ChromePass.exe
First submission 2024-10-17 19:14:02
File details
| File type: | PE32 executable (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 234.5 KB (240128 bytes) |
| Compile time: | 2021-04-10 13:55:34 |
| MD5: | a892c43b0cf244f070f97fafdb224cf4 |
| SHA1: | 1bd3cedff1b38d8244af15a8d97e49884fd8a511 |
| SHA256: | 4b127e7b83148bfbe56bd83e4b95b2a4fdb69e1c9fa4e0c021a3bfb7b02d8a16 |
| Import Hash : | 1e5e3ffcadaf7ce3dde86165afb33e9f |
| Sections 4 | .text .rdata .data .rsrc |
| Directories 3 | import resource debug |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 53/77 VT report date: 2024-10-17 17:33:57 |
| Malware Type 3 | hacktool trojan pua |
| Threat Type 3 | chromepass chromepassview nirsoft |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://157.173.104.153/up/Tool/ChromePass.exe  |
157.173.104.153 |
2024-10-17 19:14:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0x2eeee | 192512 | 34c9e5cd9a8f1624081d7a6e45ed2f7852ddcae9 | 59f7534ecbbfbbe81e8dd5c36e901aed | |
| .rdata | 0x30000 | 0x788c | 31232 | fd3e27f50b2eb1c0af3c31ed6e8cc98eb0bc8acf | 485528108e9c44fc4b01bcc48373ab82 | |
| .data | 0x38000 | 0x4dbc | 3584 | 3b82f43ca514c0e42cf39a4d0d0867516a0d4827 | 228877751411da992ddeb1aede909868 | |
| .rsrc | 0x3d000 | 0x2cfe | 11776 | 56c43772790b15ad66155b64ce9dab6f14bdc573 | 8a65f2220c2a708e87ea638e9961cd31 |
PE Resources 10
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| BIN | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3d4f8 | 792 | |
| RT_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3d810 | 308 | |
| RT_BITMAP | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3de04 | 216 | |
| RT_MENU | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3e254 | 452 | |
| RT_DIALOG | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3efbc | 822 | |
| RT_STRING | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3f7ec | 104 | |
| RT_ACCELERATOR | LANG_HEBREW | SUBLANG_DEFAULT | 0x3f854 | 80 | |
| RT_GROUP_CURSOR | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3f8a4 | 20 | |
| RT_VERSION | LANG_HEBREW | SUBLANG_DEFAULT | 0x3f8b8 | 732 | |
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x3fb94 | 362 |
Meta infos 9
| LegalCopyright: | Copyright \xa9 2008 - 2021 Nir Sofer |
| InternalName: | ChromePass |
| FileVersion: | 1.55 |
| CompanyName: | NirSoft |
| ProductVersion: | 1.55 |
| FileDescription: | Chrome Password Recovery |
| Translation: | 0x0409 0x04b0 |
| OriginalFilename: | ChromePass |
| ProductName: | ChromePass |
Packers detected 1
| Microsoft Visual C++ v7.0 |
Anti debug functions 1
| GetLastError |
Strings analysis - File found
| XML |
| *.xml |
| Text |
| *.txt |
| Library |
| Bshell32.dll |
| KERNEL32.dll |
| SHLWAPI.dll |
| Bnetmsg.dll |
| BCrypt32.dll |
| COMCTL32.dll |
| Badvapi32.dll |
| PSAPI.DLL |
| ADVAPI32.dll |
| GDI32.dll |
| COMDLG32.dll |
| USER32.dll |
| MSVCRT.dll |
| SHELL32.dll |
| ole32.dll |
Strings analysis - Possible URLs found 1
| http://www.nirsoft.net/ |