toolspub1[.]exe | Triage™

General

Target
toolspub1.exe
Size 256KB
Sample240116-bsdabsbdc8
SHA256 314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c
MD5 4dc87f81349376b17c6b6d6936dae918
SHA1 057aae5d726aabe2e1193aaa7f93ea2cd316c595
SHA512 496c273d84cb87fd3bf245b5797b44511679f64c38e401c4100030a800ad42db71091df69fe2bb5b663449d4e8c9ae2a3c6b49d5cdb9d31e18a27b65893958ed
SSDEEP 3072:ylrJL/wsH8F9PL3TYOfiHhDs902lbJt5hH4W5601:y3L/w287EDs9NH4W0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
toolspub1.exe

File Explorer

toolspub1.exe

.exe 256KB

toolspub1.exe

IMPHASH ac8f1ece26b6fcbaefd9ab768b1f60d3
SHA256 314e14253125545a7987e0f8c160cd2f2db450fce81e57151ae61b8bec2ca86c
MD5 4dc87f81349376b17c6b6d6936dae918
SHA1 057aae5d726aabe2e1193aaa7f93ea2cd316c595
SHA512 496c273d84cb87fd3bf245b5797b44511679f64c38e401c4100030a800ad42db71091df69fe2bb5b663449d4e8c9ae2a3c6b49d5cdb9d31e18a27b65893958ed
SSDEEP 3072:ylrJL/wsH8F9PL3TYOfiHhDs902lbJt5hH4W5601:y3L/w287EDs9NH4W0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement InterlockedCompareExchange SetComputerNameW GetComputerNameW SetCommBreak GetTickCount GetConsoleAliasesLengthA GlobalFindAtomA GetWriteWatch WriteConsoleW GetConsoleFontSize CompareStringW GetStartupInfoW GetLastError SetLastError FindResourceW VirtualAlloc LoadLibraryA InterlockedExchangeAdd LocalAlloc CreateHardLinkW AddAtomW QueryDosDeviceW FindNextChangeNotification lstrcmpiW GetModuleHandleA DeleteFileW GetCurrentProcessId DebugBreak ReadConsoleOutputCharacterW SuspendThread GetProcAddress SetComputerNameExA UnhandledExceptionFilter SetUnhandledExceptionFilter HeapAlloc HeapFree EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection TerminateProcess GetCurrentProcess IsDebuggerPresent GetModuleHandleW Sleep ExitProcess WriteFile GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage WideCharToMultiByte InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer HeapSize CloseHandle WriteConsoleA GetConsoleOutputCP SetStdHandle CreateFileA RaiseException

gdi32

GetCharABCWidthsFloatA

Sharing