crashpad_handler[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

crashpad_handler.exe
Size

781KB
MD5

6ef6090a642bd0927edc5a9c50b7f8db
SHA1

e332c3146fa086b5f12e0956d3307431a6148ff8
SHA256

e1eb08309dd8fb388431304f351b5a41c8740d6542b6390807fdaf43d5edf941
SHA512

f63667f10392c0bdd7422cf5d84246dcf4709c2ec98d59575ff5a6af5209b0be6151ecd9ef611a614aa7c15300c8eea310741a3286b6d84bb03c42c58c1c56c8
SSDEEP

24576:Fl97Qo2EXC8cvj35axyk7TVCJ0ObuxOBCu8dz7f:Fl93Cvvj35axyoTVCCObuxOBCu8d

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
crashpad_handler.exe

Files

crashpad_handler.exe
.exe windows:6 windows x64 arch:x64

e4ac116916bd2c1295f4815b2b7e13d3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jenkins\crashpad\backtrace-crashpad-build\crashpad\out\backtrace\crashpad_handler.pdb

Imports

kernel32

LockFileEx
SetEndOfFile
UnlockFileEx
GetLastError
GetStdHandle
GetFileType
CloseHandle
RaiseException
SetEvent
WaitForSingleObject
SleepEx
CreateEventW
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateThread
GetCurrentThreadId
CreateProcessW
OpenProcess
GetVersion
OutputDebugStringW
GetLocalTime
FormatMessageW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetLastError
GetModuleFileNameW
DuplicateHandle
ConnectNamedPipe
DisconnectNamedPipe
CreateIoCompletionPort
GetQueuedCompletionStatus
PostQueuedCompletionStatus
UnregisterWaitEx
GetFileAttributesW
GetFileInformationByHandleEx
VerSetConditionMask
IsWow64Process
GetModuleHandleW
FormatMessageA
VerifyVersionInfoW
FindClose
GetFileSizeEx
ReadFile
SetFilePointerEx
WriteFile
FindFirstFileExW
FindNextFileW
GetFileTime
RemoveDirectoryW
InitializeCriticalSection
GetProcAddress
LoadLibraryW
GetSystemInfo
VirtualQueryEx
ReadProcessMemory
SetNamedPipeHandleState
TransactNamedPipe
CreateNamedPipeW
WaitNamedPipeW
ReleaseSemaphore
CreateSemaphoreW
GetSystemTimeAsFileTime
LocalFree
InitOnceExecuteOnce
GetProcessTimes
SuspendThread
ResumeThread
GetProcessId
GetThreadContext
Wow64GetThreadContext
IsProcessorFeaturePresent
GetVersionExW
GetTimeZoneInformation
GetThreadLocale
GetSystemDefaultLCID
GetUserDefaultLCID
DeleteFileW
CreateFileW
CreateDirectoryW
SetConsoleCtrlHandler
SetProcessShutdownParameters
RegisterWaitForSingleObject
SetUnhandledExceptionFilter
WriteConsoleW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapSize
HeapReAlloc
GetConsoleMode
GetConsoleCP
FlushFileBuffers
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
EnumSystemLocalesW
IsValidLocale
HeapFree
HeapAlloc
GetModuleHandleExW
ExitProcess
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetFileInformationByHandle
WideCharToMultiByte
MultiByteToWideChar
EncodePointer
DecodePointer
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
ResetEvent
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
QueryPerformanceCounter
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
FreeLibrary
LoadLibraryExW
GetCommandLineA
GetCommandLineW
GetDriveTypeW

advapi32

BuildExplicitAccessWithNameW
BuildSecurityDescriptorW
RevertToSelf
ImpersonateNamedPipeClient
SystemFunction036
ConvertStringSecurityDescriptorToSecurityDescriptorW

user32

RegisterClassW
GetMessageW
TranslateMessage
DispatchMessageW
PostMessageW
DefWindowProcW
SetWindowLongPtrW
UnregisterClassW
CreateWindowExW
DestroyWindow
GetWindowLongPtrW

version

GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW

winhttp

WinHttpQueryHeaders
WinHttpCrackUrl
WinHttpOpen
WinHttpCloseHandle
WinHttpConnect
WinHttpReadData
WinHttpWriteData
WinHttpSetOption
WinHttpSetTimeouts
WinHttpOpenRequest
WinHttpAddRequestHeaders
WinHttpSendRequest
WinHttpReceiveResponse

powrprof

CallNtPowerInformation

Sections

.text
Size: 529KB - Virtual size: 528KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 203KB - Virtual size: 203KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e4ac116916bd2c1295f4815b2b7e13d3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

version

winhttp

powrprof

Sections

.text Size: 529KB - Virtual size: 528KB

.rdata Size: 203KB - Virtual size: 203KB

.data Size: 12KB - Virtual size: 18KB

.pdata Size: 30KB - Virtual size: 29KB

CPADinfo Size: 512B - Virtual size: 56B

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 529KB - Virtual size: 528KB

.rdata
Size: 203KB - Virtual size: 203KB

.data
Size: 12KB - Virtual size: 18KB

.pdata
Size: 30KB - Virtual size: 29KB

CPADinfo
Size: 512B - Virtual size: 56B

.reloc
Size: 5KB - Virtual size: 5KB