undetected_chromedriver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
undetected_chromedriver.exe
Size 17.9MB
Sample260608-1blmtafs31
SHA256 fcdb1b74fdff1a574f1d800e325612652ffad07bceb7da5cd52d1191e76d5685
MD5 02cdb8466234f1da35b8b670e25251ac
SHA1 419b702c4528b6bb584fd4175a21c1f5c80a56f7
SHA512 aed87de93ab387bb1da671dbdda752ce2483e17446a3c16bfc05c2938ef29d6260f1578dbfc2ae9bb83f03210b262d6dfbb2ce02211cc5ad55506053ebe5cb93
SSDEEP 393216:qSemni7L7j5uEN6oWGDWPjWlbK+MHwEmQj3+BJwxDw+Vhc55KRO6kxUuD:qSeDj5uERWlrI0xp+qDoYRee
TLSH
T1A917AE02A120307CC84631B2B83DB73E7F245566576585EBAEA85CD06FBC9D2323B75B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
undetected_chromedriver.exe

File Explorer

undetected_chromedriver.exe

.exe 17.9MB

undetected_chromedriver.exe

IMPHASH f0f9d281cce446fd9ffdd3ebd8be47a2
SHA256 fcdb1b74fdff1a574f1d800e325612652ffad07bceb7da5cd52d1191e76d5685
MD5 02cdb8466234f1da35b8b670e25251ac
SHA1 419b702c4528b6bb584fd4175a21c1f5c80a56f7
SHA512 aed87de93ab387bb1da671dbdda752ce2483e17446a3c16bfc05c2938ef29d6260f1578dbfc2ae9bb83f03210b262d6dfbb2ce02211cc5ad55506053ebe5cb93
SSDEEP 393216:qSemni7L7j5uEN6oWGDWPjWlbK+MHwEmQj3+BJwxDw+Vhc55KRO6kxUuD:qSeDj5uERWlrI0xp+qDoYRee
TLSH
T1A917AE02A120307CC84631B2B83DB73E7F245566576585EBAEA85CD06FBC9D2323B75B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7685392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

chromedriver.exe.pdb

advapi32

BuildTrusteeWithSidW CheckTokenMembership ConvertStringSidToSidW CreateProcessAsUserW GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetTokenInformation InitializeAcl InitializeSecurityDescriptor IsValidAcl IsValidSecurityDescriptor IsValidSid RegCloseKey RegCreateKeyExW RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetModuleInfo64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

shlwapi

PathMatchSpecW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus KillTimer LoadKeyboardLayoutW MapVirtualKeyW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer ToUnicode TranslateMessage UnregisterClassW VkKeyScanW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEnumProtocolsW WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecv WSARecvFrom WSAResetEvent WSASend WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons inet_ntop ioctlsocket listen ntohs recv recvfrom sendto setsockopt shutdown socket

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI AssignProcessToJobObject CancelIo CancelIoEx CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreatePipe CreateProcessW CreateThread DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindFirstFileW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrencyFormatEx GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatEx GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetGeoInfoW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetNativeSystemInfo GetNumberFormatEx GetOEMCP GetPriorityClass GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatEx GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserGeoID GetVersionExW GetWindowsDirectoryW GlobalFree GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus PrefetchVirtualMemory QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW ReplaceFileW ResetEvent ResolveLocaleName RtlCaptureStackBackTrace RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadInformation SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

ntdll

NtQueryObject RtlGetLastNtStatus

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

crypt32

CertAddStoreToCollection CertCloseStore CertControlStore CertEnumCertificatesInStore CertFindCertificateInStore CertGetEnhancedKeyUsage CertOpenStore CryptProtectMemory CryptUnprotectMemory

secur32

AcquireCredentialsHandleW DeleteSecurityContext FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW QuerySecurityPackageInfoW

ncrypt

NCryptCreatePersistedKey NCryptExportKey NCryptFinalizeKey NCryptFreeObject NCryptGetProperty NCryptImportKey NCryptIsAlgSupported NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash

iphlpapi

GetAdaptersAddresses if_indextoname

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpSetTimeouts

urlmon

CoInternetCreateSecurityManager

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

Name

.text

Size

13.7MB

Virtual Size

13.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

50KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

517B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

CPADinfo

Size

512B

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

malloc_h

Size

1024B

Virtual Size

787B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

426KB

Virtual Size

425KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

undetected_chromedriver.exe

advapi32

dbghelp

shell32

shlwapi

user32

winmm

ws2_32

kernel32

ole32

ntdll

userenv

crypt32

secur32

ncrypt

iphlpapi

api-ms-win-core-winrt-l1-1-0

winhttp

urlmon

api-ms-win-core-synch-l1-2-0

generic