toolspub2[.]exe | Triage™

General

Target
toolspub2.exe
Size 283KB
Sample240118-bc8fjaadc5
SHA256 48684fe74ef34bd1c9542aea357d418b96df47273d809e6ebdc38e538bc66d42
MD5 9962db39d4e20423e66ec5b6c4944a22
SHA1 5a537a39f60e7bdbf219dbe7a1e2dba47ac27425
SHA512 c3b84bb08378fa8dcab4cdf3308509992c827e74f62a897ff69ee9c43f56749c77029aaf502ad081500debda2933a85179ad60f26482d2447c10b0a22a5bd589
SSDEEP 3072:QEyDZZvp8LbMpJNbgwWAi30dVGcZpQnELMOnX5K5fI8TB1k48cV1JDh1O:QEydZiLApJNHviyFeEL9nXCHTB1pJd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
toolspub2.exe

File Explorer

toolspub2.exe

.exe 283KB

toolspub2.exe

IMPHASH f7df7285cdb520de588415d277cad136
SHA256 48684fe74ef34bd1c9542aea357d418b96df47273d809e6ebdc38e538bc66d42
MD5 9962db39d4e20423e66ec5b6c4944a22
SHA1 5a537a39f60e7bdbf219dbe7a1e2dba47ac27425
SHA512 c3b84bb08378fa8dcab4cdf3308509992c827e74f62a897ff69ee9c43f56749c77029aaf502ad081500debda2933a85179ad60f26482d2447c10b0a22a5bd589
SSDEEP 3072:QEyDZZvp8LbMpJNbgwWAi30dVGcZpQnELMOnX5K5fI8TB1k48cV1JDh1O:QEydZiLApJNHviyFeEL9nXCHTB1pJd
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8610

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesLengthW FindResourceW InterlockedIncrement QueryDosDeviceA InterlockedCompareExchange SetComputerNameW FindCloseChangeNotification GetTickCount GetConsoleAliasesLengthA GlobalFindAtomA SetConsoleMode WriteConsoleW SetComputerNameExW GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA GetProcAddress VirtualAlloc LoadLibraryA InterlockedExchangeAdd LocalAlloc CreateHardLinkW AddAtomW lstrcmpiW GetModuleHandleA PurgeComm CompareStringA DeleteFileW GetCurrentProcessId DebugBreak ResetWriteWatch ResumeThread GetConsoleOutputCP MultiByteToWideChar GetModuleHandleW Sleep ExitProcess GetStartupInfoW GetCPInfo InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EnterCriticalSection LeaveCriticalSection RtlUnwind SetHandleCount GetStdHandle GetFileType DeleteCriticalSection HeapFree WriteFile GetModuleFileNameA InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime RaiseException LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA CloseHandle CreateFileA HeapAlloc HeapReAlloc HeapSize GetConsoleCP GetConsoleMode FlushFileBuffers SetStdHandle SetFilePointer SetEndOfFile GetProcessHeap ReadFile WriteConsoleA

user32

SetMessageExtraInfo

Sharing