chromedriver[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
chromedriver.exe
Size 19.1MB
Sample260720-3qj4msg16p
SHA256 cc3e04f6f7386150e9c10c29db6591f9e57997f5ae3dded59ef8986036b9b33d
MD5 a96a1f04d7c47c1b5577dcb1c35e704c
SHA1 d20e54b7b9d83567d0f0396044dff318f49ee151
SHA512 65454309863c6573205046dbdac2f4ee998d8669209992fe8b8f2b28d572ba9ea6c0805f7444c3d9b7150f448879ccf582a9f74ff9e721bba66bb7a928a9408b
SSDEEP 196608:Hchc0DTBDr25vOWXSy2Y+br47nLg3mPKp9DgModRv:HsZnA5k06GnLgUo9DgModRv
TLSH
T1A5177C13F29551E9E04DC4798B1A5232EA71BC490B35A2DF1A502B922F7FED47B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chromedriver.exe

File Explorer

chromedriver.exe

.exe 19.1MB

chromedriver.exe

IMPHASH c97d9e0b64658301bbd6129f2b8d323d
SHA256 cc3e04f6f7386150e9c10c29db6591f9e57997f5ae3dded59ef8986036b9b33d
MD5 a96a1f04d7c47c1b5577dcb1c35e704c
SHA1 d20e54b7b9d83567d0f0396044dff318f49ee151
SHA512 65454309863c6573205046dbdac2f4ee998d8669209992fe8b8f2b28d572ba9ea6c0805f7444c3d9b7150f448879ccf582a9f74ff9e721bba66bb7a928a9408b
SSDEEP 196608:Hchc0DTBDr25vOWXSy2Y+br47nLg3mPKp9DgModRv:HsZnA5k06GnLgUo9DgModRv
TLSH
T1A5177C13F29551E9E04DC4798B1A5232EA71BC490B35A2DF1A502B922F7FED47B3DB20
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7779808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

chromedriver.exe.pdb

advapi32

BuildTrusteeWithSidW CheckTokenMembership ConvertStringSidToSidW CreateProcessAsUserW GetLengthSid GetNamedSecurityInfoW GetSecurityDescriptorControl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorOwner GetSecurityDescriptorSacl GetTokenInformation InitializeAcl InitializeSecurityDescriptor IsValidAcl IsValidSecurityDescriptor IsValidSid RegCloseKey RegCreateKeyExW RegEnumKeyExW RegNotifyChangeKeyValue RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW SetEntriesInAclW SetNamedSecurityInfoW SetSecurityDescriptorDacl SetSecurityInfo

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymGetSearchPathW SymInitialize SymSetOptions SymSetSearchPathW

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

shlwapi

PathMatchSpecW

user32

AllowSetForegroundWindow CreateWindowExW DefWindowProcW DestroyWindow DispatchMessageW GetActiveWindow GetQueueStatus KillTimer LoadKeyboardLayoutW MapVirtualKeyW MsgWaitForMultipleObjectsEx PeekMessageW PostMessageW PostQuitMessage RegisterClassExW SetTimer ToUnicode TranslateMessage UnregisterClassW VkKeyScanW

winmm

timeBeginPeriod timeEndPeriod timeGetTime

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEnumProtocolsW WSAEventSelect WSAGetLastError WSAGetOverlappedResult WSAIoctl WSARecv WSARecvFrom WSAResetEvent WSASend WSASendTo WSASocketW WSAStartup accept bind closesocket connect freeaddrinfo getaddrinfo gethostname getpeername getsockname getsockopt htonl htons inet_ntop ioctlsocket listen ntohs recv recvfrom sendto setsockopt shutdown socket

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AreFileApisANSI AssignProcessToJobObject CancelIo CancelIoEx CloseHandle CompareStringW ConnectNamedPipe CreateDirectoryW CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreatePipe CreateProcessW CreateThread DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrencyFormatEx GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatEx GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetDynamicTimeZoneInformation GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFullPathNameA GetFullPathNameW GetGeoInfoW GetHandleInformation GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNamedPipeServerProcessId GetNativeSystemInfo GetNumberFormatEx GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProcessTimes GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadId GetThreadPriority GetThreadPriorityBoost GetTickCount GetTimeFormatEx GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserGeoID GetVersionExW GetWindowsDirectoryW GlobalFree GlobalMemoryStatusEx HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InitializeSRWLock InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus PrefetchVirtualMemory QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile RegisterWaitForSingleObject ReleaseSRWLockExclusive ReleaseSRWLockShared RemoveDirectoryW ReplaceFileW ResetEvent ResolveLocaleName ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileCompletionNotificationModes SetFileInformationByHandle SetFilePointer SetFilePointerEx SetFileTime SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadInformation SetThreadPriority SetThreadPriorityBoost SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection TzSpecificLocalTimeToSystemTime UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

ole32

CoInitializeEx CoRegisterInitializeSpy CoRevokeInitializeSpy CoTaskMemFree CoUninitialize

ntdll

NtQueryInformationThread NtQueryObject RtlGetLastNtStatus

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

crypt32

CertAddStoreToCollection CertCloseStore CertControlStore CertEnumCertificatesInStore CertFindCertificateInStore CertGetEnhancedKeyUsage CertOpenStore CryptProtectMemory CryptUnprotectMemory

secur32

AcquireCredentialsHandleW DeleteSecurityContext FreeContextBuffer FreeCredentialsHandle InitializeSecurityContextW QueryContextAttributesW QuerySecurityPackageInfoW

ncrypt

NCryptCreatePersistedKey NCryptExportKey NCryptFinalizeKey NCryptFreeObject NCryptGetProperty NCryptImportKey NCryptIsAlgSupported NCryptOpenKey NCryptOpenStorageProvider NCryptSignHash

iphlpapi

GetAdaptersAddresses if_indextoname

api-ms-win-core-winrt-l1-1-0

RoInitialize RoUninitialize

winhttp

WinHttpCloseHandle WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpSetTimeouts

urlmon

CoInternetCreateSecurityManager

Name

.text

Size

14.0MB

Virtual Size

14.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

102KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

412KB

Virtual Size

412KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

729B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

malloc_h

Size

512B

Virtual Size

195B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

60KB

Virtual Size

60KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

chromedriver.exe

advapi32

dbghelp

shell32

shlwapi

user32

winmm

ws2_32

kernel32

ole32

ntdll

userenv

crypt32

secur32

ncrypt

iphlpapi

api-ms-win-core-winrt-l1-1-0

winhttp

urlmon

generic