3a39a9ac521830e619dbdc20bbae25842b5c61c40c3b1543fc29bdaee2473f53ede91
SSDEEP 196608:8crGhCU9TN6k862vc7XBNGW1oXgWkphlK0LpXMaIFUI:8craEc/GW1oXgWkphxXMai
TLSH
T1EBF68E02B65550ADC19AC0749A5E8726DA31BCCE0BB4A9EF21C0B6752F776F07E3D720
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

19:af:d6:2f:c1:5c:7c:90:db:15:da:ac:a8:f0:f3:44:75:35:04:54:10:a7:8a:0e:f6:2e:76:2c:03:0f:92:a7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

SERIALNUMBER=556886-8276,CN=Kilohearts AB,O=Kilohearts AB,ST=Ostergotlands lan,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Chains

May 22, 2026

SERIALNUMBER=556886-8276,CN=Kilohearts AB,O=Kilohearts AB,ST=Ostergotlands lan,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

SERIALNUMBER=556886-8276,CN=Kilohearts AB,O=Kilohearts AB,ST=Ostergotlands lan,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Subject

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Serial Number

48:fc:93:b4:60:55:94:8d:36:a7:c9:8a:89:d6:94:16

Issuer

CN=AAA Certificate Services,O=Comodo CA Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

May 25, 2021 - Dec 31, 2028

Subject

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Serial Number

33:d7:08:a8:91:40:53:19:e2:a5:bb:d3:39:b9:ad:6e

Issuer

CN=Sectigo Public Code Signing Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

SERIALNUMBER=556886-8276,CN=Kilohearts AB,O=Kilohearts AB,ST=Ostergotlands lan,C=SE,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#13025345

Serial Number

36:e2:5c:06:ad:1a:76:33:a0:f5:03:57:38:4e:00:d6

Issuer

CN=Sectigo Public Code Signing CA EV R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 15, 2026 - Jan 14, 2029

Subject

CN=Sectigo Public Time Stamping Signer R36,O=Sectigo Limited,ST=West Yorkshire,C=GB

Serial Number

a4:29:3b:6e:1e:dd:d7:a7:34:08:87:ad:7a:4e:b7:24

Issuer

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 27, 2025 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping CA R36,O=Sectigo Limited,C=GB

Serial Number

7a:23:ae:da:53:69:96:0f:91:c8:3e:5c:f4:c7:e3:3f

Issuer

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Mar 21, 2036

Subject

CN=Sectigo Public Time Stamping Root R46,O=Sectigo Limited,C=GB

Serial Number

36:c2:b0:bd:7c:1b:3a:e7:a3:b3:dd:36:cb:c9:75:68

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 22, 2021 - Jan 18, 2038

Minor OS version

Major OS version

Entry point

5400920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\development\jenkins\workspace\Products\Build_Kilohearts_Installer\bin\Installer.pdb

kernel32

GetProcAddress MultiByteToWideChar EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection InitializeConditionVariable WakeConditionVariable SleepConditionVariableCS SetThreadPriority GetSystemTimeAsFileTime GetEnvironmentVariableW GetCurrentDirectoryW CreateDirectoryW CreateFileW DeleteFileW FlushFileBuffers GetFileAttributesW GetFinalPathNameByHandleW GetFileTime GetFullPathNameW RemoveDirectoryW SetEndOfFile SetFileAttributesW SetFilePointerEx SetFileTime DeviceIoControl GetWindowsDirectoryW GetModuleHandleW CreateDirectoryExW CopyFileExW AreFileApisANSI GetSystemInfo OpenEventA ResetEvent Sleep GetCurrentProcessId WaitForMultipleObjectsEx GetProcessHeap HeapAlloc HeapFree SetWaitableTimer ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleA CreateWaitableTimerA GetModuleHandleExW GetModuleFileNameW WriteFile IsDebuggerPresent FindResourceW LoadResource SizeofResource LockResource OutputDebugStringW GetCurrentProcess OpenProcess MulDiv CreateActCtxW ActivateActCtx DeactivateActCtx ReleaseActCtx GetExitCodeProcess GetTickCount64 CreateMutexW ReleaseMutex GlobalAlloc GlobalLock GlobalFree GlobalUnlock GlobalSize CreateNamedPipeW ConnectNamedPipe CancelSynchronousIo LoadLibraryW FreeLibrary ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW GetLocaleInfoEx GetStringTypeW OutputDebugStringA WaitForSingleObject EncodePointer DecodePointer LCMapStringEx CompareStringEx GetCPInfo GetTempPathW RtlUnwindEx InterlockedPushEntrySList SetLastError RtlUnwind InitializeCriticalSectionAndSpinCount HeapSize SetStdHandle GetFileType GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ExitProcess CreateThread ExitThread FreeLibraryAndExitThread GetStdHandle GetConsoleOutputCP GetConsoleMode FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW GetTimeZoneInformation HeapReAlloc GetFileAttributesExW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW WaitNamedPipeA VerifyVersionInfoW CreateEventW SleepEx VerSetConditionMask GetSystemDirectoryW CreateFileA VirtualFree VirtualAlloc CopyFileW ReleaseSemaphore CreateSemaphoreA LoadLibraryExW FindFirstFileW FindNextFileW FindClose GetLastError ReadFile MapViewOfFile CreateFileMappingA GetFileSizeEx UnmapViewOfFile RaiseException SetFilePointer GetEnvironmentVariableA GetVersionExW GetComputerNameW GetOverlappedResult InitializeCriticalSection SetErrorMode Process32NextW Module32NextW Module32FirstW Process32FirstW CreateToolhelp32Snapshot MoveFileExW CreateEventA WaitForSingleObjectEx GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency LocalFree WideCharToMultiByte FormatMessageW GetLogicalDriveStringsW GetVolumeInformationW LoadLibraryA LCMapStringA GetStringTypeExA GetLocaleInfoA IsDBCSLeadByteEx EnumSystemLocalesA FoldStringW GetCurrencyFormatW GetTickCount GetFileInformationByHandle FormatMessageA SetEvent RtlPcToFileHeader CloseHandle GetLogicalDrives

ole32

CoInitializeEx DoDragDrop RegisterDragDrop CoCreateInstance RevokeDragDrop ReleaseStgMedium CoUninitialize OleInitialize CoTaskMemFree

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHFileOperationW ShellExecuteExW ShellExecuteW SHGetKnownFolderPath ord74 DragQueryFileW CommandLineToArgvW

user32

RedrawWindow InsertMenuItemW CreatePopupMenu CreateMenu ShowCursor SetCursorPos SetRectEmpty GetWindowPlacement SetActiveWindow SetForegroundWindow BringWindowToTop LoadIconW SetWindowTextW MonitorFromPoint ClientToScreen IsIconic MoveWindow GetMonitorInfoW MonitorFromWindow UnregisterClassW DestroyWindow KillTimer DestroyMenu SetMenu GetClientRect RegisterClipboardFormatW SetTimer CreateWindowExW RegisterClassW EnableWindow CloseClipboard SetCursor DefWindowProcW ReleaseCapture SetFocus SetCapture GetCapture UpdateLayeredWindow IsWindowVisible GetMenuItemInfoW GetMenu TrackMouseEvent EndPaint BeginPaint InvalidateRect GetUpdateRect GetMessageExtraInfo PostMessageW ToUnicode GetKeyboardState MapVirtualKeyW CallNextHookEx GetAncestor GetWindow SetWindowsHookExW GetKeyState SetWindowLongPtrW EndDialog GetWindowLongW GetWindowLongPtrW ScreenToClient GetWindowRect MapDialogRect SetWindowPos ShowWindow GetDlgItem DialogBoxIndirectParamW ReleaseDC DrawTextW GetDC GetDialogBaseUnits MessageBoxW SendMessageW IsDialogMessageW UpdateWindow WaitMessage UnhookWindowsHookEx SetMenuItemInfoW LoadCursorW OpenClipboard AdjustWindowRectEx SetClipboardData SystemParametersInfoW LoadStringA PeekMessageW PostQuitMessage DispatchMessageW TranslateMessage GetMessageW GetParent GetClassInfoW EmptyClipboard GetCursorPos GetClipboardData

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam RegQueryValueExA RegOpenKeyExA RegGetValueW RegCloseKey RegQueryValueExW RegOpenKeyW GetTokenInformation OpenProcessToken SetNamedSecurityInfoW CryptAcquireContextW CryptReleaseContext CryptGenRandom GetNamedSecurityInfoW AllocateAndInitializeSid SetEntriesInAclW

comdlg32

GetOpenFileNameW GetSaveFileNameW

gdi32

SetDIBitsToDevice CreateCompatibleDC DeleteObject CreateCompatibleBitmap SelectObject SetDIBits CreateDIBSection DeleteDC GetStockObject

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

winmm

timeGetTime timeEndPeriod timeBeginPeriod timeGetDevCaps

rpcrt4

UuidCreate

crypt32

CertFindExtension CertAddCertificateContextToStore CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CryptDecodeObjectEx PFXImportCertStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore CertGetCertificateChain CertFreeCertificateChain

ws2_32

WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACloseEvent send getsockopt ntohs ntohl htons htonl WSACleanup WSAStartup WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton WSASetLastError inet_ntop accept bind connect getpeername getsockname recv setsockopt socket WSAIoctl __WSAFDIsSet select listen getaddrinfo freeaddrinfo ioctlsocket WSACreateEvent

bcrypt

BCryptGenRandom

oleaut32

VariantClear

psapi

EnumProcessModules GetModuleInformation

setupapi

SetupDiEnumDeviceInterfaces SetupDiGetDeviceRegistryPropertyW SetupDiGetDeviceInterfaceDetailA SetupDiGetClassDevsW SetupDiDestroyDeviceInfoList SetupDiEnumDeviceInfo SetupDiGetDeviceInstanceIdA

wintrust

WinVerifyTrust

Name

.text

Size

8.7MB

Virtual Size

8.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.6MB

Virtual Size

2.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

301KB

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

428KB

Virtual Size

428KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=35, id=259, version=29395,

count=216, id=261, version=29395,

count=8, id=253, version=33218,

count=108, id=261, version=33218,

count=19, id=260, version=33218,

count=28, id=259, version=33218,

count=10, id=261, version=33521,

count=80, id=261, version=27048,

count=5, id=261, version=31823,

count=6, id=257, version=30795,

count=1, id=260, version=31935,

count=326, id=261, version=31935,

count=238, id=260, version=33521,

count=67, id=260, version=29395,

count=1, id=262, version=29395,

count=35, id=257, version=29395,

count=547, id=1, productName=Unmarked objects,

count=690, productName=Unmarked objects (old),

count=1, id=255, version=33521,

count=1, id=151,

count=1, id=258, version=33521,