chromedriver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
chromedriver.exe
Size 11.8MB
Sample260702-a7ambaaw61
SHA256 814973581e9795c22bf392a8f027fa84664096627055e32ffc4ed7baf47f0951
MD5 e980c15159cb718c6e9c1525d0c4376e
SHA1 6c709d4c6e5110b0cee2a0a2e39b7d509e6bec9b
SHA512 b92e0a4e433e997438e57c1e9d48914409d54f713d13091a20d06e03ae3d3fc5269ca4c49b0eb2170fcd97c092cce76481dbeb18e222be92de4c90e30efd3eb9
SSDEEP 196608:dP2bAW/BzlfyU7O9cgWtz8LrpHRxlx6XDa9QYArrF91HtDxXoB83ukuaReIvQWU5:dP2kWZxfrGc7tz8LrpHRxlx6XDa9QYAK
TLSH
T145C6BF02B96161F5C84230F2782DBB3E6B34466787B146DBE9A97CD06F745D1323A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chromedriver.exe

File Explorer

chromedriver.exe

.exe 11.8MB

chromedriver.exe

IMPHASH b5044d2e15ec938753af9304bbe4958e
SHA256 814973581e9795c22bf392a8f027fa84664096627055e32ffc4ed7baf47f0951
MD5 e980c15159cb718c6e9c1525d0c4376e
SHA1 6c709d4c6e5110b0cee2a0a2e39b7d509e6bec9b
SHA512 b92e0a4e433e997438e57c1e9d48914409d54f713d13091a20d06e03ae3d3fc5269ca4c49b0eb2170fcd97c092cce76481dbeb18e222be92de4c90e30efd3eb9
SSDEEP 196608:dP2bAW/BzlfyU7O9cgWtz8LrpHRxlx6XDa9QYArrF91HtDxXoB83ukuaReIvQWU5:dP2kWZxfrGc7tz8LrpHRxlx6XDa9QYAK
TLSH
T145C6BF02B96161F5C84230F2782DBB3E6B34466787B146DBE9A97CD06F745D1323A38B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5144752

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\b\s\w\ir\cache\builder\src\out\Release\chromedriver.exe.pdb

advapi32

BuildTrusteeWithSidW ConvertStringSecurityDescriptorToSecurityDescriptorW ConvertStringSidToSidW CreateProcessAsUserW EventRegister EventSetInformation EventUnregister EventWrite GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl InitializeAcl InitializeSecurityDescriptor IsValidAcl IsValidSecurityDescriptor IsValidSid RegCloseKey RegCreateKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo SystemFunction036

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus GetWindowLongW KillTimer LoadKeyboardLayoutW MapVirtualKeyW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer SetWindowLongW ToUnicode TranslateMessage UnregisterClassW VkKeyScanW

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecvFrom WSAResetEvent WSASend WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons inet_ntop ioctlsocket listen ntohs recv recvfrom sendto setsockopt shutdown socket

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AssignProcessToJobObject CancelIo CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateProcessW CreateThread DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW GlobalFree GlobalMemoryStatusEx InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32QueryWorkingSetEx LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW ReplaceFileW ResetEvent RtlCaptureStackBackTrace RtlUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

iphlpapi

GetAdaptersAddresses

winmm

timeBeginPeriod timeEndPeriod timeGetTime

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

shell32

CommandLineToArgvW ord680 SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

shlwapi

PathMatchSpecW

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

secur32

AcquireCredentialsHandleW DeleteSecurityContext FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW QuerySecurityPackageInfoW

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpSetTimeouts

urlmon

CoInternetCreateSecurityManager

crypt32

CertAddStoreToCollection CertCloseStore CertControlStore CertFindCertificateInStore CertGetEnhancedKeyUsage CertOpenStore

dhcpcsvc

DhcpCApiInitialize DhcpRequestParams

Name

.text

Size

8.5MB

Virtual Size

8.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.0MB

Virtual Size

3.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

512B

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

449B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

malloc_h

Size

512B

Virtual Size

185B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

286KB

Virtual Size

286KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

chromedriver.exe

advapi32

dbghelp

user32

ws2_32

kernel32

iphlpapi

winmm

userenv

shell32

shlwapi

ole32

secur32

winhttp

urlmon

crypt32

dhcpcsvc

generic