toolspub1[.]exe | Triage™

General

Target
toolspub1.exe
Size 215KB
Sample240122-e3netsgfg3
SHA256 75bcc7144c36d2931b31364db4d3b3fc44b1ad803790ea1077f228efc715bb6d
MD5 f73e509c71abc1b5c789834510e117c7
SHA1 de658fac7257ed1c10b11c1b96cee672ddb41277
SHA512 a176bfe67b62c770cb4c306c35d7e2c19de00adea9f6eb980d3eb6ee56ef4c29cb3b97bc8f73e6be59f30db408ad5c3d43dc5eb088016f7faf791ad4304c164d
SSDEEP 3072:/VAVkKKz6bqDShp/wnMBy7twMMZ5IQbt6POZ5GhdAhgMXEfpF:/V123pj6yNt6UGH4gMXI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
toolspub1.exe

File Explorer

toolspub1.exe

.exe 215KB

toolspub1.exe

IMPHASH 78228cc34ce8e71519a98f0987233e7f
SHA256 75bcc7144c36d2931b31364db4d3b3fc44b1ad803790ea1077f228efc715bb6d
MD5 f73e509c71abc1b5c789834510e117c7
SHA1 de658fac7257ed1c10b11c1b96cee672ddb41277
SHA512 a176bfe67b62c770cb4c306c35d7e2c19de00adea9f6eb980d3eb6ee56ef4c29cb3b97bc8f73e6be59f30db408ad5c3d43dc5eb088016f7faf791ad4304c164d
SSDEEP 3072:/VAVkKKz6bqDShp/wnMBy7twMMZ5IQbt6POZ5GhdAhgMXEfpF:/V123pj6yNt6UGH4gMXI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

5048

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MoveFileExA GetConsoleAliasExesLengthA HeapAlloc FreeEnvironmentStringsA GetModuleHandleW GetTickCount GetConsoleAliasesA TzSpecificLocalTimeToSystemTime LoadLibraryW GetLocaleInfoW GetAtomNameW GetModuleFileNameW CompareStringW SetConsoleTitleA WritePrivateProfileStringW RaiseException FindResourceA GetLastError GetProcAddress GetTapeStatus SetComputerNameA OpenWaitableTimerA LoadLibraryA LocalAlloc SetCalendarInfoW SetCurrentDirectoryW OpenJobObjectW GetStringTypeW CompareStringA EndUpdateResourceA UnregisterWaitEx LocalFree InterlockedExchange GetEnvironmentVariableW HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate HeapDestroy ExitProcess DecodePointer WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LeaveCriticalSection FatalAppExitA EnterCriticalSection SetConsoleCtrlHandler FreeLibrary Sleep RtlUnwind WideCharToMultiByte LCMapStringW MultiByteToWideChar GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale HeapSize HeapReAlloc IsProcessorFeaturePresent

advapi32

RegisterEventSourceW

Sharing