MD5 Hash: e529a1ba814ab5afa5068db7e487b4ba
SHA256 Hash: 2330327f5177058d660d8d608cc950dc24a03983597a07d9e5ada1cdd70b8e88
File size: 647168 bytes (632 KB.)
Last analysis: 18 Nov, 2017 06:50:12

Analysis MD5: e529a1ba814ab5afa5068db7e487b4ba

Analysis of the file classifies it as a class D- (Suspicious). The file is probably malicious. Do not use it. The trust index of this analysis is 87 % (high).



AutoKMS.exe is part of the Trojanstartpage.DAW malware. This file is a security risk for your system and the system of others.

Filename: AutoKMS.exe (Trojanstartpage.DAW)
Threat analysis: Suspicious
Analysis trust:
Recent activity:
First seen: 22 Mar, 2011
Last seen: 22 Mar, 2011
Last analysis: 18 Nov, 2017
Possible infection: W32.hack.tool

AutoKMS.exe Trojanstartpage.DAW

Application: Trojanstartpage.DAW
Developer: CODYQX4
File version:
File size: 647168 bytes (632 KB.)
Recent activity:
Historic activity:
MD5 hash: e529a1ba814ab5afa5068db7e487b4ba
SHA1 hash: 6faf21e89147e54d02eb3daae1c7149de7361d94
SHA256 hash: 2330327f5177058d660d8d608cc950dc24a03983597a07d9e5ada1cdd70b8e88

Signature verification


This file has no digital signature. The publisher of this file could not be verified.


File entropy

File entropy match: File code

This file contains (executable) code.

File signature

Executable file

An executable file causes a computer "to perform indicated tasks according to encoded instructions," as opposed to a data file that must be parsed by a program to be meaningful.

The determination of a file type is done with a signature or magic-numbers. Files are identified using by comparing the first set of bytes in the file header. Using this method type of files are recognised no matter the extension used. This information is useful to for example recognise executable files cloaked as images or movies.


Malicious code scan

Malicious code found

Agics makes een analysis of the source code of the file. We look for comparisons with known malicious source code. This is a good way to detect new malicious files which are in fact variations of existing, and known malicious files.

Scan results:

100 %


Online virus scanners

Detection ration:

52 %

Available on is a repository of malware samples to provide security researchers, incident responders, forensic analysts, and the morbidly curious access to samples of live malicious code. Presence of the sample on this site indicates that the file is (Once considered) being malicious.

National Software Reference Library

Not on the nsrl list

The NSRL contains a collection of digital signatures of known, traceable software applications. There are application hash values in the hash set which may be considered malicious, i.e. steganography tools and hacking scripts.



Sandbox behaviour analysis:

The file is executed in a safe environment to track its behaviour. The behaviour analysis can help with detecting new malware which is not recognized by virusscanners yet. However it has a high chance on a false-positive, especially with installers, uninstallers and virusscanners.

Network activity

No internet connection

Dropped files

File name md5


Statistic analysis

Statistic analysis of the file

Similar to other files with the same name
No certificate
Other files with the same name do not have a certificate as well
This is not a common file
Normal code

Neural network analysis

Analysis: Malicious

A neural network is a type of artificial intelligence. It recognized patterns nog clear for a human viewer. Our neural network is surprisingly accurate in recognizing dangerous files. The value below is the predicted chance the file is malicious.

84%84 %


User feedback

Read feedback on this file from other users. Help other users by providing feedback yourself.

You can earn reputation points !

You are currently not logged in. Login, or Create an account

Feedback users:

There has been no user feedback provided yet.
You are not logged in. Only registered users can provide feedback. Login and help other users.

Login Create an account