Static task
static1
Behavioral task
behavioral1
Sample
chromedump.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
chromedump.exe
Resource
win10v2004-20240910-en
General
-
Target
chromedump.exe
-
Size
660KB
-
MD5
e468cade55308ee32359e2d1a88506ef
-
SHA1
278eb15a04c93a90f3f5ef7f88641f0f41fac5bc
-
SHA256
f618e9fa05c392501fb76415d64007225fe20baddc9f1a2dcc9ff3599473a8eb
-
SHA512
82fef308bc65616efb77b3f97ff7fcd14623a3955d18a9afff5c086d85d0f2e6856468ad992da2fb01aae6488afb0c0cdb80744cc20d74d3af851f35d30947d6
-
SSDEEP
12288:oymg4BvDLjNSwO+ocal447iMaNHH8WpKG23J5qIspRQ8RzIA7t80xVJW:oyUvDLJvO+0ldi5B8WpKG2ZYICQyIelo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource chromedump.exe
Files
-
chromedump.exe.exe windows:6 windows x86 arch:x86
23166a43462b7b4cedcdb2671cf7e0b6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
UnmapViewOfFile
CreateFileA
LoadLibraryA
CloseHandle
GetProcAddress
GetFileSize
FreeLibrary
MapViewOfFile
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
HeapValidate
HeapSize
MultiByteToWideChar
LocalFree
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetLastError
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
WaitForSingleObjectEx
DeleteFileW
HeapReAlloc
GetSystemInfo
LoadLibraryW
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LockFileEx
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
WideCharToMultiByte
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
DecodePointer
DeleteFileA
CopyFileA
SetCurrentDirectoryA
WriteConsoleW
GetConsoleCP
GetStringTypeW
SetStdHandle
Sleep
GetShortPathNameA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
RaiseException
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetStdHandle
GetModuleFileNameW
ExitProcess
GetCommandLineA
GetCommandLineW
CompareStringW
LCMapStringW
GetFileType
SetEnvironmentVariableW
SetFilePointerEx
GetConsoleMode
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
advapi32
ImpersonateLoggedOnUser
LogonUserA
shell32
SHGetSpecialFolderPathA
shlwapi
PathFileExistsA
crypt32
CryptUnprotectData
Sections
.text Size: 574KB - Virtual size: 573KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 63KB - Virtual size: 62KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ