LASTTOLS[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
LASTTOLS.exe
Size 1.9MB
Sample261029-vm2khsbg64
SHA256 511fb9bb91f3fdb12291a6b9ba56b02ff1161f2c0f06a5f99bc5501f8eb0ad3f
MD5 21bf0889cec27e4723f6e8299da8a63e
SHA1 495f6dc5f91e2ce4ed6901c1cad5b9ddb2926307
SHA512 0c018222e3a0ffb7d3ea377a7248441e531864b62202dff5fd2d77b88a7f2246042a684638412d004851b661dadac7d61f429d16a6d78d305b88e61417670164
SSDEEP 49152:lszw+ITRlrSc+hBUEz2IFShhWabixeBplusdbLsAJbadOxU:izwZTRlrSc+hBfxyfusdbLsAJbadOxU
TLSH
T1B2957DC2E1D61CEDC923973851DBA337B735BCB046254F235690E2381E63AD06E9BB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
LASTTOLS.exe

File Explorer

LASTTOLS.exe

.exe 1.9MB

LASTTOLS.exe

IMPHASH 716616676b43bca98dbd3c9a95c3bee1
SHA256 511fb9bb91f3fdb12291a6b9ba56b02ff1161f2c0f06a5f99bc5501f8eb0ad3f
MD5 21bf0889cec27e4723f6e8299da8a63e
SHA1 495f6dc5f91e2ce4ed6901c1cad5b9ddb2926307
SHA512 0c018222e3a0ffb7d3ea377a7248441e531864b62202dff5fd2d77b88a7f2246042a684638412d004851b661dadac7d61f429d16a6d78d305b88e61417670164
SSDEEP 49152:lszw+ITRlrSc+hBUEz2IFShhWabixeBplusdbLsAJbadOxU:izwZTRlrSc+hBfxyfusdbLsAJbadOxU
TLSH
T1B2957DC2E1D61CEDC923973851DBA337B735BCB046254F235690E2381E63AD06E9BB16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership FreeSid

comdlg32

GetOpenFileNameW

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontW CreatePen CreateSolidBrush DeleteDC DeleteObject RoundRect SelectObject SetBkMode SetTextColor

gdiplus

GdipAlloc GdipCloneBrush GdipCloneImage GdipCreateBitmapFromFile GdipCreateFromHDC GdipCreateSolidFill GdipDeleteBrush GdipDeleteGraphics GdipDisposeImage GdipDrawImageRect GdipFillRectangleI GdipFree GdipSetInterpolationMode GdiplusShutdown GdiplusStartup

kernel32

CloseHandle CreateDirectoryW CreateEventA CreateFileW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FindResourceW GetCurrentThreadId GetEnvironmentVariableW GetExitCodeThread GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetPrivateProfileIntW GetPrivateProfileStringW GetProcAddress GetStartupInfoA GetSystemTimeAsFileTime GetTempPathW GetTickCount InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadResource LockResource OpenProcess Process32FirstW Process32NextW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetUnhandledExceptionFilter SizeofResource Sleep TlsGetValue VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WideCharToMultiByte WriteFile WritePrivateProfileStringW WriteProcessMemory

msvcrt

__C_specific_handler __getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _fmode _initterm _snwprintf _strlwr _wcsdup abort atexit calloc exit fflush fprintf free getenv malloc memcmp memcpy memset setvbuf signal strchr strcmp strlen strncmp strstr strtoul vfprintf wcscmp wcscpy wcslen wcsncpy wcsrchr

shell32

ShellExecuteW

user32

BeginPaint CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW DrawTextW EndPaint FillRect GetClientRect GetCursorPos GetMessageW GetSystemMetrics InvalidateRect LoadCursorA LoadIconA LoadImageW PostMessageA PostQuitMessage RegisterClassExW ScreenToClient SendMessageW SetCursor SetProcessDPIAware ShowWindow TranslateMessage UpdateWindow

Name

.text

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

337KB

Virtual Size

337KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

364B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

1024B

Virtual Size

744B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

512B

Virtual Size

151B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

512B

Virtual Size

468B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/97

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

LASTTOLS.exe

advapi32

comdlg32

gdi32

gdiplus

kernel32

msvcrt

shell32

user32

generic