toolspub2[.]exe | Triage™

General

Target
toolspub2.exe
Size 255KB
Sample240116-bsdabsadej
SHA256 461f0f86f52bfa5fbed84023d0a9c8652bcbca34fea76ad0cb5bb8c503b65c9a
MD5 981b36d1cfeefa91f3ef5332922cdd8d
SHA1 b8a6b27e011a503755c6df2501039edb82b092aa
SHA512 e0932850586027a24b8d8d7a3fbbaf4fc466a89cc4382ca1fb31847b5c201df3855f31e7208c577cc7907e5af0792abff0092941774cf3b4a27256440ba0d7c2
SSDEEP 3072:2lrJL/wx7/zm4XobcY66bIjWMHGZ4jnz2fbqbzx5h+4Wy601:23L/wxf9Y6mIjN/nmI+4W1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
toolspub2.exe

File Explorer

toolspub2.exe

.exe 255KB

toolspub2.exe

IMPHASH ac8f1ece26b6fcbaefd9ab768b1f60d3
SHA256 461f0f86f52bfa5fbed84023d0a9c8652bcbca34fea76ad0cb5bb8c503b65c9a
MD5 981b36d1cfeefa91f3ef5332922cdd8d
SHA1 b8a6b27e011a503755c6df2501039edb82b092aa
SHA512 e0932850586027a24b8d8d7a3fbbaf4fc466a89cc4382ca1fb31847b5c201df3855f31e7208c577cc7907e5af0792abff0092941774cf3b4a27256440ba0d7c2
SSDEEP 3072:2lrJL/wx7/zm4XobcY66bIjWMHGZ4jnz2fbqbzx5h+4Wy601:23L/wxf9Y6mIjN/nmI+4W1
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedCompareExchange SetComputerNameW GetComputerNameW SetCommBreak GetTickCount GetConsoleAliasesLengthA GlobalFindAtomA GetWriteWatch WriteConsoleW GetConsoleFontSize CompareStringW GetStartupInfoW GetLastError SetLastError FindResourceW VirtualAlloc LoadLibraryA InterlockedExchangeAdd LocalAlloc CreateHardLinkW AddAtomW QueryDosDeviceW FindNextChangeNotification lstrcmpiW GetModuleHandleA DeleteFileW GetCurrentProcessId DebugBreak ReadConsoleOutputCharacterW SuspendThread GetProcAddress SetComputerNameExA UnhandledExceptionFilter SetUnhandledExceptionFilter HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection TerminateProcess GetCurrentProcess IsDebuggerPresent GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP SetStdHandle CreateFileA RaiseException

gdi32

GetCharABCWidthsFloatA

Sharing