chrome[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
chrome.exe
Size 1.8MB
Sample261104-1846esdx8x
SHA256 6dde3590ab830a8410cc24b99be44444c95cb503f6129a91308007e4a2df0f6e
MD5 ac131a20cd53abc0706772a6eb2e153e
SHA1 47be95c35408922002037c8b32314fef7e096004
SHA512 9727a2adc8a9c0e3ef8db8286d3f006a09d395d44236c7e55ff17c0bbe3d4ec25a0895edb5b7612848566ee38f9bbf0918c85ab788e52263433cfb8b1a59ac61
SSDEEP 24576:T6tsDSRApFu2JW8eq0/ygdNaPiInHMPcrIpst3zbqsXnN8MttpLvlPTl2Kh:2tsD7uQW+gfnInK2l7cKh
TLSH
T171858D1AA2E79299C0538538B823A343C6793C2513DA35CB4FEB7FAD1BF78E41572251
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
chrome.exe

File Explorer

chrome.exe

.exe 1.8MB

chrome.exe

IMPHASH b9c6ace6941bc7ba6c232210ec3523ff
SHA256 6dde3590ab830a8410cc24b99be44444c95cb503f6129a91308007e4a2df0f6e
MD5 ac131a20cd53abc0706772a6eb2e153e
SHA1 47be95c35408922002037c8b32314fef7e096004
SHA512 9727a2adc8a9c0e3ef8db8286d3f006a09d395d44236c7e55ff17c0bbe3d4ec25a0895edb5b7612848566ee38f9bbf0918c85ab788e52263433cfb8b1a59ac61
SSDEEP 24576:T6tsDSRApFu2JW8eq0/ygdNaPiInHMPcrIpst3zbqsXnN8MttpLvlPTl2Kh:2tsD7uQW+gfnInK2l7cKh
TLSH
T171858D1AA2E79299C0538538B823A343C6793C2513DA35CB4FEB7FAD1BF78E41572251
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

549504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptHashData BCryptCreateHash BCryptFinishHash BCryptDestroyHash BCryptVerifySignature BCryptDestroyKey BCryptImportKeyPair BCryptDecrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptSetProperty BCryptGenRandom

crypt32

CryptProtectData CryptUnprotectData CryptBinaryToStringA

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpSetOption WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpSendRequest WinHttpReceiveResponse WinHttpQueryHeaders WinHttpConnect WinHttpCloseHandle WinHttpOpen WinHttpCrackUrl WinHttpSetStatusCallback WinHttpReadData

shell32

SHGetFolderPathW SetCurrentProcessExplicitAppUserModelID ShellExecuteW

ncrypt

NCryptFinalizeKey NCryptSetProperty NCryptDecrypt NCryptExportKey NCryptSignHash NCryptDeleteKey NCryptFreeObject NCryptGetProperty NCryptCreatePersistedKey NCryptOpenKey NCryptEncrypt NCryptOpenStorageProvider

kernel32

HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW ExitThread CreateThread FlsFree LoadLibraryExW VirtualProtect HeapFree HeapAlloc UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlCaptureContext VirtualFree VirtualUnlock WideCharToMultiByte CloseHandle DuplicateHandle GetLastError SetLastError WaitForSingleObject Sleep GetCurrentProcess GetExitCodeProcess CreateRemoteThread TerminateThread FlushInstructionCache OpenProcess GetTickCount64 VirtualAllocEx VirtualProtectEx ReadProcessMemory WriteProcessMemory VirtualFreeEx FreeLibrary GetModuleFileNameW GetModuleHandleW GetModuleHandleExW GetProcAddress LoadLibraryA CreateToolhelp32Snapshot Process32FirstW Process32NextW Module32FirstW Module32NextW LoadLibraryW LocalFree MultiByteToWideChar GetSystemTimeAsFileTime VirtualAlloc VirtualLock OutputDebugStringA GlobalUnlock GetEnvironmentStringsW GlobalFree VerSetConditionMask QueryPerformanceCounter QueryPerformanceFrequency GetModuleHandleA GetLocaleInfoA IsDBCSLeadByte FlsSetValue FlsGetValue FlsAlloc RtlUnwindEx RtlLookupFunctionEntry RaiseException RtlPcToFileHeader InitializeSListHead GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo GetStringTypeW LCMapStringEx DecodePointer EncodePointer DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection WakeAllConditionVariable GetFileInformationByHandleEx FreeLibraryAndExitThread CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetLocaleInfoEx FormatMessageA SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive GetExitCodeThread GetCurrentThreadId WaitForSingleObjectEx GetProcessHeap FreeEnvironmentStringsW GetCommandLineW GetCommandLineA GlobalLock WriteFile SetStdHandle CreateFileW HeapSize SetEndOfFile WriteConsoleW GlobalAlloc RtlUnwind GetStdHandle TerminateProcess ExitProcess IsProcessorFeaturePresent ReadFile

user32

ScreenToClient ClientToScreen SetCursor SetCursorPos AdjustWindowRectEx GetPropA SetPropA ReleaseDC GetDC SetForegroundWindow GetForegroundWindow IsWindowUnicode GetKeyState SetFocus BringWindowToTop IsIconic SetLayeredWindowAttributes IsChild GetMessageExtraInfo TrackMouseEvent GetKeyboardLayout EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard ChangeWindowMessageFilterEx EnumDisplayMonitors GetMonitorInfoW MonitorFromPoint SystemParametersInfoW LoadCursorW IntersectRect GetWindowLongW SetWindowRgn UpdateWindow SetCapture GetCapture SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassExW UnregisterClassW PostQuitMessage DefWindowProcW PostMessageW PeekMessageW DispatchMessageW TranslateMessage RegisterWindowMessageW GetWindow GetWindowThreadProcessId EnumWindows EnumChildWindows GetWindowLongPtrW GetClientRect IsWindowVisible MonitorFromWindow FindWindowExW GetWindowRect GetClassNameW RemovePropW GetPropW SetPropW AllowSetForegroundWindow IsWindow SetWindowLongW WindowFromPoint SetWindowLongPtrW GetCursorPos ReleaseCapture

gdi32

CreateRoundRectRgn DeleteObject GetDeviceCaps

advapi32

RegGetValueW

dwmapi

DwmSetWindowAttribute

imm32

ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow ImmReleaseContext

d3dcompiler_47

D3DCompile

Name

.text

Size

703KB

Virtual Size

703KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bubbly_

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

497KB

Virtual Size

503KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

362KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

chrome.exe

bcrypt

crypt32

d3d11

winhttp

shell32

ncrypt

kernel32

user32

gdi32

advapi32

dwmapi

imm32

d3dcompiler_47

generic