GWTool[.]exe | Triage

Sharing

General

Target

GWTool.exe
Size

226KB
MD5

a149942a72d5a5bce221bd02f19bc5b9
SHA1

35bc0fdc57a1d0366a9d1ba809f47aac70be1c5c
SHA256

1f0602cc7bfd8228a57761efc0e96ef44076f14b7b83ef1b97df2bcfecceff4c
SHA512

a222a79f1c9ef12fdcf5522a906d0e7cbe134d96a4d784cf090952f484b097fcf0805cd6e1a6d3c5f1b7ec378b5d8842c9a3025788f384bd8c280164b1c898cb
SSDEEP

1536:ckg4mk4dimaqp0RaVbJ1KswHkg4mk4dimaqp0RaV:fRYukbJ1SMRYuk

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GWTool.exe

Files

GWTool.exe
.exe windows:4 windows x86 arch:x86

f34d5f2d4577ed6d9ceec516c1f5a744

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

f:\SCM Projects\GWTool\GWTool\obj\x86\Debug\GWTool.pdb

Imports

mscoree

_CorExeMain

Sections

.text
Size: 117KB - Virtual size: 116KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 108KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 12B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ