Microsoft Toolkit[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Microsoft Toolkit.exe
Size

56.5MB
MD5

16652c1f3744f03088bc34ffa6a19fd9
SHA1

63a19d4e6a2a51b3ec965caa01216a240899d0e4
SHA256

85da939cf7c308f68cc264a96bd45ae4b4fa5bc57cf3194e6cbb2e63f35efac0
SHA512

860eacb2cdddd5631d42b565356e6322fb858523aef95ebeee57d71f9078a6fb3ee78737df7ed85c124e4c2c448e9865dd30f8adc977d8076f991521450144cb
SSDEEP

1572864:WLerqMreCSOAmbV6r36YCzJ+3AzhIKREX:DOpCrAmbebCQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Microsoft Toolkit.exe

Files

Microsoft Toolkit.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 56.1MB - Virtual size: 56.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 366KB - Virtual size: 365KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ