sigtool[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

sigtool.exe
Size

9.9MB
MD5

b457e669c7f97072dc4ecf261b586c9f
SHA1

d98930b3de153cb7580c5757dd64be19264ce763
SHA256

25bc86cc8b5318f7318e3099911b9f95e1f2df7f4c1be7bc7099ab67a1eb3121
SHA512

60e49b5809befb754ee8a2e4630953abd503d324c1a5a41a3c2817177eaa569068b3f099fdbc64cefed81ca9bf8d479c451d5c4008a5261930a5cdf82cefc7f6
SSDEEP

98304:TNmAQFwsiceK3gesTTv4FPCZXzI9aRrvjP4yPWmbzitALw:LsiceK3gesTTv4FPCZXzI9aRbjP9/L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
sigtool.exe

Files

sigtool.exe
.exe windows:6 windows x64 arch:x64

b0fd6421cc229528f26f4f569665a9ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

libclamav

cl_scandesc_callback
cl_load
cl_cvdhead
cl_cvdverify
cl_cvdfree
cl_cvdunpack
cl_retflevel
cl_strerror
cl_hash_init
cl_update_hash
cl_finish_hash
cl_hash_destroy
fmap
cli_regcomp
cli_regexec
cli_regfree
cli_strbcasestr
cli_chomp
cli_strtok
cli_hex2ui
cli_hex2str
cli_str2hex
cli_strtokenize
cli_ldbtokenize
cli_isnumber
cli_dbgmsg
cli_calloc
cli_rmdirs
cli_hashstream
cli_hashfile
cli_gettmpdir
cli_gentemp_with_prefix
cli_gentemp
cli_strerror
cli_realpath
cli_ac_chklsig
cli_scan_fmap
cli_getdsig
html_normalise_map
text_normalize_init
text_normalize_reset
text_normalize_map
cli_add_content_match_pattern
readdb_parse_ldb_subsignature
cli_initroots
cli_check_auth_header
cli_genhash_pe
cli_utf16toascii
cli_ctime
cl_retdbdir
cl_init
cl_engine_new
cl_engine_set_num
cl_engine_set_str
cli_get_debug_flag
cli_versig2
cli_errmsg
cli_warnmsg
cli_infomsg_simple
cli_dbgmsg_no_inline
cl_engine_set_clcb_vba
cl_engine_free
cl_engine_compile
cl_debug

pthreadvc3

pthread_mutex_lock
pthread_mutex_unlock

bcrypt

BCryptGenRandom

kernel32

RtlVirtualUnwind
IsProcessorFeaturePresent
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetModuleHandleW
GetCommandLineA
SetFileAttributesA
GetFileAttributesExW
GetFileAttributesA
DeleteFileA
CreateFileA
WriteConsoleW
GetConsoleMode
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
CreateThread
GetFullPathNameW
FormatMessageW
GetFinalPathNameByHandleW
MoveFileExW
DeleteFileW
FindFirstFileW
DeviceIoControl
GetFileInformationByHandle
CreateFileW
FindNextFileW
GetModuleHandleA
CreateMutexA
LoadLibraryA
WaitForSingleObjectEx
AcquireSRWLockShared
HeapReAlloc
HeapFree
GetProcessHeap
HeapAlloc
QueryPerformanceFrequency
WakeConditionVariable
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceCounter
TerminateProcess
WaitForSingleObject
GetCurrentProcessId
GetStdHandle
SetFilePointerEx
GetCommandLineW
Sleep
GetLastError
MoveFileA
MultiByteToWideChar
WideCharToMultiByte
GetModuleFileNameA
lstrcmpiA
CopyFileA
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
ReleaseMutex
FindClose
ReleaseSRWLockShared
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
GetSystemInfo
GetCurrentProcess
RtlCaptureContext
GetProcAddress
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW

advapi32

RegCloseKey
RegQueryValueExA
SystemFunction036
RegOpenKeyExA

vcruntime140

memset
memmove
memcpy
__CxxFrameHandler3
strstr
wcsrchr
wcsstr
strrchr
_CxxThrowException
memcmp
strchr
__C_specific_handler

api-ms-win-crt-string-l1-1-0

_strnicmp
strcmp
_strdup
wcsncpy
wcsncat
strlen
wcsncmp
strpbrk
strncpy
strncmp
isdigit

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
strerror
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
exit
__p___argc
__p___argv
_cexit
_c_exit
perror
_initialize_onexit_table
_register_onexit_function
_errno
_crt_atexit
terminate
_set_errno

api-ms-win-crt-stdio-l1-1-0

fflush
fgets
_get_osfhandle
fopen
fread
fseek
ftell
fwrite
__p__commode
rewind
__stdio_common_vfprintf
__stdio_common_vfscanf
__stdio_common_vsprintf
_close
_lseek
_open
_read
_write
_set_fmode
_getcwd
fclose
_fileno
_setmode
__acrt_iob_func
_lseeki64
_wopen

api-ms-win-crt-heap-l1-1-0

calloc
malloc
_set_new_mode
free
realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi
strtoul
strtol
wcstombs

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_ctime64
strftime
_localtime64_s
_localtime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_unlink
rename
_umask
_chdir
_mkdir
_fstat64i32

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale

api-ms-win-crt-math-l1-1-0

roundf
exp2f
__setusermatherr
expf
ceilf
ceil
cos
sinf
floorf
powf
truncf
sin

Sections

.text
Size: 8.8MB - Virtual size: 8.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1003KB - Virtual size: 1003KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 148KB - Virtual size: 148KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0fd6421cc229528f26f4f569665a9ef

Headers

DLL Characteristics

File Characteristics

Imports

libclamav

pthreadvc3

bcrypt

kernel32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 8.8MB - Virtual size: 8.8MB

.rdata Size: 1003KB - Virtual size: 1003KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 148KB - Virtual size: 148KB

.rsrc Size: 18KB - Virtual size: 18KB

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 8.8MB - Virtual size: 8.8MB

.rdata
Size: 1003KB - Virtual size: 1003KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 148KB - Virtual size: 148KB

.rsrc
Size: 18KB - Virtual size: 18KB

.reloc
Size: 24KB - Virtual size: 24KB