google[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
google.exe
Size 17.3MB
Sample260930-plj17afb72
SHA256 30c8e1a601a73a6ad520431797be88e65483983eda23af10d8210ce0c77216e2
MD5 c7894dfa5288b360210ff72555b4cc5c
SHA1 3b1ad8f8c224fd7d4b32b33c77e330ee9220f095
SHA512 88c08a87a3fce32393dd726eb50fe6f50d89418b6c7ea30169460fbb8fb72d5c4673d10f97ee19cf14e83b3e11a5efc6afed2936f346f6445c169d72c9b699c7
SSDEEP 196608:sW5dppq4ul2/8Dw2wXmKP1SicUppqU4Rbm1l/QNbmvl/+icfppqU4iXmKPan5dp3:sgWfeFNSicGhpYiczLSDW9ep
TLSH
T14507330663435CCEC2258670A3A8F731F83CBA594951CE3FA6D0C53D1D72EA96D9A3E1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
google.exe

File Explorer

google.exe

.exe 17.3MB

google.exe

IMPHASH 2dd5bc106d0455fc2af48e0f94fd2f52
SHA256 30c8e1a601a73a6ad520431797be88e65483983eda23af10d8210ce0c77216e2
MD5 c7894dfa5288b360210ff72555b4cc5c
SHA1 3b1ad8f8c224fd7d4b32b33c77e330ee9220f095
SHA512 88c08a87a3fce32393dd726eb50fe6f50d89418b6c7ea30169460fbb8fb72d5c4673d10f97ee19cf14e83b3e11a5efc6afed2936f346f6445c169d72c9b699c7
SSDEEP 196608:sW5dppq4ul2/8Dw2wXmKP1SicUppqU4Rbm1l/QNbmvl/+icfppqU4iXmKPan5dp3:sgWfeFNSicGhpYiczLSDW9ep
TLSH
T14507330663435CCEC2258670A3A8F731F83CBA594951CE3FA6D0C53D1D72EA96D9A3E1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

87:44:ad:07:d9:a4:9d:b4:f3:67:2d:dd:ee:ad:3e:e6:26:9a:d7:59:ec:99:04:fc:75:d0:95:02:d9:e7:3b:1f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Google LLC

Chains

Sep 25, 2026

CN=Google LLC

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW DeleteService GetTokenInformation GetUserNameW OpenProcessToken OpenSCManagerW OpenServiceW QueryServiceStatus RegCloseKey RegCreateKeyExW RegDeleteTreeW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegisterServiceCtrlHandlerExW SetServiceStatus StartServiceCtrlDispatcherW StartServiceW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

crypt32

CertCreateCertificateContext CertFreeCertificateContext

kernel32

AddVectoredExceptionHandler CloseHandle CopyFileW CreateDirectoryW CreateEventW CreateFileA CreateFileW CreateMutexW CreateProcessW CreateRemoteThread CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection ExitProcess FindResourceA GetCPInfo GetCommandLineW GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentVariableW GetExitCodeProcess GetExitCodeThread GetFileAttributesW GetFileSize GetLastError GetLocalTime GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStartupInfoW GetTempPathA GetTempPathW GetTickCount HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryW LoadResource LockResource Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenMutexW OpenProcess Process32FirstW Process32NextW ProcessIdToSessionId QueryFullProcessImageNameW ReadFile RemoveDirectoryW RemoveVectoredExceptionHandler SetConsoleCtrlHandler SetEvent SetFileTime SetUnhandledExceptionFilter SizeofResource Sleep SystemTimeToFileTime TerminateProcess TlsGetValue VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory lstrcatW lstrcpynW

msvcrt

fwprintf _assert __C_specific_handler ___lc_codepage_func ___mb_cur_max_func __iob_func __set_app_type __setusermatherr __wgetmainargs __winitenv _amsg_exit _cexit _commode _errno _fmode _initterm _setmode _wcmdln _wcsicmp _wcsnicmp abort atexit calloc exit fflush fprintf fputc fputwc free localeconv malloc memcpy memmove memset rand realloc setvbuf signal srand strerror strlen strncmp toupper vfprintf wcscat_s wcscpy_s wcslen wcsncat_s wcsncmp wcsrchr wcsstr wcstombs _fileno

ole32

CoCreateInstance CoInitializeEx CoUninitialize

oleaut32

SysAllocString SysFreeString VariantClear VariantInit

shell32

ShellExecuteExW

Name

.text

Size

230KB

Virtual Size

230KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

448B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8.2MB

Virtual Size

8.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

7.9MB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

212B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

google.exe

PE Signature issue

advapi32

bcrypt

crypt32

kernel32

msvcrt

ole32

oleaut32

shell32

generic