home

Selection Tools.exe

Selection Tools

NOSIBAY

The application Selection Tools.exe by NOSIBAY has been detected as a potentially unwanted program by 1 anti-malware scanner with very strong indications that the file is a potential threat. It is set to automatically start when a user logs into Windows via the current user run registry key under the display name ‘Selection Tools’. This file is typically installed with the program Selection Tools by Nosibay which is a potentially unwanted software program.
Publisher:
NOSIBAY  (signed and verified)

Product:
Selection Tools

Version:
3.1.59

MD5:
e47acd26a055e9fb6023c312383df7cd

SHA-1:
7e772eeb705a4af04cd335fe6dd92a0e492e9434

SHA-256:
392b16dc837388791c99b561b30c54e5eec826f7b278ba64d5c5b01b6aaf0490

Scanner detections:
1 / 68

Status:
Potentially unwanted

Note:
Our current pool of anti-malware engines have not currently detected this file, however based on our own detection heuristics we feel that this file is unwanted.

Analysis date:
12/23/2024 12:25:50 PM UTC  (today)

Scan engine
Detection
Engine version

Reason Heuristics
PUP (M)
17.2.27.5

File size:
3.1 MB (3,259,152 bytes)

Product version:
3.1.59

Copyright:
(c) Copyright, All reproduction and distribution rights reserved to Nosibay

Original file name:
Selection Tools.exe

File type:
Executable application (Win32 EXE)

Language:
French (France)

Common path:
C:\users\{user}\appdata\roaming\wtools\selection tools\selection tools.exe

Digital Signature
Signed by:
NOSIBAY

Authority:
Thawte, Inc.

Valid from:
9/25/2014 2:00:00 AM

Valid to:
12/26/2015 12:59:59 AM

Subject:
CN=NOSIBAY, OU=Secure Application Development, O=NOSIBAY, L=PEROLS, S=Hérault, C=FR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
52E368957AD1C7202A103C7CFD7BD6C2

File PE Metadata
Compilation timestamp:
11/17/2015 3:25:13 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
12.0

Entry address:
0x20E8DB

Entry point:
E8, 21, 1B, 01, 00, E9, 00, 00, 00, 00, 6A, 14, 68, 10, 7B, 6D, 00, E8, 1F, 4B, 00, 00, E8, 33, FA, 00, 00, 0F, B7, F0, 6A, 02, E8, B4, 1A, 01, 00, 59, B8, 4D, 5A, 00, 00, 66, 39, 05, 00, 00, 40, 00, 74, 04, 33, DB, EB, 33, A1, 3C, 00, 40, 00, 81, B8, 00, 00, 40, 00, 50, 45, 00, 00, 75, EB, B9, 0B, 01, 00, 00, 66, 39, 88, 18, 00, 40, 00, 75, DD, 33, DB, 83, B8, 74, 00, 40, 00, 0E, 76, 09, 39, 98, E8, 00, 40, 00, 0F, 95, C3, 89, 5D, E4, E8, 4A, E1, 00, 00, 85, C0, 75, 08, 6A, 1C, E8, DC, 00, 00, 00, 59, E8...
 
[+]

Code size:
2.4 MB (2,479,616 bytes)

Startup File (User Run)
Registry location:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
Selection Tools

Command:
"C:\users\{user}\appdata\roaming\wtools\selection tools\selection tools.exe" \winstartup


The file Selection Tools.exe has been discovered within the following program.

Selection Tools  by Nosibay
Selection Tools is a potentially unwanted program.
About 63% of users remove it
 
Powered by Should I Remove It?

Remove Selection Tools.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.