C:\Git\ChromeReprompt\x64\Release\ChromeReprompt.pdb
Static task
static1
Behavioral task
behavioral1
Sample
20fab68de4d1ba8e3165c4861a1e8280N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
20fab68de4d1ba8e3165c4861a1e8280N.exe
Resource
win10v2004-20240802-en
General
-
Target
20fab68de4d1ba8e3165c4861a1e8280N.exe
-
Size
1.5MB
-
MD5
20fab68de4d1ba8e3165c4861a1e8280
-
SHA1
3792bfaffc28080a8697a6702d735366030e6217
-
SHA256
155a790a59cfa64bf30be6182180ea610e98811ced1c803f3ced68c1a6b41537
-
SHA512
e5203eee8e88500a116c07c5f485665865169db1cf5b3659cb2696684a5f3fbe7894cfe7bc64bf46615595527a9b4d8426eaf152f3a853dc725a0b83964e8e07
-
SSDEEP
24576:BKn0Djsf9nz4mloFQnpXUMPQDR6q79dA:g0DYf5zaCpXxPuR6E9dA
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 20fab68de4d1ba8e3165c4861a1e8280N.exe
Files
-
20fab68de4d1ba8e3165c4861a1e8280N.exe.exe windows:6 windows x64 arch:x64
0ecd162df0e24165408ecef0e77fec35
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
wtsapi32
WTSEnumerateSessionsW
WTSFreeMemory
msi
ord205
kernel32
ProcessIdToSessionId
GetTempPathA
GetLastError
Process32NextW
K32GetModuleBaseNameW
LockResource
Process32FirstW
HeapReAlloc
CloseHandle
RaiseException
FindResourceExW
LoadResource
FindResourceW
HeapAlloc
K32EnumProcesses
HeapDestroy
MultiByteToWideChar
GetProcAddress
LocalFree
DeleteCriticalSection
GetProcessHeap
GetModuleHandleW
K32EnumProcessModules
lstrlenW
Sleep
GetCurrentProcess
lstrcpyW
lstrcmpW
SetUnhandledExceptionFilter
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
CreateToolhelp32Snapshot
HeapSize
OpenProcess
K32GetProcessImageFileNameW
CreateFileW
InitializeCriticalSectionEx
HeapFree
SizeofResource
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
EnterCriticalSection
OutputDebugStringW
GetWindowsDirectoryW
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
IsProcessorFeaturePresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
TerminateProcess
advapi32
RegCloseKey
RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegDeleteValueW
RegQueryValueExW
OpenProcessToken
ConvertSidToStringSidW
DuplicateTokenEx
LookupAccountSidW
GetTokenInformation
shell32
SHGetSpecialFolderPathW
SHGetKnownFolderPath
msvcp140
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_CxxThrowException
__current_exception
__std_exception_destroy
__C_specific_handler
memset
memmove
__intrinsic_setjmp
wcschr
__std_terminate
wcsstr
__current_exception_context
longjmp
memcmp
memcpy
__std_exception_copy
api-ms-win-crt-string-l1-1-0
wmemcpy_s
strcat_s
wcscat_s
_wcslwr_s
wcstok
_wcsicmp
wcscpy_s
api-ms-win-crt-stdio-l1-1-0
fread
_fseeki64
fwrite
fgetc
_get_stream_buffer_pointers
fopen_s
fsetpos
__stdio_common_vfwprintf
fclose
fflush
fgetpos
setvbuf
__p__commode
fputc
_set_fmode
ungetc
api-ms-win-crt-heap-l1-1-0
_recalloc
_callnewh
calloc
_set_new_mode
free
malloc
api-ms-win-crt-convert-l1-1-0
_itow_s
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_exe
_set_app_type
_get_initial_narrow_environment
_initterm
_initialize_onexit_table
exit
_exit
_crt_atexit
_invalid_parameter_noinfo_noreturn
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
terminate
_errno
_invalid_parameter_noinfo
__p___argc
_initialize_narrow_environment
_register_onexit_function
_initterm_e
api-ms-win-crt-filesystem-l1-1-0
_lock_file
_unlock_file
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 39KB - Virtual size: 39KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 29KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1.4MB - Virtual size: 1.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE