General

Malware Config

Signatures

Files

• ChromeSetup.exe

  .exe windows:10 windows x86 arch:x86

  89d93d1def4eb097be8ee6ac79cc84db

  
  

  Code Sign

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:44:18:e2:de:de:36:dd:29:74:c3:44:3a:fb:5c:e5

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  02-07-2021 00:00

  Not After

  10-07-2024 23:59

  Subject

  CN=Google LLC,O=Google LLC,L=Mountain View,ST=California,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  01

  Certificate

  Issuer

  CN=Dummy issuer

  Not Before

  01-01-2013 10:00

  Not After

  01-04-2013 10:00

  Subject

  CN=Dummy certificate

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  89:ba:bb:5e:6d:29:c0:08:18:e3:de:1c:fa:0e:70:dc:e8:17:15:38:05:d9:31:88:f3:a9:4f:a9:c7:db:f2:19

  Signer

  Actual PE Digest

  89:ba:bb:5e:6d:29:c0:08:18:e3:de:1c:fa:0e:70:dc:e8:17:15:38:05:d9:31:88:f3:a9:4f:a9:c7:db:f2:19

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_GUARD_CF

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\b\s\w\ir\cache\builder\src\out\Release\UpdaterSetup.exe.pdb

  Imports

  advapi32

  AddAce

  AllocateAndInitializeSid

  BuildTrusteeWithSidW

  ChangeServiceConfigW

  CheckTokenMembership

  CloseServiceHandle

  ConvertSidToStringSidW

  ConvertStringSidToSidW

  CopySid

  CreateProcessAsUserW

  CreateServiceW

  DeleteService

  DuplicateTokenEx

  EqualSid

  FreeSid

  GetAce

  GetAclInformation

  GetLengthSid

  GetNamedSecurityInfoW

  GetSecurityDescriptorControl

  GetSecurityDescriptorDacl

  GetSecurityDescriptorGroup

  GetSecurityDescriptorLength

  GetSecurityDescriptorOwner

  GetSecurityDescriptorSacl

  GetSecurityInfo

  GetSidIdentifierAuthority

  GetSidLengthRequired

  GetSidSubAuthority

  GetSidSubAuthorityCount

  GetTokenInformation

  GetTraceEnableFlags

  GetTraceEnableLevel

  GetTraceLoggerHandle

  ImpersonateLoggedOnUser

  InitializeAcl

  InitializeSecurityDescriptor

  InitializeSid

  IsValidAcl

  IsValidSecurityDescriptor

  IsValidSid

  LookupAccountSidW

  MakeAbsoluteSD

  MakeSelfRelativeSD

  OpenProcessToken

  OpenSCManagerW

  OpenServiceW

  OpenThreadToken

  QueryServiceConfigW

  RegCloseKey

  RegCreateKeyExW

  RegDeleteKeyExW

  RegDeleteValueW

  RegEnumKeyExW

  RegEnumValueW

  RegOpenKeyExW

  RegQueryInfoKeyW

  RegQueryValueExW

  RegSetValueExW

  RegisterTraceGuidsW

  RevertToSelf

  SetEntriesInAclW

  SetNamedSecurityInfoW

  SetSecurityDescriptorDacl

  SetSecurityDescriptorGroup

  SetSecurityDescriptorOwner

  SetSecurityInfo

  TraceEvent

  UnregisterTraceGuids

  dbghelp

  SymCleanup

  SymFromAddr

  SymGetLineFromAddr64

  SymGetSearchPathW

  SymInitialize

  SymSetOptions

  SymSetSearchPathW

  oleaut32

  LoadTypeLi

  SafeArrayAccessData

  SafeArrayCreateVector

  SafeArrayDestroy

  SafeArrayGetDim

  SafeArrayGetLBound

  SafeArrayGetUBound

  SafeArrayGetVartype

  SafeArrayUnaccessData

  SysAllocString

  SysAllocStringByteLen

  SysAllocStringLen

  SysFreeString

  SysStringLen

  SystemTimeToVariantTime

  VariantClear

  shell32

  CommandLineToArgvW

  ord680

  SHGetFolderPathW

  SHGetKnownFolderPath

  ShellExecuteExW

  user32

  AllowSetForegroundWindow

  CharUpperW

  CreateWindowExW

  DestroyWindow

  GetActiveWindow

  GetClientRect

  GetMonitorInfoW

  GetParent

  GetWindow

  GetWindowLongW

  GetWindowRect

  MapWindowPoints

  MessageBoxExW

  MonitorFromWindow

  SetForegroundWindow

  SetWindowPos

  UnregisterClassW

  kernel32

  AcquireSRWLockExclusive

  AcquireSRWLockShared

  AssignProcessToJobObject

  CloseHandle

  CompareStringW

  CopyFileW

  CreateDirectoryW

  CreateEventW

  CreateFileA

  CreateFileMappingW

  CreateFileW

  CreateMutexW

  CreateProcessW

  CreateToolhelp32Snapshot

  DecodePointer

  DeleteCriticalSection

  DeleteFileW

  DeleteProcThreadAttributeList

  DuplicateHandle

  EncodePointer

  EnterCriticalSection

  EnumResourceNamesW

  EnumSystemLocalesW

  ExitProcess

  ExpandEnvironmentStringsW

  FileTimeToLocalFileTime

  FileTimeToSystemTime

  FindClose

  FindFirstFileExW

  FindNextFileW

  FindResourceW

  FlushFileBuffers

  FlushViewOfFile

  FormatMessageW

  FreeEnvironmentStringsW

  FreeLibrary

  GetACP

  GetCPInfo

  GetCommandLineA

  GetCommandLineW

  GetComputerNameW

  GetConsoleMode

  GetConsoleOutputCP

  GetCurrentDirectoryW

  GetCurrentProcess

  GetCurrentProcessId

  GetCurrentThread

  GetCurrentThreadId

  GetDateFormatW

  GetDiskFreeSpaceExW

  GetDriveTypeW

  GetEnvironmentStringsW

  GetEnvironmentVariableW

  GetExitCodeProcess

  GetFileAttributesExW

  GetFileAttributesW

  GetFileInformationByHandle

  GetFileSizeEx

  GetFileType

  GetFullPathNameW

  GetLastError

  GetLocalTime

  GetLocaleInfoW

  GetLongPathNameW

  GetModuleFileNameW

  GetModuleHandleA

  GetModuleHandleExW

  GetModuleHandleW

  GetNativeSystemInfo

  GetOEMCP

  GetProcAddress

  GetProcessHeap

  GetProcessId

  GetProcessMitigationPolicy

  GetProcessTimes

  GetProductInfo

  GetStartupInfoW

  GetStdHandle

  GetStringTypeW

  GetSystemDirectoryW

  GetSystemInfo

  GetSystemTimeAsFileTime

  GetTempPathW

  GetThreadPreferredUILanguages

  GetThreadPriority

  GetTickCount

  GetTimeFormatW

  GetTimeZoneInformation

  GetUserDefaultLCID

  GetUserPreferredUILanguages

  GetVersionExW

  GetWindowsDirectoryW

  GlobalAlloc

  GlobalFree

  GlobalMemoryStatusEx

  HeapAlloc

  HeapDestroy

  HeapFree

  HeapReAlloc

  HeapSetInformation

  HeapSize

  InitOnceExecuteOnce

  InitializeCriticalSectionAndSpinCount

  InitializeCriticalSectionEx

  InitializeProcThreadAttributeList

  InitializeSListHead

  InitializeSRWLock

  InterlockedPushEntrySList

  IsDebuggerPresent

  IsProcessorFeaturePresent

  IsValidCodePage

  IsValidLocale

  IsWow64Process

  LCMapStringW

  LeaveCriticalSection

  LoadLibraryExA

  LoadLibraryExW

  LoadLibraryW

  LoadResource

  LocalFree

  LockFileEx

  LockResource

  MapViewOfFile

  MoveFileExW

  MoveFileW

  MultiByteToWideChar

  OpenProcess

  OutputDebugStringA

  OutputDebugStringW

  Process32FirstW

  Process32NextW

  ProcessIdToSessionId

  QueryFullProcessImageNameW

  QueryPerformanceCounter

  QueryPerformanceFrequency

  QueryThreadCycleTime

  RaiseException

  ReadConsoleW

  ReadFile

  ReleaseMutex

  ReleaseSRWLockExclusive

  ReleaseSRWLockShared

  RemoveDirectoryW

  ReplaceFileW

  ResetEvent

  RtlCaptureStackBackTrace

  RtlUnwind

  SetCurrentDirectoryW

  SetEndOfFile

  SetEnvironmentVariableW

  SetEvent

  SetFileAttributesW

  SetFileInformationByHandle

  SetFilePointer

  SetFilePointerEx

  SetFileTime

  SetHandleInformation

  SetLastError

  SetProcessWorkingSetSize

  SetStdHandle

  SetThreadInformation

  SetThreadPriority

  SetUnhandledExceptionFilter

  SizeofResource

  Sleep

  SleepConditionVariableSRW

  SystemTimeToFileTime

  SystemTimeToTzSpecificLocalTime

  TerminateProcess

  TlsAlloc

  TlsFree

  TlsGetValue

  TlsSetValue

  TryAcquireSRWLockExclusive

  TzSpecificLocalTimeToSystemTime

  UnhandledExceptionFilter

  UnlockFileEx

  UnmapViewOfFile

  UnregisterWaitEx

  UpdateProcThreadAttribute

  VerSetConditionMask

  VerifyVersionInfoW

  VirtualAlloc

  VirtualFree

  VirtualProtect

  VirtualQuery

  WTSGetActiveConsoleSessionId

  WaitForSingleObject

  WakeAllConditionVariable

  WideCharToMultiByte

  WriteConsoleW

  WriteFile

  lstrcmpiW

  ole32

  CoAddRefServerProcess

  CoCreateInstance

  CoImpersonateClient

  CoInitializeEx

  CoRegisterClassObject

  CoRegisterInitializeSpy

  CoReleaseServerProcess

  CoResumeClassObjects

  CoRevertToSelf

  CoRevokeClassObject

  CoRevokeInitializeSpy

  CoSetProxyBlanket

  CoTaskMemFree

  CoUninitialize

  IIDFromString

  StringFromGUID2

  secur32

  GetUserNameExW

  wtsapi32

  WTSEnumerateSessionsW

  WTSFreeMemory

  WTSQuerySessionInformationW

  userenv

  CreateEnvironmentBlock

  DestroyEnvironmentBlock

  EnterCriticalPolicySection

  LeaveCriticalPolicySection

  UnloadUserProfile

  winhttp

  WinHttpAddRequestHeaders

  WinHttpCloseHandle

  WinHttpConnect

  WinHttpGetProxyForUrl

  WinHttpOpen

  WinHttpOpenRequest

  WinHttpQueryHeaders

  WinHttpReadData

  WinHttpReceiveResponse

  WinHttpSendRequest

  WinHttpSetOption

  WinHttpSetStatusCallback

  shlwapi

  ord437

  PathMatchSpecW

  ntdll

  NtDeleteKey

  winmm

  timeGetTime

  Exports

  Exports

  GetHandleVerifier

  Sections

  .text

  Size: 2.7MB - Virtual size: 2.7MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 586KB - Virtual size: 586KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 19KB - Virtual size: 95KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .tls

  Size: 512B - Virtual size: 269B

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 5.0MB - Virtual size: 5.0MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 88KB - Virtual size: 87KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ