chrome-debloat[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
chrome-debloat.exe
Size 1.6MB
Sample260701-bbe3labx8n
SHA256 05da8ef10fa3fa2eaf930cdd7d299695a0ff7a0b37ad143d36cd9609d89c3c8a
MD5 c488a0f88faab5701ab6a8e8d179db23
SHA1 9863935462944e4526c7a9fdb03e6b9050516974
SHA512 07427e52df8b32018934df28ee4dcdd0e0df7b9eb5b371b64e5dbab162f8297144fb11f1b1a30eb66c3fc60e0e08262ce3a34562653a43b474bd19d0b73a6875
SSDEEP 24576:7Rhs7sNX+kDT9dkyMqMwqxukTABvpVp3SOzAjvzvtLK0b4+HNgXBuDVGQOCj6WYq:7RhMsNlDT/ktrlTmDrzqvpKbXce9k
TLSH
T132754A167A9A58ACD059C874830A8A636A3174CF1B36B9FF41D882353F6AEF55F3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chrome-debloat.exe

File Explorer

chrome-debloat.exe

.exe 1.6MB

chrome-debloat.exe

IMPHASH 87336966c995fdf518214d75f6a6e2ec
SHA256 05da8ef10fa3fa2eaf930cdd7d299695a0ff7a0b37ad143d36cd9609d89c3c8a
MD5 c488a0f88faab5701ab6a8e8d179db23
SHA1 9863935462944e4526c7a9fdb03e6b9050516974
SHA512 07427e52df8b32018934df28ee4dcdd0e0df7b9eb5b371b64e5dbab162f8297144fb11f1b1a30eb66c3fc60e0e08262ce3a34562653a43b474bd19d0b73a6875
SSDEEP 24576:7Rhs7sNX+kDT9dkyMqMwqxukTABvpVp3SOzAjvzvtLK0b4+HNgXBuDVGQOCj6WYq:7RhMsNlDT/ktrlTmDrzqvpKbXce9k
TLSH
T132754A167A9A58ACD059C874830A8A636A3174CF1B36B9FF41D882353F6AEF55F3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1188304

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

chrome_debloat.pdb

kernel32

FindFirstFileExW DuplicateHandle SetFileInformationByHandle SetFileTime HeapFree HeapAlloc GetFullPathNameW CloseHandle SetLastError GetFileInformationByHandle MoveFileExW LoadLibraryExA FormatMessageW GetFileInformationByHandleEx GetFileAttributesW SetFileAttributesW FreeLibrary FlushFileBuffers GetProcessHeap FindClose Sleep GetModuleHandleA DeleteFileW GetProcAddress GetLastError VirtualQuery VirtualFree VirtualAlloc GetSystemInfo GetCurrentProcessorNumber TlsFree TlsSetValue TlsAlloc SwitchToThread GetProcessTimes AcquireSRWLockExclusive ReleaseSRWLockExclusive InitializeSRWLock WriteFile GetEnvironmentVariableA GetCommandLineW GetExitCodeProcess CreateThread GetModuleFileNameW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW CompareStringOrdinal FreeEnvironmentStringsW GetModuleHandleExA CreateDirectoryW QueryPerformanceCounter GetModuleHandleW QueryPerformanceFrequency ReadFileEx WriteFileEx SleepEx HeapReAlloc WriteConsoleW MultiByteToWideChar WaitForSingleObject GetConsoleOutputCP GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetCurrentProcess LoadLibraryA WaitForSingleObjectEx GetCurrentDirectoryW RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId WriteConsoleA GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetEnvironmentStringsW GetEnvironmentVariableW SetConsoleActiveScreenBuffer GetConsoleScreenBufferInfo GetConsoleMode SetConsoleMode CreateConsoleScreenBuffer AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GlobalLock GlobalSize WideCharToMultiByte GetSystemTimePreciseAsFileTime GlobalUnlock WaitForMultipleObjects GetNumberOfConsoleInputEvents ReadConsoleInputW SetConsoleCursorInfo SetConsoleCursorPosition FillConsoleOutputCharacterA FillConsoleOutputAttribute SetConsoleTextAttribute CreateFileW

bcryptprimitives

ProcessPrng

ntdll

RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile NtOpenFile

oleaut32

SysStringLen SysFreeString

advapi32

RegCreateKeyExW RegCloseKey RegCreateKeyTransactedW RegEnumValueW RegQueryValueExW RegSetValueExW RegDeleteTreeW RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegOpenKeyTransactedW AdjustTokenPrivileges OpenProcessToken RevertToSelf ImpersonateAnonymousToken LookupPrivilegeValueA

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

GetForegroundWindow GetKeyboardLayout GetClipboardData OpenClipboard ToUnicodeEx CloseClipboard GetWindowThreadProcessId

vcruntime140

__C_specific_handler _CxxThrowException memset memmove __CxxFrameHandler3 memcpy memcmp __current_exception __current_exception_context __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

__setusermatherr round

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

__p___argc terminate _crt_atexit _register_onexit_function _initialize_onexit_table _set_app_type _configure_narrow_argv _initialize_narrow_environment _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _seh_filter_exe _get_initial_narrow_environment _exit exit _initterm_e _initterm _errno

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func _set_fmode __p__commode fputs

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-locale-l1-1-0

_configthreadlocale