BLTools[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

BLTools.exe
Size

1.1MB
MD5

adbe188bdeb56e9de21eb22840cb1ecc
SHA1

bd8a67a4d72d414cfe3a3bfc8bc2ab0e6dbfae7f
SHA256

30634e675eddb8a0b953dac342b0b93958809bdaf3577f85a46c4d5d4e3ea539
SHA512

541aae86712eb5e1a8292fad8264fd03b280444092f0b9ffb8d7aac6c0d97898bac5f34aac9da7e03bb7b373e04d5e659ea14a0961bd7153eed30712bbdbbfe2
SSDEEP

6144:qkuD/utHVINZJxZcKOsbBA4xQ7uhhq7p4Fe0ZCtVTduet4Bd3+p0gkWYNwc7n1FI:qlj9ZzJBw7p4A3x4wkhwc51YawDsUXJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BLTools.exe

Files

BLTools.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ