toolspub1[.]exe | Triage™

General

Target
toolspub1.exe
Size 282KB
Sample240118-bc75rsadc4
SHA256 d59c4d4d2c2ed517f36a87a29bdb6a9450b3afbfc1b7a07b8af2dca276291d50
MD5 08a6455816df0b89edc79a34e6bacc42
SHA1 641d1224a4220d5262a10161f153927dcfe6853b
SHA512 a991470f1202a21ba969bc699e311ac24458a0d5db7939a9e7cedb0062efc5ba06338b116aa90b7a973be7585ebd4c1ffa01315ed52f651b6748173fa92a75b5
SSDEEP 3072:DU0myMdL+lJXLCE48z1WOGIfFy4oU7CqRk5QwYB1k48cV1JDh1O:DULygLKJXLHNIMty47zwYB1pJd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
toolspub1.exe

File Explorer

toolspub1.exe

.exe 282KB

toolspub1.exe

IMPHASH f7df7285cdb520de588415d277cad136
SHA256 d59c4d4d2c2ed517f36a87a29bdb6a9450b3afbfc1b7a07b8af2dca276291d50
MD5 08a6455816df0b89edc79a34e6bacc42
SHA1 641d1224a4220d5262a10161f153927dcfe6853b
SHA512 a991470f1202a21ba969bc699e311ac24458a0d5db7939a9e7cedb0062efc5ba06338b116aa90b7a973be7585ebd4c1ffa01315ed52f651b6748173fa92a75b5
SSDEEP 3072:DU0myMdL+lJXLCE48z1WOGIfFy4oU7CqRk5QwYB1k48cV1JDh1O:DULygLKJXLHNIMty47zwYB1pJd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8850

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesLengthW FindResourceW InterlockedIncrement QueryDosDeviceA InterlockedCompareExchange SetComputerNameW FindCloseChangeNotification GetTickCount GetConsoleAliasesLengthA GlobalFindAtomA SetConsoleMode WriteConsoleW SetComputerNameExW GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc LoadLibraryA InterlockedExchangeAdd LocalAlloc CreateHardLinkW AddAtomW lstrcmpiW GetModuleHandleA PurgeComm CompareStringA DeleteFileW GetCurrentProcessId DebugBreak ResetWriteWatch ResumeThread GetConsoleOutputCP MultiByteToWideChar GetModuleHandleW Sleep ExitProcess GetStartupInfoW GetCPInfo InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType DeleteCriticalSection HeapFree WriteFile GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime RaiseException LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CloseHandle CreateFileA HeapAlloc HeapReAlloc HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle SetFilePointer SetEndOfFile GetProcessHeap ReadFile WriteConsoleA

user32

SetMessageExtraInfo

Sharing