The MTool exe (nwjs) The NW js Community File Malware Analysis

The MTool.exe (nwjs) File Analysis

Updated 1 day ago

Checked by Malware Check

MTool.exe

Hash Type	Value	Action
MD5	d2b65e462b2356d11c477aebf075d78f
SHA1	ac42f368424e80290810b59ee1564f3184fa198e
SHA256	53743686de6a767ae44ea3931c908393debd86dae7654f2aa8a26c34e48d3bfb
SHA512	5cdd9939296f11e0b559eb85ce95ed701d5ee3480d11a2864ccf8db426a5a02f5878ded43074840282fd464ff9f5fcedfe30e7b4100b7f0cf0214f811d7e475d
ImpHash	bc7574156c6926b8efba6a7c3cd07de7

Hash Type

Value

Action

MD5

d2b65e462b2356d11c477aebf075d78f

SHA1

ac42f368424e80290810b59ee1564f3184fa198e

SHA256

53743686de6a767ae44ea3931c908393debd86dae7654f2aa8a26c34e48d3bfb

SHA512

5cdd9939296f11e0b559eb85ce95ed701d5ee3480d11a2864ccf8db426a5a02f5878ded43074840282fd464ff9f5fcedfe30e7b4100b7f0cf0214f811d7e475d

ImpHash

bc7574156c6926b8efba6a7c3cd07de7

PE Analysis

Basic Information

▼

Icon	Hash: c78ea2e284ddc9feb131b0bb9b0335f2 Fuzzy: 359bb7409f6d66c2043431322b378e73 dHash: 70f0b23319aecc70
Image Base	`0x140000000`
Entry Point	`0x14014c9d0`
Compilation Time	2020-10-04 05:00:00
Checksum	0x00000000 (Actual: 0x00259047)
OS Version	5.2
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
PDB Path	`nw.exe.pdb`
Digital Signature	No valid SignedData structure was found.
Imports	3 libraries nw_elf, KERNEL32, VERSION
Exports	4 functions
Resources	62 Resources
Sections	14 Sections

Version Information

▼

CompanyName	The NW.js Community
FileDescription	nwjs
FileVersion	0.67.1
InternalName	nw_exe
LegalCopyright	Copyright 2020, The NW.js community and The Chromium Authors. All rights reserved.
OriginalFilename	nw.exe
ProductName	nwjs
ProductVersion	0.67.1
CompanyShortName	nwjs.io
ProductShortName	nwjs
LastChange	62f83a7521ae1f32e563795732dff0c9da1b660d-refs/heads/master@{#812354}
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`.text`	`0x00001000`	1,593,388 bytes	1,593,856 bytes	6.58 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`A9A6776561056368510828558FD780BB`
`.rdata`	`0x00187000`	329,900 bytes	330,240 bytes	5.53 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`33EDE661E6C65FF24D3F6D97F3983A46`
`.data`	`0x001d8000`	42,512 bytes	15,872 bytes	3.37 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`365FEDA648D213E38338827AB49193A6`
`.pdata`	`0x001e3000`	57,444 bytes	57,856 bytes	6.07 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`B5F0DFD22BBFA317E87715931ECF9F9E`
`.00cfg`	`0x001f2000`	40 bytes	512 bytes	0.43 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`EBCEEF116BD267624BC9D7BBE491D889`
`.gxfg`	`0x001f3000`	11,488 bytes	11,776 bytes	5.16 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`C97D788E458F9ADE7F221906741447DA`
`.retplne`	`0x001f6000`	128 bytes	512 bytes	1.24 (Normal)	`0x00000000`	`D0C1C42539CD3883E9204A2468F4817C`
`.tls`	`0x001f7000`	305 bytes	512 bytes	0.14 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`9AA06F145D2598570C21005B86668587`
`.voltbl`	`0x001f8000`	68 bytes	512 bytes	1.14 (Normal)	`0x00000000`	`A596ACE00344A4353F556BC517A7E489`
`CPADinfo`	`0x001f9000`	56 bytes	512 bytes	0.12 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`60D3EA61D541C9BE2E845D2787FB9574`
`_RDATA`	`0x001fa000`	244 bytes	512 bytes	2.45 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`497300F7D556A7D1D8B2F0FBED69D78D`
`malloc_h`	`0x001fb000`	326 bytes	512 bytes	4.67 (Normal)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`D544B33399052336D504CA1E17D63B87`
`.rsrc`	`0x001fc000`	379,392 bytes	379,392 bytes	4.71 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ`	`ED67A522360174EE11055D7297F54CAE`
`.reloc`	`0x00259000`	8,460 bytes	8,704 bytes	5.41 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_DISCARDABLE\|IMAGE_SCN_MEM_READ`	`605ACEB3ECBB81AE25A6FB6BB4A54E6E`

Entropy Analysis Alert

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 62 (375,859 bytes)

Resource Type	Count	Total Size	Percentage
GOOGLEUPDATEAPPLICATIONCOMMANDS	1	4 bytes	0%
RT_CURSOR	23	56,516 bytes	15%
RT_ICON	12	316,655 bytes	84.2%
RT_GROUP_CURSOR	21	448 bytes	0.1%
RT_GROUP_ICON	3	186 bytes	0%
RT_VERSION	1	1,072 bytes	0.3%
RT_MANIFEST	1	978 bytes	0.3%

Certificate Chain Analysis

▼

Certificate Information

Product	nwjs
Description	nwjs
File Version	0.67.1
Original Name	nw.exe
Internal Name	nw_exe
Copyright	Copyright 2020, The NW.js community and The Chromium Authors. All rights reserved.

✓ This file has been digitally signed and the certificate chain has been verified

The signature ensures file integrity and authenticity from the publisher
Timestamping proves when the signature was applied

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	MTool.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.219.174
Database Version	2025-06-25 16:00:30 UTC

The MTool.exe (nwjs) File Analysis

Technical Analysis

Clean File

Scan Another File

File Identification