BLTools v4[.]5[.]5 New[.]exe

General

Target
BLTools v4.5.5 New.exe
Size 1001KB
Sample261031-ynna3aztht
SHA256 24f5ce1ed239dfbd4eb48dd160e08821d9e5489765e26212e7223838860f034d
MD5 3748f454806661f7150c15357bb724e9
SHA1 b2b96af9f219300d8f23f6d5acca97b06ec86a98
SHA512 09e5a5be1bf404f450c9da62827e6629a79a27c02534ef6ff52f13c75cf3e922adbb8eae735585cb608258688654a4d1a697e4e64982f51f2962c8aa2ff950fe
SSDEEP 24576:/iiy2LA/I0xusciua5CNEpYBRupKm7BfHgq155ppbdGax1Om5vuxZHPzQaq5Xxk8:E95vuxZHklLESqaEwX
TLSH
T1AA250242B691C0B2C4531A769879C779192FFC100F316ACBE7A51BB9DEB06D18E30E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
BLTools v4.5.5 New.exe

File Explorer

BLTools v4.5.5 New.exe

.exe 1001KB

BLTools v4.5.5 New.exe

IMPHASH 35f2e35a9ab5b63b150853141ee62e01
SHA256 24f5ce1ed239dfbd4eb48dd160e08821d9e5489765e26212e7223838860f034d
MD5 3748f454806661f7150c15357bb724e9
SHA1 b2b96af9f219300d8f23f6d5acca97b06ec86a98
SHA512 09e5a5be1bf404f450c9da62827e6629a79a27c02534ef6ff52f13c75cf3e922adbb8eae735585cb608258688654a4d1a697e4e64982f51f2962c8aa2ff950fe
SSDEEP 24576:/iiy2LA/I0xusciua5CNEpYBRupKm7BfHgq155ppbdGax1Om5vuxZHPzQaq5Xxk8:E95vuxZHklLESqaEwX
TLSH
T1AA250242B691C0B2C4531A769879C779192FFC100F316ACBE7A51BB9DEB06D18E30E5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

66960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NO_ISOLATION IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CloseThreadpoolWork CompareStringW CreateFileW CreateThread CreateThreadpoolWork DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread FreeLibraryWhenCallbackReturns GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileSize GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SleepConditionVariableSRW SubmitThreadpoolWork TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter WaitForSingleObjectEx WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

advapi32

CryptDestroyKey CryptEncrypt

Name

.text

Size

173KB

Virtual Size

173KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

49KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.bss

Size

755KB

Virtual Size

755KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

1020B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

BLTools v4.5.5 New.exe

kernel32

advapi32

generic