ChedotSetup_x642JJW4[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ChedotSetup_x642JJW4.exe
Size

981KB
MD5

ba22fb9d80693a87e93fdd24076b454a
SHA1

a96aff68737ea54f8320e7b372d9c1a040f6739c
SHA256

511f043135cd13efd87fd3d893e0a4ae8248a11aa3f0c5bb6f264c962d04c721
SHA512

482409c8451bcaf81592bc19470e9f7a9daad5aed02696ebe0ebd088745c1ef3cb3e73daf7d806ee36de90da9718635ef289357cc86f8609d1d18d9016798e1b
SSDEEP

12288:G3BxPmuW7ECxjjVKlxKE/z3mqxV7W3ZKvcBt6mFw0es4xHq46RbNMUp3401g5kUR:GYEMKCqxc07MQs39RbNBIu1rBm

Score

1^/10

Malware Config

Signatures

Files

ChedotSetup_x642JJW4.exe
.exe windows:5 windows x86 arch:x86

129d3c09d6cfc1e5f76f8d9f902cd95b

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/01/2021, 00:00

Not After

06/01/2031, 00:00

Subject

CN=DigiCert Timestamp 2021,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

08:14:17:b7:d1:42:88:60:b6:a0:ef:26:92:6e:00:0c
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

21/06/2020, 00:00

Not After

26/06/2023, 12:00

Subject

CN=Guerrilla Programming OÜ,O=Guerrilla Programming OÜ,L=Tallinn,C=EE

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

22/10/2013, 12:00

Not After

22/10/2028, 12:00

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

68:46:e7:19:1d:0e:40:8d:a6:84:e5:de:87:e0:16:a6:68:21:0a:05
Signer

Actual PE Digest

68:46:e7:19:1d:0e:40:8d:a6:84:e5:de:87:e0:16:a6:68:21:0a:05

Digest Algorithm

sha1

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Projects\chedot_installer\Release\chedot-installer.pdb

Imports

kernel32

SetErrorMode
GetCurrentDirectoryW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
GetUserDefaultLCID
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
WriteConsoleW
SetEnvironmentVariableA
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
GetFileTime
GetDriveTypeW
ReadConsoleW
SetFilePointerEx
GetConsoleMode
GetConsoleCP
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
GetTimeFormatW
GetDateFormatW
ExitProcess
GetStdHandle
HeapQueryInformation
GetFileType
SetStdHandle
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
GetCommandLineW
GetCommandLineA
RtlUnwind
GetCPInfo
LCMapStringW
GetStringTypeW
SwitchToThread
OutputDebugStringW
GetFileSizeEx
GetFileAttributesExW
GetFileAttributesW
LocalReAlloc
GlobalHandle
GlobalReAlloc
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSection
CompareStringW
GlobalFindAtomW
GetSystemDirectoryW
EncodePointer
GlobalAddAtomW
WritePrivateProfileStringW
GetPrivateProfileStringW
GetPrivateProfileIntW
ResumeThread
SuspendThread
SetThreadPriority
CreateEventW
SetEvent
GetCurrentProcessId
lstrcmpW
lstrcmpA
GlobalDeleteAtom
GetVersionExW
GetCurrentThreadId
GetCurrentThread
LocalAlloc
FreeLibrary
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
FindNextFileW
FileTimeToLocalFileTime
LoadLibraryA
LoadLibraryExW
GetCurrentProcess
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
CreateFileW
FormatMessageW
MulDiv
LocalFree
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LoadLibraryW
GetModuleHandleA
GetModuleFileNameW
OutputDebugStringA
GetACP
GetProcessHeap
DeleteCriticalSection
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
HeapSize
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
EnterCriticalSection
HeapFree
FreeResource
SetLastError
GetSystemTime
RemoveDirectoryW
DeleteFileW
ReadFile
PeekNamedPipe
CreatePipe
CloseHandle
WaitForSingleObject
CreateProcessW
CreateDirectoryW
GetTempPathW
VerifyVersionInfoW
VerSetConditionMask
GetLocaleInfoW
GetSystemDefaultLCID
GetLastError
WideCharToMultiByte
GetProcAddress
GetModuleHandleW
MultiByteToWideChar
FindResourceW
LoadResource
LockResource
SizeofResource
FindFirstFileExW
Sleep

user32

RemovePropW
GetPropW
SetPropW
GetScrollPos
GetForegroundWindow
UpdateWindow
SetMenu
GetMenu
GetCapture
GetDlgCtrlID
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
IsChild
IsMenu
CreateWindowExW
GetClassInfoExW
GetClassInfoW
RegisterClassW
CallWindowProcW
DefWindowProcW
GetMessageTime
GetMessagePos
RegisterWindowMessageW
CallNextHookEx
SetWindowsHookExW
GetCursorPos
ValidateRect
GetKeyState
IsWindowVisible
GetWindowTextW
DispatchMessageW
TranslateMessage
GetMessageW
SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetFocus
ScreenToClient
ClientToScreen
EndPaint
BeginPaint
EnableWindow
LoadIconW
MoveWindow
SetWindowLongW
ReleaseDC
GetDC
TabbedTextOutW
GrayStringW
DrawTextExW
DrawTextW
GetLastActivePopup
GetWindowThreadProcessId
IsWindowEnabled
GetActiveWindow
GetNextDlgTabItem
GetDlgItem
EndDialog
CreateDialogIndirectParamW
DestroyWindow
PostQuitMessage
PostMessageW
GetDesktopWindow
CharUpperW
AdjustWindowRectEx
MapWindowPoints
CopyRect
PtInRect
GetClassLongW
GetClassNameW
GetTopWindow
GetWindow
UnhookWindowsHookEx
WinHelpW
MonitorFromWindow
PeekMessageW
GetMonitorInfoW
GetWindowLongW
SetWindowPos
MessageBoxW
IsIconic
GetSystemMetrics
GetClientRect
DrawIcon
FillRect
ShowWindow
SetTimer
KillTimer
SetForegroundWindow
SetFocus
SetActiveWindow
BringWindowToTop
LoadBitmapW
GetWindowRect
GetParent
InvalidateRect
TrackMouseEvent
LoadCursorW
SetCursor
GetWindowModuleFileNameW
EnumWindows
RedrawWindow
GetSysColor
IsWindow
UnregisterClassW
SendDlgItemMessageA
SetRectEmpty
OffsetRect
SetWindowTextW
IsDialogMessageW
GetSysColorBrush
RealChildWindowFromPoint
SendMessageW
GetSubMenu
GetMenuItemID
GetMenuItemCount
DestroyMenu

gdi32

PtVisible
RectVisible
RestoreDC
SaveDC
SelectClipRgn
SetBkColor
SetBkMode
SetMapMode
SetTextColor
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
GetClipBox
Escape
DeleteObject
CreateSolidBrush
CreateBitmap
GetDeviceCaps
DeleteDC
CreateRectRgn
BitBlt
CreateCompatibleDC
GetStockObject
SelectObject
GetObjectW
CreateFontIndirectW

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

CryptDestroyHash
RegOpenKeyExW
RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegDeleteKeyW
CryptGetHashParam
RegCloseKey
CryptHashData
CryptReleaseContext
CryptCreateHash
CryptAcquireContextW
RegCreateKeyExW
RegQueryValueExW
RegSetValueExW
RegDeleteValueW

shell32

ShellExecuteW
SHGetFolderPathW

comctl32

InitCommonControlsEx

shlwapi

PathIsUNCW
PathStripToRootW
UrlUnescapeW
PathFindExtensionW
PathFindFileNameW
PathAppendW

ole32

CoTaskMemFree
CreateStreamOnHGlobal
CoUninitialize
CoCreateGuid
CoCreateInstance
CoInitialize

oleaut32

VariantChangeType
VariantClear
VariantInit
SysAllocString
SysFreeString

gdiplus

GdiplusStartup
GdipCreateFromHDC
GdipLoadImageFromStream
GdipFree
GdipAlloc
GdipCloneImage
GdipDisposeImage
GdiplusShutdown
GdipDeleteGraphics
GdipDrawImageRectI

wininet

InternetGetConnectedState
InternetCanonicalizeUrlW
InternetCrackUrlW
InternetOpenUrlW
InternetSetFilePointer
InternetWriteFile
InternetQueryDataAvailable
InternetQueryOptionW
InternetGetLastResponseInfoW
InternetSetStatusCallbackW
FtpCommandW
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
InternetOpenW
InternetConnectW
InternetCloseHandle
FtpSetCurrentDirectoryW
FtpOpenFileW
FtpFindFirstFileW
InternetReadFile

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 409KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 133KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 390KB - Virtual size: 389KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

129d3c09d6cfc1e5f76f8d9f902cd95b

Code Sign

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:ddCertificate

Extended Key Usages

Key Usages

08:14:17:b7:d1:42:88:60:b6:a0:ef:26:92:6e:00:0cCertificate

Extended Key Usages

Key Usages

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

68:46:e7:19:1d:0e:40:8d:a6:84:e5:de:87:e0:16:a6:68:21:0a:05Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

comctl32

shlwapi

ole32

oleaut32

gdiplus

wininet

oleacc

Sections

.text Size: 409KB - Virtual size: 409KB

.rdata Size: 133KB - Virtual size: 132KB

.data Size: 12KB - Virtual size: 24KB

.rsrc Size: 390KB - Virtual size: 389KB

.reloc Size: 30KB - Virtual size: 29KB

0d:42:4a:e0:be:3a:88:ff:60:40:21:ce:14:00:f0:dd
Certificate

08:14:17:b7:d1:42:88:60:b6:a0:ef:26:92:6e:00:0c
Certificate

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

68:46:e7:19:1d:0e:40:8d:a6:84:e5:de:87:e0:16:a6:68:21:0a:05
Signer

.text
Size: 409KB - Virtual size: 409KB

.rdata
Size: 133KB - Virtual size: 132KB

.data
Size: 12KB - Virtual size: 24KB

.rsrc
Size: 390KB - Virtual size: 389KB

.reloc
Size: 30KB - Virtual size: 29KB