03ae3da6adc184087f223e8ed2aa3d395ad5b9c793f372828a9e3bb7ebab1754N

Sharing

Copy URL Twitter E-mail

General

Target

03ae3da6adc184087f223e8ed2aa3d395ad5b9c793f372828a9e3bb7ebab1754N
Size

779KB
MD5

89131e45c70d32f00ca88cbb94572ef0
SHA1

1af42f10a5409b5eaba751a7e9b40c392d2a1855
SHA256

03ae3da6adc184087f223e8ed2aa3d395ad5b9c793f372828a9e3bb7ebab1754
SHA512

7a5cf9b6259c18509d4ac17f2b9cf80191e2380ab1c371084462f5f3123ed2c206c616289609fdb2efc1e07eca4d834942f6533925f4ad252c212b7cad792460
SSDEEP

12288:dRPupHklwBPznfaGxS5RDrhSkBi+iXjB3ZbINNnmtMb0sBjvrEH7uf6tYjbv:dUVPzBgDrDBWYNBprEH7yv

Score

1^/10

Malware Config

Signatures

Files

03ae3da6adc184087f223e8ed2aa3d395ad5b9c793f372828a9e3bb7ebab1754N
.dll windows:5 windows x86 arch:x86

963f42d349501824bf4ce653a9f36db8

Code Sign

0e:e3:f1:c8:f4:51:cb:f2:12:03:34:1a:53:f2:3e:71
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31/01/2019, 00:00

Not After

03/02/2021, 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Acrobat DC,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18/04/2012, 12:00

Not After

18/04/2027, 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

04/01/2017, 00:00

Not After

18/01/2028, 00:00

Subject

CN=DigiCert SHA2 Timestamp Responder,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07/01/2016, 12:00

Not After

07/01/2031, 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

d1:0f:4e:e8:3f:7f:16:c0:e6:26:a2:b4:bb:c5:05:68:4e:0c:4f:2a:d5:ca:83:7f:aa:f7:89:04:95:bb:db:d0
Signer

Actual PE Digest

d1:0f:4e:e8:3f:7f:16:c0:e6:26:a2:b4:bb:c5:05:68:4e:0c:4f:2a:d5:ca:83:7f:aa:f7:89:04:95:bb:db:d0

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

chrome_elf.dll.pdb

Imports

kernel32

VerSetConditionMask
VerifyVersionInfoW
GetModuleHandleW
GetProcAddress
CreateRemoteThread
LoadLibraryExA
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
ReadConsoleW
GetDriveTypeW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
SetConsoleCtrlHandler
SetStdHandle
ExitProcess
GetConsoleMode
GetConsoleCP
GetFullPathNameW
LoadLibraryExW
InterlockedFlushSList
RtlUnwind
GetCPInfo
GetLocaleInfoW
LCMapStringW
DecodePointer
EncodePointer
GetStringTypeW
GetStartupInfoW
InitializeSListHead
IsProcessorFeaturePresent
UnhandledExceptionFilter
WaitForSingleObjectEx
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
MultiByteToWideChar
GetCurrentProcess
VirtualQuery
VirtualProtect
GetLastError
GetCommandLineW
GetEnvironmentVariableW
GetNativeSystemInfo
CreateFileW
ReadFile
CloseHandle
WaitForSingleObject
SetEvent
ReleaseMutex
CreateMutexW
DuplicateHandle
GetProcessId
GetCurrentProcessId
WideCharToMultiByte
GetTempPathW
GetModuleFileNameW
SetEnvironmentVariableW
GetFileAttributesW
CreateDirectoryW
OutputDebugStringW
LoadLibraryW
GetComputerNameExW
FreeLibrary
ReadProcessMemory
GetModuleHandleExW
WriteProcessMemory
GetLongPathNameW
VirtualProtectEx
SetLastError
OpenProcess
TerminateProcess
GetProcessTimes
HeapCreate
HeapDestroy
GetSystemTimeAsFileTime
ReleaseSRWLockExclusive
QueryPerformanceFrequency
QueryPerformanceCounter
QueryThreadCycleTime
GetCurrentThread
GetThreadPriority
SetThreadPriority
Sleep
GetThreadId
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetCurrentThreadId
TryAcquireSRWLockExclusive
AcquireSRWLockExclusive
IsDebuggerPresent
RaiseException
CreateThread
TlsGetValue
DeleteFileW
GetCurrentDirectoryW
GetLocalTime
GetTickCount
OutputDebugStringA
WriteFile
FormatMessageA
TlsAlloc
TlsFree
TlsSetValue
SetFilePointerEx
SetEndOfFile
LockFileEx
UnlockFileEx
FlushFileBuffers
SetUnhandledExceptionFilter
RtlCaptureStackBackTrace
GetVersionExW
GetSystemInfo
RemoveDirectoryW
CreateEventW
SwitchToThread
FindClose
FindNextFileW
FindFirstFileExW
ResetEvent
GetStdHandle
CreateProcessW
SleepEx
GetVersion
GetFileType
WaitNamedPipeW
SetNamedPipeHandleState
TransactNamedPipe
CreateNamedPipeW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection

Exports

Exports

AddDllToBlacklist
ClearReportsBetween_ExportThunk
CrashForException_ExportThunk
DisableHook
DrainLog
DumpHungProcessWithPtype_ExportThunk
DumpProcessWithoutCrash
GetApplyHookResult
GetBlockedModulesCount
GetCrashReports_ExportThunk
GetCrashpadDatabasePath_ExportThunk
GetHandleVerifier
GetInstallDetailsPayload
GetUniqueBlockedModulesCount
GetUserDataDirectoryThunk
InjectDumpForHungInput_ExportThunk
IsBlacklistInitialized
IsCrashReportingEnabledImpl
RegisterLogNotification
RequestSingleCrashUpload_ExportThunk
SetCrashKeyValueImpl
SetMetricsClientId
SetUploadConsent_ExportThunk
SignalChromeElf
SignalInitializeCrashReporting
SuccessfullyBlocked

Sections

.text
Size: 460KB - Virtual size: 460KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 106KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 104KB - Virtual size: 118KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.crthunk
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CPADinfo
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

963f42d349501824bf4ce653a9f36db8

Code Sign

0e:e3:f1:c8:f4:51:cb:f2:12:03:34:1a:53:f2:3e:71Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41Certificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

d1:0f:4e:e8:3f:7f:16:c0:e6:26:a2:b4:bb:c5:05:68:4e:0c:4f:2a:d5:ca:83:7f:aa:f7:89:04:95:bb:db:d0Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

Exports

Exports

Sections

.text Size: 460KB - Virtual size: 460KB

.rdata Size: 106KB - Virtual size: 106KB

.data Size: 104KB - Virtual size: 118KB

.crthunk Size: 512B - Virtual size: 64B

CPADinfo Size: 512B - Virtual size: 40B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 20KB - Virtual size: 20KB

0e:e3:f1:c8:f4:51:cb:f2:12:03:34:1a:53:f2:3e:71
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

09:c0:fc:46:c8:04:42:13:b5:59:8b:af:28:4f:4e:41
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

d1:0f:4e:e8:3f:7f:16:c0:e6:26:a2:b4:bb:c5:05:68:4e:0c:4f:2a:d5:ca:83:7f:aa:f7:89:04:95:bb:db:d0
Signer

.text
Size: 460KB - Virtual size: 460KB

.rdata
Size: 106KB - Virtual size: 106KB

.data
Size: 104KB - Virtual size: 118KB

.crthunk
Size: 512B - Virtual size: 64B

CPADinfo
Size: 512B - Virtual size: 40B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 20KB - Virtual size: 20KB