google[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
google.exe
Size 4.9MB
Sample260928-pma5nstdlh
SHA256 38545e8c5d9f98af07de3dc037e2a50ada7a57d3ef43281f946e3087ffd357b2
MD5 8cc7271aae2ed6504dd6d4e539172a6f
SHA1 e04af907402b9de1b458a417b1e3e06846ecb06f
SHA512 59b954d3b628b2b3e8ba1698cbb20df3f41af93b179c7bcc56ca79b08b86e63621486f207564015bc205da1dba261db0775829f1ec67dd015adceb67170c861e
SSDEEP 98304:AI/ZY7YIn34My0BgNnkf7xQ33tChyyj3hrfC/PYglvP6p/aZ+Bos2SGX3G:AGS7YTMy0BgNnFtSyyj3hNg3whos27m
TLSH
T17336331BB792946CC507C23848C38AB1FA35BC945B36AF3FA065CEB54D11DC1E5A8B36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
google.exe

File Explorer

google.exe

.exe 4.9MB

google.exe

IMPHASH 9a66a4928f793d4f509002298076c178
SHA256 38545e8c5d9f98af07de3dc037e2a50ada7a57d3ef43281f946e3087ffd357b2
MD5 8cc7271aae2ed6504dd6d4e539172a6f
SHA1 e04af907402b9de1b458a417b1e3e06846ecb06f
SHA512 59b954d3b628b2b3e8ba1698cbb20df3f41af93b179c7bcc56ca79b08b86e63621486f207564015bc205da1dba261db0775829f1ec67dd015adceb67170c861e
SSDEEP 98304:AI/ZY7YIn34My0BgNnkf7xQ33tChyyj3hrfC/PYglvP6p/aZ+Bos2SGX3G:AGS7YTMy0BgNnFtSyyj3hNg3whos27m
TLSH
T17336331BB792946CC507C23848C38AB1FA35BC945B36AF3FA065CEB54D11DC1E5A8B36
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

6c:04:da:27:ef:7a:30:b4:89:51:ee:3f:a2:c8:d2:88:78:7e:04:aa:43:df:ee:12:8d:72:d2:c6:7f:ff:40:3f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Google LLC

Chains

Sep 25, 2026

CN=Google LLC

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW DeleteService GetTokenInformation OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegDeleteTreeW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileW CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FindResourceA GetCPInfo GetCommandLineW GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileSize GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetTempPathA GetTempPathW GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LockResource Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess Process32FirstW Process32NextW ProcessIdToSessionId QueryFullProcessImageNameW ReadFile RemoveDirectoryW RemoveVectoredExceptionHandler SetConsoleCtrlHandler SetEvent SetFileTime SetUnhandledExceptionFilter SizeofResource Sleep SystemTimeToFileTime TerminateProcess TlsGetValue VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory lstrcatW lstrcpynW

msvcrt

fwprintf _assert __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _setmode _wcmdln _wcsicmp _wcsnicmp abort atexit calloc exit fflush fprintf fputc fputwc free localeconv malloc memcpy memmove memset rand realloc setvbuf signal srand strerror strlen strncmp toupper vfprintf wcscat_s wcscpy_s wcslen wcsncat_s wcsncmp wcsrchr wcsstr wcstombs _fileno

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString

shell32

ShellExecuteExW

Name

.text

Size

106KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

208B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

google.exe

PE Signature issue

advapi32

bcrypt

kernel32

msvcrt

ole32

oleaut32

shell32

generic