home

keypang.exe

Keypang

AD79 Corp

The application keypang.exe by AD79 Corp has been detected as a potentially unwanted program by 5 anti-malware scanners. It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘kp’.
Publisher:
AD79 Corp  (signed and verified)

Product:
Keypang

Version:
1.05

MD5:
5099d9b64d8f7ffe358f29aede8571d0

SHA-1:
6ceb418c41ccd05943630bf754ea5b9f79749e7b

SHA-256:
b497da05e3c1dff34afb2a7d158ecd945ee34b8213964879da608e64276bde57

Scanner detections:
5 / 68

Status:
Potentially unwanted

Analysis date:
4/27/2024 3:56:28 AM UTC  (today)

Scan engine
Detection
Engine version

Dr.Web
Trojan.Adkor.324
9.0.1.05190

Emsisoft Anti-Malware
Gen:Variant.Adware.Graftor.136219
10.0.0.5366

ESET NOD32
Win32/AdWare.Kraddare.JS application
7.0.302.0

F-Secure
Variant.Adware.Graftor
5.15.21

Norman
Gen:Variant.Adware.Graftor.136219
13.02.2016 01:47:07

File size:
246.6 KB (252,472 bytes)

Product version:
1.05

Original file name:
keypang.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\roaming\keypang\keypang.exe

Digital Signature
Signed by:
AD79 Corp

Authority:
Thawte, Inc.

Valid from:
8/22/2013 9:00:00 AM

Valid to:
9/22/2014 8:59:59 AM

Subject:
CN=AD79 Corp, O=AD79 Corp, L=Yeonsu-gu, S=Incheon, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
3000AE01184DFF956E01F0B36AF80075

File PE Metadata
Compilation timestamp:
11/28/2013 2:42:16 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
6144:+yhdKmuvbDjErDd5KRTiyPneRfaI6eEQH/wHf:6muvIrDORTDPneRfaIdEQH/Q

Entry address:
0x2CCC

Entry point:
68, C4, 98, 40, 00, E8, F0, FF, FF, FF, 00, 00, 00, 00, 00, 00, 30, 00, 00, 00, 38, 00, 00, 00, 00, 00, 00, 00, 5A, 42, DB, C3, 71, 07, 31, 43, A9, 60, 81, 97, B7, 76, 78, CA, 00, 00, 00, 00, 00, 00, 01, 00, 00, 00, 2D, 43, 30, 30, 30, 2D, 4B, 65, 79, 70, 61, 6E, 67, 00, 00, 00, 00, 00, FF, CC, 31, 00, 08, 00, 28, A1, 50, C2, 41, 69, 43, 83, AB, 54, 1A, 31, FC, 75, E1, 12, EF, 88, 1C, 8F, 79, 6E, 45, 9C, E2, 1B, 74, 0B, CC, 6D, CA, 3A, 4F, AD, 33, 99, 66, CF, 11, B7, 0C, 00, AA, 00, 60, D3, 93, 00, 00, 00...
 
[+]

Entropy:
5.3674

Developed / compiled with:
Microsoft Visual Basic v5.0/v6.0

Code size:
204 KB (208,896 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
kp

Command:
"C:\users\{user}\appdata\roaming\keypang\keypang.exe"


Remove keypang.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.