Chrome_Driver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Chrome_Driver.exe
Size 2.3MB
Sample240508-ymw7kscf2s
SHA256 b32c6a34e772913041c7a44f915714626c6f106546d818eeb00cb8c890fdbf8b
MD5 b34af55798ad8d2c069ccd79b170c3d2
SHA1 5d65e100fe121dc297fc4450526a912bfd8622f2
SHA512 5e293f05245a4cbcd08225e2fe03a2963ac890b20d4c51fe9be15135a79d39d070fb90b78d8e73c5d63f18ac09a449d04a322b8ee7312b10dfdb59dead8cb044
SSDEEP 49152:Avfi6YH2rW9DScg7ES0ErvgpnnuQX1wwuL1u:cf9hWqEClB1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Chrome_Driver.exe

File Explorer

Chrome_Driver.exe

.exe 2.3MB

Chrome_Driver.exe

IMPHASH 7fb4a92eeef17e3a61a07d92b07ec22d
SHA256 b32c6a34e772913041c7a44f915714626c6f106546d818eeb00cb8c890fdbf8b
MD5 b34af55798ad8d2c069ccd79b170c3d2
SHA1 5d65e100fe121dc297fc4450526a912bfd8622f2
SHA512 5e293f05245a4cbcd08225e2fe03a2963ac890b20d4c51fe9be15135a79d39d070fb90b78d8e73c5d63f18ac09a449d04a322b8ee7312b10dfdb59dead8cb044
SSDEEP 49152:Avfi6YH2rW9DScg7ES0ErvgpnnuQX1wwuL1u:cf9hWqEClB1
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

824212

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\aviax\Music\aaa\x64\Build\BatLabs.pdb

kernel32

SleepEx GetSystemDirectoryA VerifyVersionInfoA GetTickCount MoveFileExA WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx ReleaseSRWLockExclusive AcquireSRWLockExclusive GlobalAlloc SleepConditionVariableSRW RtlCaptureContext EnterCriticalSection RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId LocalFree FormatMessageA GetModuleHandleW GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW MultiByteToWideChar Module32NextW Module32FirstW CloseHandle Process32FirstW Process32NextW GetModuleFileNameA GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap GetLastError HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy CreateDirectoryA QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA GetModuleHandleA GlobalUnlock LeaveCriticalSection WideCharToMultiByte GlobalLock RtlLookupFunctionEntry GlobalFree Sleep CreateToolhelp32Snapshot OpenProcess GetStdHandle SetConsoleTextAttribute SetLastError GetConsoleScreenBufferInfo SetConsoleTitleW ReadProcessMemory WakeAllConditionVariable WriteProcessMemory

user32

GetWindowThreadProcessId GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos MessageBoxW GetClientRect SetCursor SetCapture GetSystemMetrics TrackMouseEvent ClientToScreen GetCapture ScreenToClient RegisterClassExA EnumWindows FindWindowA ReleaseCapture SetWindowLongA GetDesktopWindow SetWindowLongW LoadIconW TranslateMessage SetLayeredWindowAttributes CreateWindowExA DefWindowProcA MoveWindow MessageBoxA GetAsyncKeyState LoadCursorW mouse_event PeekMessageW GetForegroundWindow GetWindowLongW GetWindow GetWindowRect DestroyWindow SetWindowPos ShowWindow DispatchMessageW

msvcp140

?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?id@?$ctype@_W@std@@2V0locale@2@A ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?id@?$ctype@D@std@@2V0locale@2@A ?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

d3d9

Direct3DCreate9Ex

d3dx9_43

D3DXMatrixTranspose D3DXVec3Transform

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmSetCandidateWindow ImmGetContext ImmSetCompositionWindow

normaliz

IdnToAscii

wldap32

ord46 ord217 ord60 ord301 ord45 ord211 ord50 ord41 ord22 ord26 ord27 ord32 ord33 ord35 ord79 ord30 ord200 ord143

crypt32

CertFreeCertificateChainEngine CertFreeCertificateChain CertGetCertificateChain CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CryptStringToBinaryA PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringA CryptQueryObject CertCreateCertificateChainEngine

ws2_32

ntohl gethostname sendto recvfrom freeaddrinfo getaddrinfo select __WSAFDIsSet ioctlsocket listen htonl accept WSACleanup WSAStartup WSAIoctl WSASetLastError socket setsockopt ntohs getsockopt getsockname getpeername connect bind WSAGetLastError send recv closesocket htons

rpcrt4

UuidCreate RpcStringFreeA UuidToStringA

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler __current_exception memcmp memchr memset strchr strstr __std_terminate memmove __std_exception_copy __std_exception_destroy strrchr _CxxThrowException memcpy __current_exception_context

api-ms-win-crt-heap-l1-1-0

calloc _callnewh _set_new_mode malloc realloc free

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function system _crt_atexit _initialize_onexit_table _get_initial_narrow_environment _getpid _errno _register_thread_local_exe_atexit_callback _c_exit _invalid_parameter_noinfo_noreturn _cexit terminate _resetstkoflw __p___argv _invalid_parameter_noinfo __p___argc __sys_nerr strerror _configure_narrow_argv _exit _seh_filter_exe _set_app_type exit _initterm_e _initterm _initialize_narrow_environment _beginthreadex

api-ms-win-crt-stdio-l1-1-0

fopen_s __stdio_common_vfprintf fgets _pclose __stdio_common_vsscanf _popen _wfopen fputc _set_fmode fflush fseek ftell _get_stream_buffer_pointers _fseeki64 fread __acrt_iob_func fsetpos ungetc setvbuf fgetpos fopen __stdio_common_vsprintf __p__commode fwrite _lseeki64 fread_s feof _read fgetc _open _close fclose _write fputs

api-ms-win-crt-math-l1-1-0

fmodf _dclass __setusermatherr cosf ceilf atan2f acosf pow powf sqrtf sinf _dsign

api-ms-win-crt-string-l1-1-0

strncmp strcspn strncpy _wcsicmp strcmp _strdup isupper strpbrk tolower strspn

api-ms-win-crt-convert-l1-1-0

strtoll strtol strtoul atoi atof strtoull strtod

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_lock_file _stat64 _unlock_file _unlink _access _fstat64 _mkdir

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64

advapi32

CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA ConvertSidToStringSidA IsValidSid GetTokenInformation GetLengthSid CopySid OpenProcessToken