toolspub1[.]exe | Triage™

General

Target
toolspub1.exe
Size 203KB
Sample240102-233abaecg7
SHA256 9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483
MD5 7b2592bee2a2b4cfb28502892c619612
SHA1 c4477fef847e926783d54efb7c577fdb8d2407f9
SHA512 c9527802e2d80f8f226471fc1d0791dea2efc29e51eba03c2525defc6d6be41e8b8f2bcf1ecf30c543a9476d520ef53ab898b912a1a69086b83cc0bb5d28c1fe
SSDEEP 3072:dDoO2LbVS5fgevom6PJiMrt+NqaDD3LP2uHv49GriBditdi16kwxZRUiaD:S3LbfGMTI3LPJPqG2Bkeia
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
toolspub1.exe

File Explorer

toolspub1.exe

.exe 203KB

toolspub1.exe

IMPHASH 628b5625e44ec4d4a2ba4078ce3026c9
SHA256 9c98f0f798b53d28919e7c8f7331619c509e24045d1f4dd192f86f2a6115d483
MD5 7b2592bee2a2b4cfb28502892c619612
SHA1 c4477fef847e926783d54efb7c577fdb8d2407f9
SHA512 c9527802e2d80f8f226471fc1d0791dea2efc29e51eba03c2525defc6d6be41e8b8f2bcf1ecf30c543a9476d520ef53ab898b912a1a69086b83cc0bb5d28c1fe
SSDEEP 3072:dDoO2LbVS5fgevom6PJiMrt+NqaDD3LP2uHv49GriBditdi16kwxZRUiaD:S3LbfGMTI3LPJPqG2Bkeia
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

9654

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LocalUnlock OpenFile TryEnterCriticalSection CopyFileExW SetEndOfFile CreateJobObjectW HeapFree FreeEnvironmentStringsA GetWindowsDirectoryA GetCompressedFileSizeW GetConsoleCP GlobalAlloc IsProcessInJob DnsHostnameToComputerNameW GetAtomNameW GetModuleFileNameW GetTimeZoneInformation CompareStringW SetConsoleTitleA VirtualUnlock GetLastError GetLongPathNameW CreateNamedPipeA EnumDateFormatsExA SetVolumeLabelW GetConsoleDisplayMode SetFileAttributesA LoadLibraryA OpenWaitableTimerW GlobalFindAtomW GetModuleHandleA lstrcatW VirtualProtect QueryPerformanceFrequency CreateWaitableTimerA LocalFree LCMapStringW CompareStringA GetLocaleInfoW WideCharToMultiByte TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapReAlloc HeapAlloc GetStartupInfoW RaiseException RtlUnwind GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection HeapCreate HeapDestroy VirtualFree VirtualAlloc Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount HeapSize SetConsoleCtrlHandler FreeLibrary InterlockedExchange GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA SetEnvironmentVariableA

user32

GetDesktopWindow GetMonitorInfoA

Name

.text

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

417B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cas

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.paci

Size

1024B

Virtual Size

577B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

toolspub1.exe

kernel32

user32

generic