Microsoft Toolkit[.]exe | Triage

Sharing

General

Target

Microsoft Toolkit.exe
Size

54.5MB
MD5

ea54a3ed8c40aa405b9645c166137318
SHA1

c4de105bc0d4debf2eab7563fc3127f6677a43c3
SHA256

3d5bf21c0f5b37ae78ef8c685d31f72d9d894daf4fa4e11870fb1ac5b7ce9047
SHA512

f646fdb1b08fb99ff35fe9d03a778499007195a8f19127978e2ce197f7ca5ed3138e57448572693e8d5a5eaa81ebef8d791122eeb221fb84286845cea2f4d0cf
SSDEEP

1572864:mpwfhw0dPZjxzAG/d9Y15bAexs/Qa6m0:mqZZjxEwM15bAH/2R

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Microsoft Toolkit.exe

Files

Microsoft Toolkit.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 54.2MB - Virtual size: 54.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ