BLTools[.]exe | Triage

Sharing

General

Target

BLTools.exe
Size

1.2MB
MD5

c24d037a521df5a6a53c31c7583f9777
SHA1

b0f8f03edd5aed035a80b042256d8541ecc9437c
SHA256

ce239f615ec2e18bf2259456da55da98fde8c50167ece081a7f859779276afc0
SHA512

deceb8217b3015da2ecd78a0ee8abbccb5b46c24d1aae30f18832bbb9e99916dc613c77c14d69b0d32272e0377224f4a76cc1abf955d9305a0bd4abf64aa9bfa
SSDEEP

12288:BHhLGKKWeqqOGq000M0EwfhH5zB35r9WOXTudCQ/8gvVvc7MWJWLtnlryLI3dMXR:BHhEa4Ah4lwSwyvEk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BLTools.exe

Files

BLTools.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

mscoree

_CorExeMain

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ