» selection tools update.exe
Overview
Analysis
File Details
Behaviors (1)
Programs (1)

selection tools update.exe

Selection Tools

NOSIBAY

The application selection tools update.exe, “Selection Tools Updater” by NOSIBAY has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. It runs as a scheduled task under the Windows Task Scheduler triggered daily at a specified time. This file is typically installed with the program Selection Tools by Nosibay which is a potentially unwanted software program.

File name:

Publisher:

NOSIBAY (signed and verified)

Product:

Selection Tools

Description:

Selection Tools Updater

Version:

3.1.57.0.63970

MD5:

63a95378dcfe7a5a8f01046cbc7308c4

SHA-1:

8f260edaf3e3252e21521c6f9f2003cb032718c2

SHA-256:

aac08c74456ee2687d17910a6ee81b004c4d8df92c72d6758271eacbebac2cd9

Scanner detections:

1 / 68

Status:

Potentially unwanted

Note:

Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:

11/22/2024 8:08:36 PM UTC (today)

Scan engine

Detection

Engine version

Reason Heuristics

PUP (M)

16.11.16.10

File size:

161.3 KB (165,184 bytes)

File type:

Executable application (Win32 EXE)

Installer:

NSIS (Nullsoft Scriptable Install System)

Language:

Language Neutral

Common path:

C:\users\{user}\appdata\roaming\wtools\selection tools\selection tools update.exe

Digital Signature

Signed by:

NOSIBAY

Authority:

Thawte, Inc.

Valid from:

9/24/2014 8:00:00 PM

Valid to:

12/25/2015 6:59:59 PM

Subject:

CN=NOSIBAY, OU=Secure Application Development, O=NOSIBAY, L=PEROLS, S=Hérault, C=FR

Issuer:

CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:

52E368957AD1C7202A103C7CFD7BD6C2

File PE Metadata

Compilation timestamp:

12/5/2009 5:50:46 PM

OS version:

4.0

OS bitness:

Win32

Subsystem:

Windows GUI

Linker version:

6.0

CTPH (ssdeep):

3072:qQIURTXJ345wICmYO0zhxSFGaprkyJV0FP+US3:qsFRIUhxSFbBkyJVI2U+

Entry address:

0x323C

Entry point:

81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 58, 3F, 42, 00, E8, 09, 2C, 00, 00, A3, A4, 3E, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 58, F4, 41, 00, FF, 15, 58, 71, 40, 00, 68, B8, 91, 40, 00, 68, A0, 36, 42, 00, E8, BC, 28, 00, 00, FF, 15, B0, 70, 40, 00, BF, 00, 90, 42, 00, 50, 57, E8, AA, 28, 00, 00... 
[+]

Entropy:

7.7302

Packer / compiler:

Nullsoft install system v2.x

Code size:

23 KB (23,552 bytes)

Scheduled Task

Task name:

Selection Tools Update

Trigger:

Daily (Runs daily at 5:40 AM)

The file selection tools update.exe has been discovered within the following program.

Selection Tools by Nosibay

Selection Tools is a potentially unwanted program.

About 63% of users remove it

Remove selection tools update.exe - Powered by Reason Core Security

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.