ToolsDownloader++[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
ToolsDownloader++.exe
Size 17.3MB
Sample260806-ad9vbaef86
SHA256 7d6e42a390910baea993d5b264bd162e5b04c78a16eb8ec670817e6471b569fb
MD5 9af365d08698a65e884998c933834a14
SHA1 c5be6763d612989016a5b82b60dcb68f96b438db
SHA512 25ef310208369844719d75d0487c0b3d83ea82153c11ca7ec4d4245954c458d4765fb843ba336268a1d1fea3c04b56820b921ceed9f47f8c808fd698d469a39a
SSDEEP 196608:rgRG1QrtdhSO0whEIAmmnL416cAEpL8cCvIw:rN1QrtdhSO0whEfmA41tAEpLjCvIw
TLSH
T19307A6776100C07DCA884074C281CF5FBD2828A56AE25FC3C49576F63E9ADB86DEBD46
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

ToolsDownloader++.exe

.exe 17.3MB

ToolsDownloader++.exe

IMPHASH 9d18fa453fc90224793819a98449285e
SHA256 7d6e42a390910baea993d5b264bd162e5b04c78a16eb8ec670817e6471b569fb
MD5 9af365d08698a65e884998c933834a14
SHA1 c5be6763d612989016a5b82b60dcb68f96b438db
SHA512 25ef310208369844719d75d0487c0b3d83ea82153c11ca7ec4d4245954c458d4765fb843ba336268a1d1fea3c04b56820b921ceed9f47f8c808fd698d469a39a
SSDEEP 196608:rgRG1QrtdhSO0whEIAmmnL416cAEpL8cCvIw:rN1QrtdhSO0whEfmA41tAEpLjCvIw
TLSH
T19307A6776100C07DCA884074C281CF5FBD2828A56AE25FC3C49576F63E9ADB86DEBD46
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

a2:45:72:67:ee:b4:82:4c:02:9d:6e:53:24:ac:04:65:72:cb:03:46:7f:3f:09:bd:ba:f7:cf:23:b6:f1:74:96

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=detect,O=detect,L=Taunton,C=GB

Chains

May 14, 2026

CN=detect,O=detect,L=Taunton,C=GB

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Subject

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Serial Number

7b:2c:9b:d3:16:80:32:99

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Feb 12, 2016 - Feb 12, 2041

Subject

CN=detect,O=detect,L=Taunton,C=GB

Serial Number

75:7c:65:a5:eb:7a:79:35:42:d0:0e:a6:34:6d:97:4f

Issuer

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 30, 2025 - Sep 30, 2026

Subject

CN=SSL.com Code Signing Intermediate CA RSA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

64:33:51:d3:c7:38:9f:08

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 24, 2016 - Jun 24, 2031

Subject

CN=SSL.com Timestamping Unit 2025 E1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

1f:6b:16:62:d2:2e:1b:6c:5d:f1:c0:c1:a0:60:0e:38

Issuer

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 18, 2025 - Nov 12, 2034

Subject

CN=SSL.com Timestamping Issuing RSA CA R1,O=SSL Corp,L=Houston,ST=Texas,C=US

Serial Number

6d:52:18:70:87:e8:23:4d:85:60:00:d0:80:8f:93:56

Issuer

CN=SSL.com Root Certification Authority RSA,O=SSL Corporation,L=Houston,ST=Texas,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 13, 2019 - Nov 12, 2034

Minor OS version

Major OS version

Entry point

18177616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathW FindClose OpenProcess SetFileAttributesW CreateToolhelp32Snapshot Sleep Process32NextW FileTimeToSystemTime GlobalAlloc Process32FirstW SetCurrentDirectoryW GlobalLock MoveFileExW ReadProcessMemory GetModuleFileNameW SystemTimeToTzSpecificLocalTime QueryFullProcessImageNameW GlobalUnlock LoadLibraryW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive RemoveDirectoryW TerminateProcess FindNextFileW GetFullPathNameW MultiByteToWideChar FindFirstFileW MulDiv lstrcmpiW GetModuleHandleW GetProcAddress GetExitCodeProcess CreateProcessW GetSystemDirectoryW GetFileAttributesW WaitForSingleObject CreateDirectoryW CloseHandle DeleteFileW GetLastError CreateFileW WriteFile WideCharToMultiByte GetCurrentProcessId

user32

CreatePopupMenu SetWindowTextW GetWindowThreadProcessId LoadImageW SystemParametersInfoW SetCursor GetSystemMetrics EndPaint FillRect CreateWindowExW ScreenToClient SendMessageW GetWindowLongPtrW RegisterClassExW ShowWindow BeginDeferWindowPos RedrawWindow TrackMouseEvent SetClipboardData GetClassNameW SetParent SetCapture EndDeferWindowPos TrackPopupMenu DrawTextW GetParent UpdateWindow OpenClipboard ClientToScreen CloseClipboard EmptyClipboard MapWindowPoints SetMenuDefaultItem EnumWindows AppendMenuW TranslateMessage IsDialogMessageW DispatchMessageW MessageBoxW PostQuitMessage CharLowerBuffW SetForegroundWindow GetAncestor GetWindowTextLengthW DeferWindowPos DefWindowProcW PostMessageW FindWindowExW GetWindowRect DestroyWindow GetDC ReleaseCapture InvalidateRect ReleaseDC GetCursorPos DestroyMenu GetClientRect SetFocus IsWindowVisible GetMessageW GetWindowTextW SetWindowPos LoadCursorW SetWindowLongPtrW EnableWindow BeginPaint

gdi32

SelectClipRgn CreatePen SetBkMode SetTextColor DeleteDC CreateRectRgn ExcludeClipRect GetStockObject CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt CreateFontIndirectW SetBkColor DeleteObject CreateSolidBrush GetTextMetricsW RoundRect

shell32

ShellExecuteW SHGetFolderPathW SHGetKnownFolderPath SHFileOperationW SHGetFileInfoW ShellExecuteExW

ole32

CoUninitialize CoTaskMemFree CoInitializeEx CoCreateInstance

oleaut32

VariantClear SysAllocString VariantInit SysFreeString

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z

comctl32

ord413 InitCommonControlsEx ord410

shlwapi

PathCreateFromUrlW

uxtheme

SetWindowTheme

dwmapi

DwmSetWindowAttribute

winhttp

WinHttpConnect WinHttpQueryOption WinHttpReceiveResponse WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetOption WinHttpCrackUrl WinHttpOpen WinHttpCloseHandle WinHttpSendRequest

rstrtmgr

RmEndSession RmRegisterResources RmStartSession RmGetList

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception_context __current_exception memmove memcpy memcmp _CxxThrowException memset __std_exception_copy __std_exception_destroy

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vswprintf_s

api-ms-win-crt-string-l1-1-0

_wcsicmp iswalnum iswalpha towlower towupper wcscmp iswspace strlen wcslen

api-ms-win-crt-convert-l1-1-0

strtod _wcstoui64

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _beginthreadex _initterm_e exit _exit _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _initterm _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

160KB

Virtual Size

160KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.detect

Size

16.9MB

Virtual Size

16.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ToolsDownloader++.exe

kernel32

user32

gdi32

shell32

ole32

oleaut32

msvcp140

comctl32

shlwapi

uxtheme

dwmapi

winhttp

rstrtmgr

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic