popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

chromedriver.exe

Generic Malware Malicious Library UPX Malicious Packer MSOffice File PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 27, 2021, 2:19 p.m. Oct. 27, 2021, 2:20 p.m.
Size 10.7MB
Type PE32 executable (console) Intel 80386, for MS Windows
MD5 9e5141400fa79953543f744bac726cc8
SHA256 3cf646d073d566c9061d32777f7ec447fa966187c5066a5b60fb64f90d8c6960
CRC32 053F034E
ssdeep 196608:prkAebafA+00QbogTn7GFao8CESmwT/+ANWAs0QlhnsH1CdOs3iYjnzMTUHAkwQB:OPSA+00QbogTn7Ggo8CESmvANm0QlhnL
PDB Path chromedriver.exe.pdb
Yara
  • Malicious_Packer_Zero - Malicious Packer
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • Microsoft_Office_File_Zero - Microsoft Office File

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
13.230.135.153 Active Moloch
14.0.113.209 Active Moloch
34.202.213.193 Active Moloch
5.62.40.202 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

pdb_path chromedriver.exe.pdb
section .00cfg
section .rodata
section .voltbl
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1784
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x738d3000
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x002ea800', u'virtual_address': u'0x00796000', u'entropy': 7.433470984953431, u'name': u'.rdata', u'virtual_size': u'0x002ea704'} entropy 7.43347098495 description A section with a high entropy has been found
entropy 0.272258946889 description Overall entropy of this PE file is high
host 13.230.135.153
host 14.0.113.209
host 34.202.213.193
host 5.62.40.202