chromedriver[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

chromedriver.rar
Size

23.4MB
MD5

51c62c5d3b41b24df76caa407e6b226a
SHA1

5bfd73402c05131d1681e0c496abc3c1cf7b0ae6
SHA256

231747a4a443c20821ddb0bd7b2e76ec733ebd0f6406f9d81de13f2b3d13284c
SHA512

6a160131605b38c1a49febf02468d6bf90ec68f76d3710d7d3f05388756e1057172fcd484b466d4b891dd0b4cb29933f2f9dfbce602385a3d6a3b96ec4a1bab5
SSDEEP

393216:/Ude4nBqiKM6Aqh1N4u+UkjE1as3x7qZvi00ERXpTAh7gbKuTrfmqm61:/AeUq5M6Aq+z5E1a/U09fTAh7dQORc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/chromedriver.exe

Files

chromedriver.rar
.rar

Password: 1
chromedriver.exe
.exe windows:6 windows x64

Password: 1

764ed3d92fd3b9427dddf31734a161ae

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

RtlGetVersion
RtlCaptureStackBackTrace
RtlUnwindEx
RtlAddFunctionTable
VerSetConditionMask
RtlVirtualUnwind
RtlDeleteFunctionTable
RtlUnwind
RtlCaptureContext
RtlLookupFunctionEntry
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
RtlPcToFileHeader

iphlpapi

GetAdaptersAddresses

advapi32

SystemFunction036
RegEnumKeyExW
RegQueryInfoKeyW
EventWriteTransfer
EventSetInformation
EventRegister
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

kernel32

ResetEvent
WaitForMultipleObjects
SetConsoleCursorPosition
LockFileEx
SetConsoleMode
UnlockFile
GetACP
lstrlenW
IsValidCodePage
OpenProcess
WaitForSingleObject
SetLastError
GetFullPathNameW
GetLastError
DeviceIoControl
FreeEnvironmentStringsW
GetExitCodeProcess
GetConsoleScreenBufferInfo
CreateFileA
SetStdHandle
GetHandleInformation
AddVectoredExceptionHandler
SetThreadStackGuarantee
HeapAlloc
GetProcessHeap
HeapFree
HeapReAlloc
LoadLibraryExW
GetFileInformationByHandleEx
GetConsoleMode
AcquireSRWLockShared
ReleaseSRWLockShared
WakeAllConditionVariable
SleepConditionVariableSRW
GlobalUnlock
GetStringTypeW
GetProcAddress
Sleep
GetFileSizeEx
GetConsoleOutputCP
EnumSystemLocalesW
GetUserDefaultLCID
GetCurrentProcessId
SetCurrentDirectoryW
FindClose
IsValidLocale
WriteConsoleInputW
PeekConsoleInputW
FlushConsoleInputBuffer
GetLocaleInfoW
GlobalMemoryStatusEx
GetTickCount64
LCMapStringW
TerminateProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
SetThreadErrorMode
FreeLibrary
SetErrorMode
LoadLibraryW
FormatMessageW
CreateEventA
CompareStringW
TryAcquireSRWLockShared
SetFileTime
CloseHandle
UnmapViewOfFile
GetSystemInfo
VirtualProtect
CreateFileMappingW
MapViewOfFile
TryAcquireSRWLockExclusive
GetQueuedCompletionStatusEx
CreateIoCompletionPort
SetFileCompletionNotificationModes
GetTimeFormatW
GetDateFormatW
FlsFree
GetCommandLineA
GetCPInfo
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
EncodePointer
WaitForSingleObjectEx
CreateFileW
CreateSemaphoreW
CancelIo
ReadDirectoryChangesW
ReleaseSemaphore
CreatePipe
GetModuleHandleA
SetFileInformationByHandle
WakeConditionVariable
GetConsoleCursorInfo
SetConsoleCursorInfo
InterlockedPushEntrySList
ReleaseSRWLockExclusive
GlobalSize
WideCharToMultiByte
ReadConsoleInputW
WriteConsoleW
FillConsoleOutputCharacterA
FillConsoleOutputAttribute
GetFileInformationByHandle
AcquireSRWLockExclusive
GetStartupInfoW
InitializeSListHead
GetCurrentThread
GetCurrentDirectoryW
LoadLibraryA
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
GetEnvironmentStringsW
GetModuleHandleW
SetEnvironmentVariableW
GetTempPathW
GetModuleFileNameW
GetCommandLineW
SetFilePointerEx
FlushFileBuffers
GetFinalPathNameByHandleW
FindNextFileW
CreateDirectoryW
FindFirstFileW
ReadConsoleW
SetEvent
InitializeCriticalSectionAndSpinCount
GetCurrencyFormatEx
SetHandleInformation
IsProcessorFeaturePresent
UnhandledExceptionFilter
RaiseException
ResolveLocaleName
ResumeThread
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
DuplicateHandle
GetCurrentProcess
GetOverlappedResult
CreateEventW
ReadFile
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
DeleteFileW
MoveFileExW
RemoveDirectoryW
CreateSymbolicLinkW
CreateHardLinkW
SetFileAttributesW
CopyFileExW
RegisterWaitForSingleObject
UnregisterWaitEx
GetProcessId
PostQueuedCompletionStatus
SetConsoleCtrlHandler
GetStdHandle
RemoveVectoredExceptionHandler
SetConsoleTextAttribute
VirtualAlloc
VirtualFree
VirtualQuery
GetTickCount
FormatMessageA
GetSystemTime
SystemTimeToFileTime
GetFileSize
LocalFree
HeapDestroy
HeapCompact
DeleteFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
MultiByteToWideChar
HeapSize
HeapValidate
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
GetLocaleInfoEx
IsDebuggerPresent
GetThreadContext
GetTimeZoneInformation
GetTempFileNameA
GetFileType
VerifyVersionInfoW
MapViewOfFileEx
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
QueryThreadCycleTime
GetThreadPriority
SetThreadPriority
InitOnceExecuteOnce
FlsAlloc
FlsGetValue
FlsSetValue
SetUnhandledExceptionFilter
SwitchToThread
GetOEMCP
GetNumberFormatEx
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetDateFormatEx
GetTimeFormatEx
GetNumberOfConsoleInputEvents
GlobalLock
GetNativeSystemInfo
GetDynamicTimeZoneInformation
GetUserGeoID
GetGeoInfoW
CreateSemaphoreA
InitializeConditionVariable
OpenThread
SuspendThread
FindFirstFileExW

crypt32

CertFreeCertificateContext
CertCloseStore
CertOpenStore
CertEnumCertificatesInStore
CertGetEnhancedKeyUsage
CertDuplicateCertificateContext

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

user32

OpenClipboard
GetClientRect
CloseClipboard
MapVirtualKeyW
GetClipboardData

ws2_32

setsockopt
WSASocketW
getaddrinfo
freeaddrinfo
recvfrom
sendto
getpeername
getsockopt
shutdown
connect
accept
socket
WSAIoctl
recv
WSAStartup
GetHostNameW
send
ioctlsocket
WSAGetLastError
listen
bind
closesocket
WSASend
getsockname
WSARecv
WSACleanup

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

d3dcompiler_47

D3DCompile

winmm

timeGetTime

dbghelp

SymSetSearchPathW
SymInitialize
SymGetModuleBase64
SymFunctionTableAccess64
StackWalk64
SymGetLineFromAddr64
SymGetSearchPathW
SymFromAddr
SymSetOptions

psapi

GetPerformanceInfo
GetProcessMemoryInfo

Exports

Exports

CrashForExceptionInNonABICompliantCodeRange
napi_acquire_threadsafe_function
napi_add_env_cleanup_hook
napi_add_finalizer
napi_adjust_external_memory
napi_async_destroy
napi_async_init
napi_call_function
napi_call_threadsafe_function
napi_cancel_async_work
napi_close_callback_scope
napi_close_escapable_handle_scope
napi_close_handle_scope
napi_coerce_to_bool
napi_coerce_to_number
napi_coerce_to_object
napi_coerce_to_string
napi_create_array
napi_create_array_with_length
napi_create_arraybuffer
napi_create_async_work
napi_create_bigint_int64
napi_create_bigint_uint64
napi_create_bigint_words
napi_create_buffer
napi_create_buffer_copy
napi_create_dataview
napi_create_date
napi_create_double
napi_create_error
napi_create_external
napi_create_external_arraybuffer
napi_create_external_buffer
napi_create_function
napi_create_int32
napi_create_int64
napi_create_object
napi_create_promise
napi_create_range_error
napi_create_reference
napi_create_string_latin1
napi_create_string_utf16
napi_create_string_utf8
napi_create_symbol
napi_create_threadsafe_function
napi_create_type_error
napi_create_typedarray
napi_create_uint32
napi_define_class
napi_define_properties
napi_delete_async_work
napi_delete_element
napi_delete_property
napi_delete_reference
napi_detach_arraybuffer
napi_escape_handle
napi_fatal_error
napi_fatal_exception
napi_get_all_property_names
napi_get_and_clear_last_exception
napi_get_array_length
napi_get_arraybuffer_info
napi_get_boolean
napi_get_buffer_info
napi_get_cb_info
napi_get_dataview_info
napi_get_date_value
napi_get_element
napi_get_global
napi_get_instance_data
napi_get_last_error_info
napi_get_named_property
napi_get_new_target
napi_get_node_version
napi_get_null
napi_get_property
napi_get_property_names
napi_get_prototype
napi_get_reference_value
napi_get_threadsafe_function_context
napi_get_typedarray_info
napi_get_undefined
napi_get_uv_event_loop
napi_get_value_bigint_int64
napi_get_value_bigint_uint64
napi_get_value_bigint_words
napi_get_value_bool
napi_get_value_double
napi_get_value_external
napi_get_value_int32
napi_get_value_int64
napi_get_value_string_latin1
napi_get_value_string_utf16
napi_get_value_string_utf8
napi_get_value_uint32
napi_get_version
napi_has_element
napi_has_named_property
napi_has_own_property
napi_has_property
napi_instanceof
napi_is_array
napi_is_arraybuffer
napi_is_buffer
napi_is_dataview
napi_is_date
napi_is_detached_arraybuffer
napi_is_error
napi_is_exception_pending
napi_is_promise
napi_is_typedarray
napi_make_callback
napi_module_register
napi_new_instance
napi_object_freeze
napi_object_seal
napi_open_callback_scope
napi_open_escapable_handle_scope
napi_open_handle_scope
napi_queue_async_work
napi_ref_threadsafe_function
napi_reference_ref
napi_reference_unref
napi_reject_deferred
napi_release_threadsafe_function
napi_remove_env_cleanup_hook
napi_remove_wrap
napi_resolve_deferred
napi_run_script
napi_set_element
napi_set_instance_data
napi_set_named_property
napi_set_property
napi_strict_equals
napi_throw
napi_throw_error
napi_throw_range_error
napi_throw_type_error
napi_typeof
napi_unref_threadsafe_function
napi_unwrap
napi_wrap
node_api_create_syntax_error
node_api_get_module_file_name
node_api_throw_syntax_error

Sections

.text
Size: 39.5MB - Virtual size: 39.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 25.7MB - Virtual size: 25.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 173KB - Virtual size: 297KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 192KB - Virtual size: 191KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: 1

Password: 1

764ed3d92fd3b9427dddf31734a161ae

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

iphlpapi

advapi32

kernel32

crypt32

shell32

ole32

user32

ws2_32

bcrypt

d3dcompiler_47

winmm

dbghelp

psapi

Exports

Exports

Sections

.text Size: 39.5MB - Virtual size: 39.5MB

.rdata Size: 25.7MB - Virtual size: 25.7MB

.data Size: 173KB - Virtual size: 297KB

.pdata Size: 1.6MB - Virtual size: 1.6MB

_RDATA Size: 512B - Virtual size: 348B

.rsrc Size: 109KB - Virtual size: 108KB

.reloc Size: 192KB - Virtual size: 191KB

.text
Size: 39.5MB - Virtual size: 39.5MB

.rdata
Size: 25.7MB - Virtual size: 25.7MB

.data
Size: 173KB - Virtual size: 297KB

.pdata
Size: 1.6MB - Virtual size: 1.6MB

_RDATA
Size: 512B - Virtual size: 348B

.rsrc
Size: 109KB - Virtual size: 108KB

.reloc
Size: 192KB - Virtual size: 191KB