LockDownBrowserOEM[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

LockDownBrowserOEM.exe
Size

11.2MB
MD5

bcc9b4aa35a7bd5062da3861f2172033
SHA1

3ceba1e28bb799ebc61ae4e12d6db4a34e20a9d0
SHA256

8e9f3322da550905bd898640892415ab5787daeaafa90d28e53fa50a75015f3e
SHA512

7ea9c113192e99506a59cf54eb1ab787c36015eacfcb953f31e8eb89b3d2f24b86755ee4a578b5074f317b6b2a4f3690c2e3f95b88cbc519970fb59f8d884c20
SSDEEP

98304:KI5kwm/psoOaDcM4wC/KEfanJlCADS13tRppofRMYTwP5z74s:KuIBht40g8JD+ppofRMxlj

Score

1^/10

Malware Config

Signatures

Files

LockDownBrowserOEM.exe
.exe windows:5 windows x86 arch:x86

7d982cdd603a2c4bd18edaaa3df19c0c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

29/04/2021, 00:00

Not After

28/04/2036, 23:59

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0b:a5:fc:ce:dc:0f:6a:8a:cd:f9:25:37:1e:85:5d:c4
Certificate

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Not Before

21/08/2023, 00:00

Not After

14/09/2025, 23:59

Subject

CN=Respondus\, Inc.,O=Respondus\, Inc.,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

14/07/2023, 00:00

Not After

13/10/2034, 23:59

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

c6:7f:1b:98:f3:36:48:46:33:09:64:87:ce:9b:da:37:b2:a2:d6:d3:f2:85:3e:15:19:e6:b3:42:41:e3:5c:38
Signer

Actual PE Digest

c6:7f:1b:98:f3:36:48:46:33:09:64:87:ce:9b:da:37:b2:a2:d6:d3:f2:85:3e:15:19:e6:b3:42:41:e3:5c:38

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\VS12\LockDownChrome\Release - SDKOEM - RLDBOEM - Student\LockDownBrowserOEM.pdb

Imports

kernel32

GetVersionExW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
FreeLibrary
GetModuleFileNameW
GetModuleHandleA
LocalAlloc
LocalFree
QueryFullProcessImageNameA
WideCharToMultiByte
K32EnumProcesses
K32EnumProcessModules
K32GetModuleFileNameExA
GlobalAlloc
GlobalUnlock
GlobalLock
DecodePointer
GetFileAttributesA
WaitForSingleObject
GetSystemTimeAsFileTime
MultiByteToWideChar
GlobalAddAtomW
FlushFileBuffers
WriteConsoleW
GetFileSizeEx
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
SetEndOfFile
SetStdHandle
GetCurrentDirectoryW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
OpenProcess
TerminateProcess
ExitProcess
ReadConsoleW
GetModuleHandleExW
FreeLibraryAndExitThread
ResumeThread
ExitThread
CreateThread
GetFileType
CreateFileW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
GetFullPathNameW
GetDriveTypeW
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
RtlUnwind
GetStartupInfoW
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LoadLibraryExA
VirtualFree
VirtualAlloc
IsProcessorFeaturePresent
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
InitializeSListHead
OutputDebugStringW
IsDebuggerPresent
GetCPInfo
GetStringTypeW
LCMapStringEx
EncodePointer
InitializeCriticalSectionAndSpinCount
GetSystemDirectoryA
GetCurrentProcess
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy
GetFileSize
GetFileAttributesExA
GetFileAttributesW
FindClose
CompareFileTime
ExpandEnvironmentStringsA
GetEnvironmentVariableA
GetTimeZoneInformation
WriteFile
ReadFile
CreateFileA
GetCurrentProcessId
LoadLibraryA
CreateProcessA
CreateMutexW
CloseHandle
GetTempPathA
RemoveDirectoryA
FindNextFileA
FindFirstFileA
DeleteFileA
CreateDirectoryA
GetCommandLineW
GetSystemPowerStatus
SystemTimeToFileTime
MapViewOfFile
CreateFileMappingW
GetSystemTime
GetModuleFileNameA
GetNativeSystemInfo
ProcessIdToSessionId
GetLocalTime
GetSystemInfo
GlobalMemoryStatusEx
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetCommandLineA
GetLastError
RaiseException
FindResourceW
LockResource
LoadResource
GetTickCount
Sleep
GetStdHandle
GetCurrentThread
GetThreadContext
VirtualQuery
VirtualProtect

user32

EnumDisplayMonitors
GetMonitorInfoA
LoadImageW
LoadIconW
EnumWindows
GetForegroundWindow
LoadAcceleratorsW
MsgWaitForMultipleObjectsEx
GetAsyncKeyState
EmptyClipboard
CloseClipboard
SetWinEventHook
EnableWindow
EnumDesktopsA
GetThreadDesktop
GetWindowTextW
SetWindowTextW
SendDlgItemMessageW
PostMessageW
IsWindow
ShowWindow
GetClientRect
GetWindowThreadProcessId
EnumDisplayDevicesA
SystemParametersInfoW
GetWindowInfo
GetAncestor
OpenWindowStationA
OpenClipboard
CreateDialogParamW
PeekMessageW
GetKeyboardLayout
wsprintfW
LoadBitmapW
SetWindowPos
IsWindowVisible
GetWindowLongW
SetParent
UnregisterClassW
DialogBoxParamW
GetUserObjectInformationW
SetWindowLongW
GetMessageW
TranslateMessage
DispatchMessageW
DefWindowProcW
RegisterClassExW
CreateWindowExW
DestroyWindow
SetTimer
KillTimer
RegisterWindowMessageW
PostQuitMessage
IsChild
FillRect
MessageBoxW
GetClassNameA
GetWindowDisplayAffinity
SetWindowDisplayAffinity
MapVirtualKeyW
TranslateAcceleratorW
IsDialogMessageW
SendMessageW
CallWindowProcW
RegisterRawInputDevices
SetClipboardData
TrackMouseEvent
DrawTextA
ClientToScreen
SetRect
BeginDeferWindowPos
DeferWindowPos
EndDeferWindowPos
SetFocus
IsWindowEnabled
GetMenu
SetMenu
UpdateWindow
ScreenToClient
BeginPaint
EndPaint
SetPropW
PtInRect
NotifyWinEvent
SetDlgItemTextW
CheckRadioButton
GetDlgCtrlID
GetPropW
RemovePropW
GetDesktopWindow
FindWindowW
FindWindowExW
GetShellWindow
GetActiveWindow
MessageBoxA
GetWindowTextA
RedrawWindow
InvalidateRect
SetForegroundWindow
DrawTextW
GetSystemMetrics
GetFocus
IsDlgButtonChecked
CheckDlgButton
GetDlgItemTextA
MoveWindow
GetClassInfoExW
GetMonitorInfoW
MonitorFromWindow
GetWindow
MapWindowPoints
GetWindowRect
SetWindowTextA
SetDlgItemTextA
GetDlgItem
EndDialog
ReleaseDC
GetDC
LoadStringW
LoadCursorW
EnumChildWindows
GetParent
AdjustWindowRectEx

gdi32

SetBkColor
GetStockObject
TextOutW
MoveToEx
GetObjectW
SetTextColor
SetBkMode
SelectObject
LineTo
GetTextExtentPoint32W
DeleteDC
CreatePen
CombineRgn
CreateRectRgn
CreateSolidBrush
DeleteObject
PtInRegion
SetRectRgn
GetDeviceCaps
BitBlt
CreateCompatibleBitmap
CreateFontW
CreateCompatibleDC

comdlg32

FindTextW

advapi32

AllocateAndInitializeSid
GetTokenInformation
FreeSid
CheckTokenMembership
AdjustTokenPrivileges
OpenProcessToken
ReadEventLogW
RegCreateKeyExA
ConvertSidToStringSidA
StartServiceW
QueryServiceStatusEx
QueryServiceConfigW
OpenServiceW
OpenSCManagerW
ControlService
CloseServiceHandle
ChangeServiceConfigW
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyExA
RegCreateKeyA
RegCloseKey
CloseEventLog
OpenEventLogW
LookupPrivilegeValueW

shell32

ShellExecuteA
SHGetFolderPathW
SHGetFolderPathA

ole32

CoTaskMemFree
CoCreateInstance
CoInitializeSecurity
CoUninitialize
CoInitialize
CoInitializeEx

oleaut32

VariantChangeType
VariantClear
VariantInit
SysFreeString
SysAllocString

comctl32

ImageList_Create
ImageList_Add
ord410
ord413
_TrackMouseEvent

libcef

cef_get_min_log_level
cef_string_utf16_cmp
cef_string_ascii_to_utf16
cef_get_current_platform_thread_id
cef_string_utf16_to_utf8
cef_string_utf8_to_utf16
cef_string_utf16_clear
cef_string_utf8_clear
cef_string_utf16_set
cef_string_userfree_utf16_free
cef_string_multimap_alloc
cef_string_multimap_free
cef_request_create
cef_urlrequest_create
cef_log
cef_value_create
cef_cookie_manager_get_global_manager
cef_string_list_alloc
cef_string_list_free
cef_request_context_get_global_context
cef_request_context_create_context
cef_create_context_shared
cef_currently_on
cef_post_task
cef_execute_process
cef_initialize
cef_shutdown
cef_do_message_loop_work
cef_run_message_loop
cef_quit_message_loop
cef_crash_reporting_enabled
cef_set_crash_key_value
cef_load_crlsets_file
cef_get_mime_type
cef_base64encode
cef_uriencode
cef_api_hash
cef_browser_host_create_browser
cef_string_map_alloc
cef_string_map_free
cef_command_line_create
cef_command_line_get_global
cef_process_message_create
cef_set_osmodal_loop
cef_post_data_create
cef_post_data_element_create
cef_string_list_size
cef_string_list_value
cef_string_list_append
cef_string_map_size
cef_string_map_key
cef_string_map_value
cef_string_map_append
cef_string_multimap_size
cef_string_multimap_key
cef_string_multimap_value
cef_string_multimap_append
cef_v8context_get_current_context
cef_v8value_create_bool
cef_v8value_create_int
cef_v8value_create_string
cef_v8value_create_function
cef_shared_process_message_builder_create

wininet

HttpQueryInfoA
InternetCloseHandle
InternetOpenW
InternetQueryOptionA
InternetConnectA
InternetReadFile
HttpSendRequestA
InternetSetOptionA
HttpOpenRequestA

iphlpapi

GetAdaptersInfo

setupapi

SetupDiGetClassDevsW
SetupDiEnumDeviceInfo
SetupDiGetDeviceRegistryPropertyA

version

VerQueryValueA
GetFileVersionInfoA
GetFileVersionInfoSizeA

oleacc

LresultFromObject
AccessibleObjectFromWindow

msimg32

GradientFill

ws2_32

gethostname

wtsapi32

WTSRegisterSessionNotification
WTSUnRegisterSessionNotification

lockdownbrowser

?CLDBDoSomeStuff@@YAHPAH@Z
?CLDBDoYetMoreStuff@@YAHPAH@Z
?CLDBDoSomeOtherStuffs@@YAHPAH@Z
?CLDBDoSomeOtherStuff@@YAHPAH@Z

wintrust

WinVerifyTrust

rpcrt4

UuidCreate

shlwapi

PathFileExistsA
PathAppendA

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 321KB - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 67KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3.6MB - Virtual size: 3.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7d982cdd603a2c4bd18edaaa3df19c0c

Code Sign

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9Certificate

Extended Key Usages

Key Usages

0b:a5:fc:ce:dc:0f:6a:8a:cd:f9:25:37:1e:85:5d:c4Certificate

Extended Key Usages

Key Usages

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16Certificate

Extended Key Usages

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

c6:7f:1b:98:f3:36:48:46:33:09:64:87:ce:9b:da:37:b2:a2:d6:d3:f2:85:3e:15:19:e6:b3:42:41:e3:5c:38Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

comdlg32

advapi32

shell32

ole32

oleaut32

comctl32

libcef

wininet

iphlpapi

setupapi

version

oleacc

msimg32

ws2_32

wtsapi32

lockdownbrowser

wintrust

rpcrt4

shlwapi

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 321KB - Virtual size: 321KB

.data Size: 17KB - Virtual size: 22KB

.rsrc Size: 6.1MB - Virtual size: 6.1MB

.reloc Size: 67KB - Virtual size: 67KB

.idata Size: 13KB - Virtual size: 13KB

.text Size: 3.6MB - Virtual size: 3.6MB

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Certificate

0b:a5:fc:ce:dc:0f:6a:8a:cd:f9:25:37:1e:85:5d:c4
Certificate

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

c6:7f:1b:98:f3:36:48:46:33:09:64:87:ce:9b:da:37:b2:a2:d6:d3:f2:85:3e:15:19:e6:b3:42:41:e3:5c:38
Signer

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 321KB - Virtual size: 321KB

.data
Size: 17KB - Virtual size: 22KB

.rsrc
Size: 6.1MB - Virtual size: 6.1MB

.reloc
Size: 67KB - Virtual size: 67KB

.idata
Size: 13KB - Virtual size: 13KB

.text
Size: 3.6MB - Virtual size: 3.6MB